@code-yeongyu/senpi 2026.9.22-2 → 2026.9.22-3

package/dist/core/auth-provider-key-migration.d.ts

@@ -0,0 +1,27 @@
+import type { Credential } from "@earendil-works/pi-ai";
+type AuthStorageData = Record<string, Credential>;
+/**
+ * One-shot auth.json provider-key migration for the provider rename (#1989):
+ * a credential stored under a legacy provider id (`openai-codex`,
+ * `claude-sdk-oauth`) is rewritten under its canonical id
+ * (`chatgpt-subscription`, `anthropic-subscription`).
+ *
+ * Completion is derived from the data, not a migrations-state marker: once the
+ * legacy key is absent the function is a no-op, so a busy credential store can
+ * skip a load and retry later, and an older binary re-introducing a legacy key
+ * after the fact still gets migrated. The credential object moves VERBATIM —
+ * pools (`accounts`, `login-N` names, `pinned`, `slotState`) and the
+ * managed-sentinel values inside the flat fields are preserved under the new
+ * key, byte for byte.
+ *
+ * Conflict rule: when both keys hold an entry, the canonical entry wins and
+ * the legacy entry is removed from the live file only — the timestamped backup
+ * taken before the rewrite still holds it. Entries are never merged: one
+ * single-use OAuth grant must not end up with two refresh owners.
+ */
+export declare function migrateLegacyProviderKeys(data: AuthStorageData): {
+    data: AuthStorageData;
+    migrated: boolean;
+};
+export {};
+//# sourceMappingURL=auth-provider-key-migration.d.ts.map

package/dist/core/auth-provider-key-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider-key-migration.d.ts","sourceRoot":"","sources":["../../src/core/auth-provider-key-migration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGxD,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAMlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAc7G"}

package/dist/core/auth-provider-key-migration.js

@@ -0,0 +1,40 @@
+import { LEGACY_PROVIDER_IDS } from "@earendil-works/pi-ai";
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * One-shot auth.json provider-key migration for the provider rename (#1989):
+ * a credential stored under a legacy provider id (`openai-codex`,
+ * `claude-sdk-oauth`) is rewritten under its canonical id
+ * (`chatgpt-subscription`, `anthropic-subscription`).
+ *
+ * Completion is derived from the data, not a migrations-state marker: once the
+ * legacy key is absent the function is a no-op, so a busy credential store can
+ * skip a load and retry later, and an older binary re-introducing a legacy key
+ * after the fact still gets migrated. The credential object moves VERBATIM —
+ * pools (`accounts`, `login-N` names, `pinned`, `slotState`) and the
+ * managed-sentinel values inside the flat fields are preserved under the new
+ * key, byte for byte.
+ *
+ * Conflict rule: when both keys hold an entry, the canonical entry wins and
+ * the legacy entry is removed from the live file only — the timestamped backup
+ * taken before the rewrite still holds it. Entries are never merged: one
+ * single-use OAuth grant must not end up with two refresh owners.
+ */
+export function migrateLegacyProviderKeys(data) {
+    let next;
+    for (const [legacyId, canonicalId] of Object.entries(LEGACY_PROVIDER_IDS)) {
+        const legacy = data[legacyId];
+        // Only plain-object entries move; anything else found on the key stays
+        // put for a human to inspect rather than being renamed blind.
+        if (!isPlainObject(legacy))
+            continue;
+        next ??= { ...data };
+        delete next[legacyId];
+        if (next[canonicalId] === undefined) {
+            next[canonicalId] = legacy;
+        }
+    }
+    return next ? { data: next, migrated: true } : { data, migrated: false };
+}
+//# sourceMappingURL=auth-provider-key-migration.js.map

