@byokit/openclaw 0.9.0 → 0.11.0

package/dist/locks.js

@@ -0,0 +1,85 @@
+export function createLocks() {
+    const slots = new Map();
+    const slot = (id) => {
+        let s = slots.get(id);
+        if (!s) {
+            s = { readers: 0, writer: false, queue: [] };
+            slots.set(id, s);
+        }
+        return s;
+    };
+    // FIFO: an exclusive waiter blocks later shared waiters until the readers ahead of it drain.
+    const pump = (s) => {
+        if (s.writer)
+            return;
+        const head = s.queue[0];
+        if (!head)
+            return;
+        if (head.mode === 'exclusive') {
+            if (s.readers === 0) {
+                s.queue.shift();
+                s.writer = true;
+                head.grant();
+            }
+            return;
+        }
+        while (s.queue[0]?.mode === 'shared') {
+            const w = s.queue.shift();
+            s.readers++;
+            w.grant();
+        }
+    };
+    const acquire = (id, mode) => {
+        const s = slot(id);
+        if (mode === 'shared' && !s.writer && s.queue.every((w) => w.mode === 'shared')) {
+            s.readers++;
+            return Promise.resolve();
+        }
+        if (mode === 'exclusive' && !s.writer && s.readers === 0 && s.queue.length === 0) {
+            s.writer = true;
+            return Promise.resolve();
+        }
+        return new Promise((grant) => {
+            s.queue.push(mode === 'exclusive' ? { mode, grant: () => { s.writer = true; grant(); } } : { mode, grant });
+            pump(s);
+        });
+    };
+    const release = (id, mode) => {
+        const s = slot(id);
+        if (mode === 'shared')
+            s.readers = Math.max(0, s.readers - 1);
+        else
+            s.writer = false;
+        pump(s);
+        if (s.readers === 0 && !s.writer && s.queue.length === 0)
+            slots.delete(id);
+    };
+    return {
+        async shared(agentId, work) {
+            await acquire(agentId, 'shared');
+            try {
+                return await work();
+            }
+            finally {
+                release(agentId, 'shared');
+            }
+        },
+        async exclusive(agentIds, work) {
+            // Sorted so two exclusive takes over overlapping sets cannot deadlock each other.
+            const ids = [...new Set(agentIds)].sort();
+            for (const id of ids)
+                await acquire(id, 'exclusive');
+            try {
+                return await work();
+            }
+            finally {
+                for (const id of [...ids].reverse())
+                    release(id, 'exclusive');
+            }
+        },
+        live(agentId) {
+            const s = slots.get(agentId);
+            return !!s && (s.readers > 0 || s.writer);
+        },
+    };
+}

package/dist/members.d.ts

@@ -1,6 +1,7 @@
 import type { GatewayTransport, Member } from './types.ts';
 export declare const MEMBER_ID: RegExp;
 export declare const KEY_PREFIX = "byokit-key-";
+export declare const BASE_AGENT = "byokit-base";
 export declare const keyAgentId: (member: Member) => string;
 export declare function createMembers(ctx: {
     request: GatewayTransport['request'];

package/dist/members.js

@@ -1,6 +1,13 @@
 import { join } from 'node:path';
+// Any member that may run: D9's older rule, which a member created before O14 still matches (D17).
 export const MEMBER_ID = /^[a-z][a-z0-9-]{0,31}$/;
+// D9 for a member the kit creates: no `--` (account agents are `<member>--<6 hex>`) and at most 24 characters.
+const NEW_MEMBER_ID = /^[a-z](?!.*--)[a-z0-9-]{0,23}$/;
 export const KEY_PREFIX = 'byokit-key-';
+// The inherited auth base every agent reads through (5.15): the kit never creates, signs in to or runs it.
+export const BASE_AGENT = 'byokit-base';
+// The engine's own agents (`main` exists on every install) and the base are never a member, existing or not.
+const RESERVED = new Set(['main', 'openclaw', 'crestodian', BASE_AGENT]);
 export const keyAgentId = (member) => `${KEY_PREFIX}${member}`;
 // The engine answers agents.create before its roster hot-reload applies (up to ~113 ms observed), so a turn sent
 // at once fails as 'unknown agent id'. ensure resolves only once agents.list shows the member.
@@ -10,14 +17,17 @@ export function createMembers(ctx) {
     const cache = new Map();
     const listed = (member) => ctx.request('agents.list').then((list) => list.agents.some((agent) => agent.id === member));
     return { ensure(member) {
-            if (!MEMBER_ID.test(member) || member.startsWith(KEY_PREFIX))
-                return Promise.reject(new Error(`invalid member id: ${member}`));
+            const invalid = () => new Error(`invalid member id: ${member}`);
+            if (!MEMBER_ID.test(member) || member.startsWith(KEY_PREFIX) || RESERVED.has(member))
+                return Promise.reject(invalid());
             const existing = cache.get(member);
             if (existing)
                 return existing;
             const workspace = join(ctx.root, 'workspaces', member);
             const result = (async () => {
                 if (!await listed(member)) {
+                    if (!NEW_MEMBER_ID.test(member) || member.startsWith('byokit-'))
+                        throw invalid();
                     await ctx.request('agents.create', { name: member, workspace });
                     const deadline = Date.now() + VISIBLE_TIMEOUT_MS;
                     while (!await listed(member)) {

package/dist/pick.d.ts

@@ -0,0 +1,11 @@
+import type { Account, AccountId, AccountPick, Considered, Defaults, ModelInfo, PickWhy, Room, RunSelection } from './types.ts';
+export type RoomOf = (a: Account, demand: readonly string[]) => Room;
+/** Every account's `Considered` row, in list order, with the kit-only `bound` applied. */
+export declare function consider(accounts: readonly Account[], defaults: Defaults, sel: RunSelection, room: RoomOf, nowMs: number, models?: (a: Account) => readonly ModelInfo[], bound?: readonly AccountId[]): Considered[];
+/** Auto's winner only; `candidates` are the eligible accounts. Pure and portable; no timers, reads or mid-run switching. */
+export declare function chooseAccount(candidates: readonly Account[], room: (a: Account) => Room, nowMs: number): {
+    account: Account;
+    why: PickWhy;
+} | undefined;
+/** Resolve once before starting. Without `models`, membership is host-validated and a missing model is ''. */
+export declare function resolveSelection(accounts: readonly Account[], defaults: Defaults, sel: RunSelection, room: RoomOf, nowMs: number, models?: (a: Account) => readonly ModelInfo[], bound?: readonly AccountId[]): AccountPick;