package/dist/core/auth-provider-key-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider-key-migration.js","sourceRoot":"","sources":["../../src/core/auth-provider-key-migration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAI5D,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC9D,IAAI,IAAiC,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,IAAI,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,GAAG,MAAoB,CAAC;QAC1C,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC","sourcesContent":["import type { Credential } from \"@earendil-works/pi-ai\";\nimport { LEGACY_PROVIDER_IDS } from \"@earendil-works/pi-ai\";\n\ntype AuthStorageData = Record<string, Credential>;\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * One-shot auth.json provider-key migration for the provider rename (#1989):\n * a credential stored under a legacy provider id (`openai-codex`,\n * `claude-sdk-oauth`) is rewritten under its canonical id\n * (`chatgpt-subscription`, `anthropic-subscription`).\n *\n * Completion is derived from the data, not a migrations-state marker: once the\n * legacy key is absent the function is a no-op, so a busy credential store can\n * skip a load and retry later, and an older binary re-introducing a legacy key\n * after the fact still gets migrated. The credential object moves VERBATIM —\n * pools (`accounts`, `login-N` names, `pinned`, `slotState`) and the\n * managed-sentinel values inside the flat fields are preserved under the new\n * key, byte for byte.\n *\n * Conflict rule: when both keys hold an entry, the canonical entry wins and\n * the legacy entry is removed from the live file only — the timestamped backup\n * taken before the rewrite still holds it. Entries are never merged: one\n * single-use OAuth grant must not end up with two refresh owners.\n */\nexport function migrateLegacyProviderKeys(data: AuthStorageData): { data: AuthStorageData; migrated: boolean } {\n\tlet next: AuthStorageData | undefined;\n\tfor (const [legacyId, canonicalId] of Object.entries(LEGACY_PROVIDER_IDS)) {\n\t\tconst legacy = data[legacyId];\n\t\t// Only plain-object entries move; anything else found on the key stays\n\t\t// put for a human to inspect rather than being renamed blind.\n\t\tif (!isPlainObject(legacy)) continue;\n\t\tnext ??= { ...data };\n\t\tdelete next[legacyId];\n\t\tif (next[canonicalId] === undefined) {\n\t\t\tnext[canonicalId] = legacy as Credential;\n\t\t}\n\t}\n\treturn next ? { data: next, migrated: true } : { data, migrated: false };\n}\n"]}

package/dist/core/auth-storage.d.ts

@@ -28,6 +28,17 @@ export declare class FileAuthStorageBackend implements AuthStorageBackend {
     constructor(authPath?: string);
     private ensureParentDir;
     private ensureFileExists;
+    /**
+     * Atomic credential write: stage a 0o600 temp file beside the store and
+     * rename it over the target. An existing store may carry an
+     * administrator-set mode; it is copied onto the temp before the rename, so
+     * preservation matches the previous in-place write (whose mode applied only
+     * on creation) and the staged bytes are never wider than the file already
+     * was. Cross-process writers are serialized by the proper-lockfile lock the
+     * caller already holds, so the pid-suffixed temp cannot collide; a crashed
+     * write leaves at worst a 0o600 temp behind.
+     */
+    private writeAuthFile;
     private acquireLockSyncWithRetry;
     withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
     private acquireLockAsync;
@@ -66,9 +77,23 @@ export declare class AuthStorage implements CredentialStore {
     static fromStorage(storage: AuthStorageBackend): AuthStorage;
     static inMemory(data?: AuthStorageData): AuthStorage;
     private parseStorageData;
-    /** Reports whether the parse had to heal poisoned pool slots, so a load can write the repair back once. */
+    /**
+     * Reports whether the parse healed poisoned pool slots or moved legacy
+     * provider keys, so a load can write the result back exactly once. Repair
+     * runs FIRST, while the entry still sits under its legacy key, so poisoned
+     * sentinel slots heal with old-key derivation semantics; the sentinel
+     * matcher accepts legacy materials too, so a later load of an already
+     * migrated credential heals the same way.
+     */
     private parseStorageContent;
     private recordError;
+    /**
+     * Timestamped 0o600 copy of the pre-migration bytes, written inside the
+     * held store lock before the migrated document replaces them. A migration
+     * re-run after a crash between backup and rewrite writes another backup;
+     * the loop suffix keeps same-millisecond names from overwriting each other.
+     */
+    private backupAuthFile;
     private updateReadState;
     /**
      * Reload credentials from storage.