package/dist/pick.js

@@ -0,0 +1,145 @@
+import { words } from "./words.js";
+const DAY_MS = 24 * 60 * 60 * 1000;
+const finite = (n) => typeof n === 'number' && Number.isFinite(n);
+const reset = (r) => r.resetsAt ?? Infinity;
+const roomWords = (left, span) => words(`room.${span}`, { left: `${Math.round(left)}%` });
+// "3:40pm", or "Fri 3:40pm" when it isn't today (matches @byokit/accounts' clock).
+const clock = (t) => (new Date(t).toDateString() === new Date().toDateString() ? '' : new Date(t).toLocaleDateString('en-US', { weekday: 'short' }) + ' ') +
+    new Date(t).toLocaleTimeString('en-US', { hour: 'numeric', minute: '2-digit' }).toLowerCase();
+// One shared eligibility predicate for direct picks, Auto and every explanation row. Room is read once per row.
+// `bound` (kit only) is the accounts a conversation may use; an account outside it is never a candidate, even when
+// the selection names it, and its row carries `out: 'bound'`. An account the selection names is judged only on
+// `bound` and the demand, so an API-key or resting account it names carries no `billing`/`resting` `out`.
+function considerRows(accounts, room, nowMs, demand = [], models, provider, named, bound) {
+    return accounts.map((account) => {
+        const r = room(account);
+        const age = finite(r.at) ? Math.max(0, nowMs - r.at) : 'unknown';
+        const stale = typeof age === 'number' && age > DAY_MS;
+        const left = r.left === 'unknown' || !finite(r.left) || stale ? 'unknown' : Math.max(0, Math.min(100, r.left));
+        const row = { id: account.id, left, age,
+            confidence: stale ? 'stale' : left === 'unknown' || age === 'unknown' ? 'unknown' : 'known', reason: 'no_reading' };
+        if (r.left !== 'unknown') {
+            row.span = r.span;
+            if (finite(r.resetsAt))
+                row.resetsAt = r.resetsAt;
+        }
+        if (bound !== undefined && !bound.includes(account.id))
+            row.out = 'bound';
+        if (!row.out && account.id !== named) {
+            if (account.state === 'resting' && finite(account.until) && account.until > nowMs) {
+                row.out = 'resting';
+                row.until = account.until;
+            }
+            else if (account.state !== 'ready' && !(account.state === 'resting' && finite(account.until) && account.until <= nowMs))
+                row.out = 'state';
+            else if (account.billing !== 'subscription')
+                row.out = 'billing';
+        }
+        if (!row.out && demand.length && models) {
+            const available = models(account);
+            const missing = demand.find((id) => !available.some((m) => m.id === id && m.available));
+            if (missing !== undefined) {
+                row.out = 'model';
+                row.missing = missing;
+            }
+        }
+        if (!row.out && !demand.length && provider !== undefined && account.provider !== provider && account.id !== named)
+            row.out = 'provider';
+        if (row.out)
+            row.reason = row.out;
+        else
+            row.tier = left === 'unknown' ? 'unknown' : left > 0 || reset(row) <= nowMs ? 'room' : 'exhausted';
+        return { account, row };
+    });
+}
+/** Every account's `Considered` row, in list order, with the kit-only `bound` applied. */
+export function consider(accounts, defaults, sel, room, nowMs, models, bound) {
+    const demand = [...new Set([...(sel.model ? [sel.model] : []), ...(sel.needs ?? [])])];
+    const defaultAccount = accounts.find((a) => a.id === defaults.account);
+    const named = nameOf(accounts, defaults, sel, bound);
+    const provider = sel.provider ?? defaultAccount?.provider ?? accounts[0]?.provider;
+    return considerRows(accounts, (a) => room(a, demand), nowMs, demand, models, provider, named, bound).map((c) => c.row);
+}
+const tierOrder = { room: 0, unknown: 1, exhausted: 2 };
+function compare(a, b) {
+    const tier = tierOrder[a.row.tier] - tierOrder[b.row.tier];
+    if (tier)
+        return tier;
+    if (a.row.tier === 'unknown')
+        return 0;
+    if (a.row.tier === 'room' && a.row.left !== b.row.left)
+        return Number(b.row.left) - Number(a.row.left);
+    // Avoid Infinity - Infinity (NaN); stable sort preserves list order for ties.
+    return reset(a.row) === reset(b.row) ? 0 : reset(a.row) < reset(b.row) ? -1 : 1;
+}
+function rankingReason(winner, next) {
+    if (winner.row.tier === 'unknown')
+        return 'no_reading';
+    if (winner.row.tier === 'exhausted')
+        return 'refills_first';
+    if (!next || next.row.tier !== 'room' || winner.row.left !== next.row.left)
+        return 'most_room';
+    return reset(winner.row) < reset(next.row) ? 'earlier_reset' : 'list_order';
+}
+function rank(rows) {
+    const ranked = rows.filter((c) => !c.row.out).sort(compare);
+    const winner = ranked[0];
+    if (!winner)
+        return undefined;
+    const why = ranked.length === 1 ? 'only' : rankingReason(winner, ranked[1]);
+    for (const c of ranked)
+        c.row.reason = c === winner ? why : rankingReason(winner, c);
+    return { account: winner.account, why, row: winner.row };
+}
+/** Auto's winner only; `candidates` are the eligible accounts. Pure and portable; no timers, reads or mid-run switching. */
+export function chooseAccount(candidates, room, nowMs) {
+    const pick = rank(considerRows(candidates, room, nowMs));
+    return pick && { account: pick.account, why: pick.why };
+}
+// The `'default'` id is the saved default account when it is ready, a subscription (or a non-custom API choice) and
+// in `bound`; a default outside `bound` is treated as not ready (its row has `out: 'bound'`) and the pick falls through.
+function nameOf(accounts, defaults, sel, bound) {
+    const defaultAccount = accounts.find((a) => a.id === defaults.account);
+    const usable = defaultAccount?.state === 'ready' &&
+        (defaultAccount.billing === 'subscription' || (defaultAccount.billing === 'api' && defaultAccount.provider !== 'custom')) &&
+        (bound === undefined || bound.includes(defaultAccount.id));
+    return sel.account === 'default' ? (usable ? defaultAccount.id : undefined) : sel.account === 'auto' ? undefined : sel.account;
+}
+/** Resolve once before starting. Without `models`, membership is host-validated and a missing model is ''. */
+export function resolveSelection(accounts, defaults, sel, room, nowMs, models, bound) {
+    const demand = [...new Set([...(sel.model ? [sel.model] : []), ...(sel.needs ?? [])])];
+    const defaultAccount = accounts.find((a) => a.id === defaults.account);
+    const named = nameOf(accounts, defaults, sel, bound);
+    const provider = sel.provider ?? defaultAccount?.provider ?? accounts[0]?.provider;
+    const rows = considerRows(accounts, (a) => room(a, demand), nowMs, demand, models, provider, named, bound);
+    const considered = rows.map((c) => c.row);
+    const auto = rank(rows); // also fills explanations for every eligible row, even on explicit selection
+    if (named !== undefined) {
+        const chosen = rows.find((c) => c.account.id === named);
+        if (!chosen)
+            return { ok: false, code: 'unknown_account', reason: words('auto.none', { provider: provider ?? '' }), considered };
+        if (chosen.row.out)
+            return { ok: false, code: 'not_included', reason: words(`pick.out.${chosen.row.out}`, { model: chosen.row.missing ?? '' }), considered };
+        return finish(chosen.account, chosen.row, sel.account === 'default' ? 'default' : 'chosen', sel.account === 'default' ? 'default' : 'chosen');
+    }
+    if (sel.account === 'default' && defaults.auto === false) {
+        const first = rows.find((c) => !c.row.out);
+        if (first)
+            return finish(first.account, first.row, 'default', 'first_ready');
+    }
+    else if (auto)
+        return finish(auto.account, auto.row, 'auto', auto.why);
+    return { ok: false, code: 'none', reason: words('auto.none', { provider: provider ?? '' }), considered };
+    function finish(account, row, how, why) {
+        const available = models?.(account).filter((m) => m.available);
+        const model = sel.model ?? (defaults.model && (!available || available.some((m) => m.id === defaults.model)) ? defaults.model : available?.[0]?.id) ?? '';
+        if (models && !model)
+            return { ok: false, code: 'not_included', reason: words('pick.out.model', { model: sel.model ?? '' }), considered };
+        row.reason = why;
+        const slots = { name: account.name, provider: account.provider };
+        const reason = how !== 'auto' ? words(`pick.why.${why}`, slots) : row.tier === 'unknown' ? words('auto.unknown', slots) : row.tier === 'exhausted' ?
+            words(finite(row.resetsAt) ? 'auto.refills' : 'auto.refillsNoTime', { ...slots, time: finite(row.resetsAt) ? clock(row.resetsAt) : '' }) :
+            words('auto.room', { ...slots, room: roomWords(Number(row.left), row.span ?? 'tightest') });
+        return { ok: true, account, model, how, why, reason, considered };
+    }
+}