package/dist/core/auth-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACX,gBAAgB,EAGhB,oBAAoB,EAEpB,UAAU,EACV,cAAc,EACd,eAAe,EACf,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEN,KAAK,cAAc,EAMnB,MAAM,uCAAuC,CAAC;AAoB/C,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAsBlD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,KAAK,UAAU,CAAC,CAAC,IAAI;IACpB,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAmBF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,wBAAwB;IAwBhC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAkBjE;YAEa,gBAAgB;IAwCxB,aAAa,CAAC,CAAC,EACpB,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAwCZ;CACD;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,IAAI;IA+CN,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAS9F;IAEK,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAQ7E;IAEK,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACzE,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEjC;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;CACD;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACpE,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,UAAU,CAAuC;IAEzD,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAMjE;IAED,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAcZ;CACD;AAED;;GAEG;AACH,qBAAa,WAAY,YAAW,eAAe;IAClD,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IACxE,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,SAAS,CAAoB;IAErC,OAAO,eAaN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAE,MAAyC,GAAG,WAAW,CAG9E;IAED,cAAc,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED,OAAO,CAAC,gBAAgB;IAIxB,2GAA2G;IAC3G,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,eAAe;IAMvB;;OAEG;IACH,MAAM,IAAI,IAAI,CAmBb;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAEvD;IAED,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5C;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAGnE;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAQlD;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAO7B;IAED,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAE5C;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAQpD;IAED,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAU/C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjC;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAM1C;IAED,MAAM,IAAI,eAAe,CAExB;IAED,WAAW,IAAI,KAAK,EAAE,CAIrB;YAEa,sBAAsB;YAWtB,cAAc;IAkDtB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAS5F;IAEK,MAAM,CACX,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAkBjC;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5E;IAED,wEAAwE;IAClE,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAY7E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB/F;IAED,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAEhE;IAED,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEhD;IAED,iBAAiB,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAWvD;IAEK,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa7E;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAG7B;IAED,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,iBAAiB;CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAyC,GACjD,UAAU,GAAG,SAAS,CAOxB"}
+{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACX,gBAAgB,EAGhB,oBAAoB,EAEpB,UAAU,EACV,cAAc,EACd,eAAe,EACf,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEN,KAAK,cAAc,EAMnB,MAAM,uCAAuC,CAAC;AAqB/C,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAsBlD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,KAAK,UAAU,CAAC,CAAC,IAAI;IACpB,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAqBF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,wBAAwB;IAwBhC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAkBjE;YAEa,gBAAgB;IAwCxB,aAAa,CAAC,CAAC,EACpB,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAwCZ;CACD;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,IAAI;IA+CN,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAa9F;IAEK,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAQ7E;IAEK,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACzE,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEjC;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;CACD;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACpE,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,UAAU,CAAuC;IAEzD,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAMjE;IAED,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAcZ;CACD;AAED;;GAEG;AACH,qBAAa,WAAY,YAAW,eAAe;IAClD,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IACxE,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,SAAS,CAAoB;IAErC,OAAO,eAaN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAE,MAAyC,GAAG,WAAW,CAG9E;IAED,cAAc,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED,OAAO,CAAC,gBAAgB;IAQxB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,WAAW;IAInB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,eAAe;IAMvB;;OAEG;IACH,MAAM,IAAI,IAAI,CAsBb;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAEvD;IAED,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5C;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAGnE;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAQlD;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAO7B;IAED,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAE5C;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAQpD;IAED,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAU/C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjC;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAM1C;IAED,MAAM,IAAI,eAAe,CAExB;IAED,WAAW,IAAI,KAAK,EAAE,CAIrB;YAEa,sBAAsB;YAatB,cAAc;IAkDtB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAS5F;IAEK,MAAM,CACX,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAkBjC;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5E;IAED,wEAAwE;IAClE,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAY7E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB/F;IAED,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAEhE;IAED,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEhD;IAED,iBAAiB,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAWvD;IAEK,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa7E;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAG7B;IAED,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,iBAAiB;CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAyC,GACjD,UAAU,GAAG,SAAS,CAQxB"}