package/dist/signin.d.ts

@@ -21,4 +21,5 @@ export declare function signIn(ctx: SignInCtx, member: Member, o: SignInOptions,
 };
 /** Usable provider profiles plus native Claude Code readiness reported by the engine. */
 export declare function providers(ctx: SignInCtx, member: Member, refresh?: boolean): Promise<string[]>;
+/** Signs the member's agent out of its own profiles of `provider` only (5.7, 5.15). */
 export declare function signOut(ctx: SignInCtx, member: Member, provider: string): Promise<void>;

package/dist/signin.js

@@ -433,7 +433,19 @@ export async function providers(ctx, member, refresh) {
     return signedInProviders(await (ctx.authStatus ? ctx.authStatus(agentId, refresh ?? false, true)
         : authStatus(ctx.request, agentId, refresh, true))) ?? [];
 }
+/** Signs the member's agent out of its own profiles of `provider` only (5.7, 5.15). */
 export async function signOut(ctx, member, provider) {
     const { agentId } = await ctx.ensure(member);
-    await ctx.request('models.authLogout', { provider, agentId }, { timeoutMs: STATUS_MS });
+    // Without profileIds the pin removes the provider's profiles from every owner store, another member's included.
+    // The inherited base is empty (5.15), so every profile this agent's status lists is its own.
+    const read = (refresh) => ctx.authStatus ? ctx.authStatus(agentId, refresh, false) : authStatus(ctx.request, agentId, refresh);
+    let status = await read(false);
+    if (status.unavailable)
+        status = await read(true); // no prepared snapshot yet: build it once
+    if (status.unavailable)
+        throw new Error(String(status.unavailable.message ?? 'account status unavailable'));
+    const profileIds = (status.providers ?? []).flatMap((row) => typeof row === 'string' || row.provider !== provider ? []
+        : (row.profiles ?? []).map((p) => p.profileId).filter((id) => typeof id === 'string' && id !== ''));
+    if (profileIds.length)
+        await ctx.request('models.authLogout', { provider, agentId, profileIds }, { timeoutMs: STATUS_MS });
 }

package/dist/testing/contract.js

@@ -18,7 +18,6 @@ const REQUIRED_METHODS = [
     'plugin.approval.resolve', 'question.resolve', 'wizard.cancel', 'wizard.next',
 ];
 // Driven by the kit but not advertised in hello (O11 probe, e.g. sessions.steer): routable, just not listed.
-// The engine job's generated.test.ts audits the full generated table against hello instead of asserting it here.
 const REQUIRED_EVENTS = [
     'agent',
     'exec.approval.requested', 'exec.approval.resolved',

package/dist/testing/fake-gateway.js

@@ -2,7 +2,7 @@
 // `new OpenClawKit({ transport: fake.factory, spawnEngine: false, ... })` or drive `fake.transport.request`
 // directly. No engine, no network, no account.
 import { connect } from 'node:net';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { ENGINE_VERSION, PROTOCOL_VERSION } from "../constants.js";
@@ -23,6 +23,12 @@ const EVENTS = [
 /** Window between a run's last event and its completion, so an abort issued on the text event still lands. */
 const ABORT_WINDOW_MS = 25;
 const BRIDGE_TIMEOUT_MS = 30_000;
+// The plugin's accounts.js status thresholds: auth selection's refresh margin and auth-health's oauth warn window.
+const EXPIRING_MS = 300_000;
+const OAUTH_WARN_MS = 86_400_000;
+// The plugin's account agent shape (D9) and agent id shape, as plugin/accounts.js tests them.
+const ACCOUNT_AGENT = /--[0-9a-f]{6}$/;
+const AGENT_ID = /^[a-z][a-z0-9-]{0,31}$/;
 const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 function mergeInto(target, patch) {
     for (const [key, value] of Object.entries(patch)) {
@@ -100,6 +106,9 @@ export function fakeGateway(script, o) {
     const handlers = new Map();
     const agents = new Map();
     const keys = new Map();
+    const profiles = new Map();
+    const orders = new Map();
+    const models = new Map();
     const wizards = new Map();
     const runs = new Map();
     const configBox = { hash: 'hash-1', config: {} };
@@ -114,10 +123,92 @@ export function fakeGateway(script, o) {
             agent.workspace = workspace;
         return agent;
     };
-    const signInAgent = (id, provider) => {
+    const storeOf = (id) => {
+        let store = profiles.get(id);
+        if (!store) {
+            store = {};
+            profiles.set(id, store);
+        }
+        return store;
+    };
+    const orderOf = (id) => {
+        let order = orders.get(id);
+        if (!order) {
+            order = {};
+            orders.set(id, order);
+        }
+        return order;
+    };
+    // As the plugin's accounts.js: `who` only exists for an OAuth profile that stores a provider account id.
+    const whoOf = (credential) => credential.type === 'oauth' && typeof credential.accountId === 'string' && credential.accountId.length > 0
+        ? createHash('sha256').update(`${credential.provider}\n${credential.accountId}`).digest('hex').slice(0, 16) : undefined;
+    const hasSecret = (value, ref) => (typeof value === 'string' && value.length > 0) || (!!ref && typeof ref === 'object' && !Array.isArray(ref));
+    // The plugin's token expiry state (credential-state.ts): missing, invalid, expired, or valid.
+    const expiryState = (expires, now) => {
+        if (expires === undefined)
+            return 'missing';
+        if (typeof expires !== 'number' || !Number.isFinite(expires) || expires <= 0 || expires > 8.64e13)
+            return 'invalid';
+        return expires <= now ? 'expired' : 'valid';
+    };
+    // The plugin's profile status (auth-health.ts) from the credential alone: static, ok, expiring, expired or missing.
+    const statusOf = (credential, now) => {
+        if (credential.type === 'api_key')
+            return hasSecret(credential.key, credential.keyRef) ? 'static' : 'missing';
+        if (credential.type === 'token') {
+            if (!hasSecret(credential.token, credential.tokenRef))
+                return 'missing';
+            const state = expiryState(credential.expires, now);
+            if (state === 'invalid')
+                return 'missing';
+            if (state === 'expired')
+                return 'expired';
+            if (credential.expires === undefined)
+                return 'static';
+            return credential.expires - now <= EXPIRING_MS ? 'expiring' : 'ok';
+        }
+        if (!hasSecret(credential.access, undefined) && !hasSecret(credential.refresh, undefined))
+            return 'missing';
+        const expires = credential.expires;
+        const state = expiryState(expires, now);
+        if (state === 'invalid' || state === 'missing')
+            return 'missing';
+        if (state === 'expired')
+            return 'expired';
+        return expires - now <= OAUTH_WARN_MS ? 'expiring' : 'ok';
+    };
+    const entryPrimaryOf = (id) => {
+        const entries = configBox.config.agents?.entries;
+        const entry = entries?.[id];
+        const ref = entry?.model;
+        if (typeof ref === 'string')
+            return ref;
+        if (isPlainObject(ref) && typeof ref.primary === 'string')
+            return ref.primary;
+        return undefined;
+    };
+    const primaryOfId = (id) => entryPrimaryOf(id) ?? models.get(id);
+    const setPrimaryOfId = (id, primary) => {
+        models.set(id, primary);
+        const entries = configBox.config.agents?.entries;
+        const entry = entries?.[id];
+        if (entry && isPlainObject(entry)) {
+            const current = entry.model;
+            if (isPlainObject(current))
+                current.primary = primary;
+            else
+                entry.model = primary;
+        }
+    };
+    const signInAgent = (id, provider, extra) => {
         const agent = ensureAgent(id);
         if (!agent.providers.includes(provider))
             agent.providers.push(provider);
+        // The pin names the first profile of a provider `<provider>:default` and points the agent's model at it.
+        storeOf(id)[`${provider}:default`] = { provider, type: 'oauth', status: 'ok', access: 'fake-access',
+            refresh: 'fake-refresh', expires: Date.now() + 30 * 86_400_000, accountId: `fake-${id}`, ...extra };
+        orderOf(id)[provider] = [`${provider}:default`];
+        setPrimaryOfId(id, `${provider}/default@${provider}:default`);
     };
     // Every transport the factory made; events fan out to all of them, drop() closes all of them.
     const live = new Set();
@@ -222,13 +313,40 @@ export function fakeGateway(script, o) {
                 ensureAgent(id, workspace);
             return { id };
         },
-        'models.authStatus': (p) => ({
-            providers: (agents.get(String(p?.agentId ?? 'main'))?.providers ?? []).map((provider) => ({ provider })),
-        }),
+        // One profile per signed-in provider, `<provider>:default`, as the pin lists an agent's own profiles.
+        'models.authStatus': (p) => {
+            const id = String(p?.agentId ?? 'main');
+            const store = storeOf(id);
+            const now = Date.now();
+            return {
+                providers: (agents.get(id)?.providers ?? []).map((provider) => {
+                    const profileId = `${provider}:default`;
+                    const credential = store[profileId];
+                    return { provider,
+                        profiles: [{ profileId, type: credential?.type ?? 'oauth',
+                                status: credential ? statusOf(credential, now) : 'ok' }] };
+                }),
+            };
+        },
         'models.authLogout': (p) => {
             const agent = agents.get(String(p?.agentId ?? 'main'));
+            // The pin refuses a profileIds list naming a profile the agent does not hold.
+            if (p.profileIds !== undefined && (!Array.isArray(p.profileIds) || !p.profileIds.length
+                || p.profileIds.some((id) => id !== `${p.provider}:default` || !agent?.providers.includes(String(p.provider)))))
+                throw new Error('profileIds contain unavailable auth profiles');
             if (agent)
                 agent.providers = agent.providers.filter((provider) => provider !== p.provider);
+            const store = profiles.get(String(p.agentId ?? 'main'));
+            if (store)
+                for (const profileId of Object.keys(store))
+                    if (store[profileId].provider === p.provider)
+                        delete store[profileId];
+            const order = orders.get(String(p.agentId ?? 'main'));
+            if (order)
+                delete order[String(p.provider)];
+            const pin = models.get(String(p.agentId ?? 'main'));
+            if (typeof pin === 'string' && pin.includes(`@${String(p.provider)}:`))
+                models.delete(String(p.agentId ?? 'main'));
             if (keys.get(String(p.agentId))?.provider === p.provider)
                 keys.delete(String(p.agentId));
             return {};
@@ -249,6 +367,102 @@ export function fakeGateway(script, o) {
             }
             return { ok: key.sealed, ...(key.sealed ? { model: key.model } : {}) };
         },
+        // Account sealing (5.15): the same five actions, branches and refusals the shipped plugin method serves.
+        'byokit.accounts': (p) => {
+            const action = String(p.action ?? '');
+            const entries = configBox.config.agents?.entries;
+            const known = (id) => Boolean(id) && AGENT_ID.test(id) && ((Boolean(entries) && id in entries) || agents.has(id));
+            if (action === 'adopt') {
+                const from = String(p.from), to = String(p.to), provider = String(p.provider);
+                if (from === to || !known(from) || !known(to))
+                    return { ok: false };
+                if (typeof p.who !== 'string' || !p.who)
+                    return { ok: false };
+                const fromOrder = orderOf(from), named = fromOrder[provider] ?? [];
+                const fromId = named.length === 1 ? named[0] : undefined;
+                const credential = fromId ? storeOf(from)[fromId] : undefined;
+                if (!fromId || !credential || credential.provider !== provider || whoOf(credential) !== p.who)
+                    return { ok: false };
+                const target = primaryOfId(to);
+                if (typeof target !== 'string')
+                    return { ok: false };
+                const toStore = storeOf(to), toOrder = orderOf(to);
+                for (const [otherId, other] of Object.entries(toStore))
+                    if (ACCOUNT_AGENT.test(to) ? otherId !== fromId : other.provider === provider && otherId !== fromId)
+                        delete toStore[otherId];
+                toStore[fromId] = credential;
+                toOrder[provider] = [fromId];
+                if (!ensureAgent(to).providers.includes(provider))
+                    ensureAgent(to).providers.push(provider);
+                delete storeOf(from)[fromId];
+                if (fromOrder[provider]) {
+                    fromOrder[provider] = fromOrder[provider].filter((x) => x !== fromId);
+                    if (!fromOrder[provider].length)
+                        delete fromOrder[provider];
+                }
+                if (!Object.values(storeOf(from)).some((c) => c.provider === provider))
+                    ensureAgent(from).providers = ensureAgent(from).providers.filter((x) => x !== provider);
+                const cut = target.lastIndexOf('@');
+                setPrimaryOfId(to, `${cut > 0 ? target.slice(0, cut) : target}@${fromId}`);
+                return { ok: true };
+            }
+            const id = String(p.agentId ?? '');
+            if (!known(id))
+                return { ok: false };
+            const store = storeOf(id), order = orderOf(id);
+            if (action === 'list')
+                return { ok: true, profiles: Object.entries(store).map(([profileId, credential]) => ({ provider: credential.provider,
+                        profileId, type: credential.type, status: statusOf(credential, Date.now()), ...(whoOf(credential) ? { who: whoOf(credential) } : {}) })) };
+            if (action === 'clear') {
+                profiles.set(id, {});
+                orders.set(id, {});
+                const cleared = agents.get(id);
+                if (cleared)
+                    cleared.providers = [];
+                return { ok: true };
+            }
+            if (action === 'ready') {
+                const provider = String(p.provider ?? '');
+                const named = order[provider] ?? [];
+                const credential = named.length === 1 ? store[named[0]] : undefined;
+                if (!provider || !credential || credential.provider !== provider)
+                    return { ok: false };
+                const status = statusOf(credential, Date.now());
+                if (status === 'missing' || status === 'expired')
+                    return { ok: false };
+                return { ok: true, type: credential.type, ...(typeof credential.expires === 'number' ? { expiresAt: credential.expires } : {}),
+                    ...(whoOf(credential) ? { who: whoOf(credential) } : {}) };
+            }
+            if (action === 'seal') {
+                const primary = primaryOfId(id) ?? '';
+                const at = primary.lastIndexOf('@');
+                if (at < 1)
+                    return { ok: false };
+                const profileId = primary.slice(at + 1);
+                const credential = store[profileId];
+                const account = ACCOUNT_AGENT.test(id);
+                if (!credential || credential.provider !== p.provider || (!account && credential.type === 'api_key'))
+                    return { ok: false };
+                for (const [otherId, other] of Object.entries(store))
+                    if (account ? otherId !== profileId : other.provider === p.provider && otherId !== profileId)
+                        delete store[otherId];
+                // An account agent's whole order is replaced; a member's keeps its other providers, as plugin/accounts.js does.
+                const provider = String(p.provider);
+                if (account)
+                    orders.set(id, { [provider]: [profileId] });
+                else
+                    order[provider] = [profileId];
+                const sealedAgent = agents.get(id);
+                if (sealedAgent) {
+                    if (account)
+                        sealedAgent.providers = [provider];
+                    else if (!sealedAgent.providers.includes(provider))
+                        sealedAgent.providers.push(provider);
+                }
+                return { ok: true, ...(whoOf(credential) ? { who: whoOf(credential) } : {}) };
+            }
+            return { ok: false };
+        },
         'openclaw.setup.activate': (p) => {
             if (p.kind !== 'api-key')
                 throw new Error('only the API-key setup path is simulated');
@@ -391,8 +605,7 @@ export function fakeGateway(script, o) {
     const hello = () => ({
         protocol: PROTOCOL_VERSION,
         server: { version: ENGINE_VERSION },
-        // The methods the fake serves. The generated tables are type-only until O2 ships runtime names; O11's
-        // generated.test.ts cross-checks the real engine's hello against the committed tables.
+        // The methods the fake serves. The generated tables are type-only until O2 ships runtime names.
         methods: [...handlers.keys()].sort(),
         events: [...EVENTS],
     });