package/dist/core/auth-storage.js

@@ -2,16 +2,17 @@
  * CredentialStore implementation backed by auth.json.
  * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
-import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai";
+import { findEnvKeys, getEnvApiKey, readByProviderId } from "@earendil-works/pi-ai";
 import { appendLoginSlot, listSlots, removeSlot, repairManagedSentinelSlots, upsertSlot, } from "@earendil-works/pi-ai/auth/pool/slots";
 import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import lockfile from "proper-lockfile";
 import { getAgentDir } from "../config.js";
 import { raceWithAbortSignal } from "../utils/abort.js";
 import { getFileContentRevision, normalizePath } from "../utils/paths.js";
 import { stripBom } from "../utils/text.js";
+import { migrateLegacyProviderKeys } from "./auth-provider-key-migration.js";
 import { CredentialStoreBusyError, FILE_STORAGE_LOCK_OPTIONS, FILE_STORAGE_LOCK_RETRY_BUDGET_MS, FILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS, FILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS, FILE_STORAGE_SYNC_LOCK_BUDGET_MS, isLockError, } from "./lockfile-policy.js";
 import { isCommandConfigValue, resolveConfigValue } from "./resolve-config-value.js";
 /**
@@ -35,7 +36,9 @@ function repairPoisonedPoolSlots(data) {
     }
     return repaired ? { data: repaired, repaired: true } : { data, repaired: false };
 }
-// The mode applies only on creation so administrator-managed modes and ACLs remain intact.
+// Every write stages a fresh 0o600 file and renames it over the store, so the
+// credential file is never briefly world-readable and never half-written; the
+// restrictive mode also wins over any wider mode an earlier direct write left.
 const AUTH_FILE_WRITE_OPTIONS = { encoding: "utf-8", mode: 0o600 };
 let sharedAuthFileReadState;
 export class FileAuthStorageBackend {
@@ -53,6 +56,35 @@ export class FileAuthStorageBackend {
             writeFileSync(this.authPath, "{}", AUTH_FILE_WRITE_OPTIONS);
         }
     }
+    /**
+     * Atomic credential write: stage a 0o600 temp file beside the store and
+     * rename it over the target. An existing store may carry an
+     * administrator-set mode; it is copied onto the temp before the rename, so
+     * preservation matches the previous in-place write (whose mode applied only
+     * on creation) and the staged bytes are never wider than the file already
+     * was. Cross-process writers are serialized by the proper-lockfile lock the
+     * caller already holds, so the pid-suffixed temp cannot collide; a crashed
+     * write leaves at worst a 0o600 temp behind.
+     */
+    writeAuthFile(content) {
+        const temporary = `${this.authPath}.${process.pid}.tmp`;
+        try {
+            writeFileSync(temporary, content, AUTH_FILE_WRITE_OPTIONS);
+            if (existsSync(this.authPath)) {
+                chmodSync(temporary, statSync(this.authPath).mode & 0o777);
+            }
+            renameSync(temporary, this.authPath);
+        }
+        catch (error) {
+            try {
+                rmSync(temporary, { force: true });
+            }
+            catch {
+                // Best effort; a stale temp is already 0o600.
+            }
+            throw error;
+        }
+    }
     acquireLockSyncWithRetry(path) {
         const startedAt = Date.now();
         let attempt = 0;
@@ -83,7 +115,7 @@ export class FileAuthStorageBackend {
             const current = existsSync(this.authPath) ? readFileSync(this.authPath, "utf-8") : undefined;
             const { result, next } = fn(current);
             if (next !== undefined) {
-                writeFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);
+                this.writeAuthFile(next);
             }
             return result;
         }
@@ -151,7 +183,7 @@ export class FileAuthStorageBackend {
             throwIfCompromised();
             options?.signal?.throwIfAborted();
             if (next !== undefined) {
-                writeFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);
+                this.writeAuthFile(next);
             }
             throwIfCompromised();
             return result;
@@ -218,7 +250,11 @@ export class ReadOnlyAuthStorage {
     }
     async read(providerId, options) {
         options?.signal?.throwIfAborted();
-        const credential = this.load()[providerId];
+        // Read boundary (senpi#1989): an auth.json written by an earlier version is
+        // keyed by the legacy provider id. Try the canonical key first, then the
+        // legacy spelling, so a credential is never reported missing after the
+        // rename. Nothing is rewritten here.
+        const credential = readByProviderId(this.load(), providerId);
         options?.signal?.throwIfAborted();
         if (!credential)
             return undefined;
@@ -309,18 +345,48 @@ export class AuthStorage {
         return AuthStorage.fromStorage(storage);
     }
     parseStorageData(content) {
-        return this.parseStorageContent(content).data;
+        if (!content)
+            return {};
+        // Mutation paths keep the stored keys as-is: the key migration (and its
+        // pre-write backup) belongs to the load seam, so a write can never drop a
+        // legacy entry without the backup that preserves it.
+        return repairPoisonedPoolSlots(JSON.parse(stripBom(content))).data;
     }
-    /** Reports whether the parse had to heal poisoned pool slots, so a load can write the repair back once. */
+    /**
+     * Reports whether the parse healed poisoned pool slots or moved legacy
+     * provider keys, so a load can write the result back exactly once. Repair
+     * runs FIRST, while the entry still sits under its legacy key, so poisoned
+     * sentinel slots heal with old-key derivation semantics; the sentinel
+     * matcher accepts legacy materials too, so a later load of an already
+     * migrated credential heals the same way.
+     */
     parseStorageContent(content) {
         if (!content) {
-            return { data: {}, repaired: false };
+            return { data: {}, repaired: false, migrated: false };
         }
-        return repairPoisonedPoolSlots(JSON.parse(stripBom(content)));
+        const repaired = repairPoisonedPoolSlots(JSON.parse(stripBom(content)));
+        const migrated = migrateLegacyProviderKeys(repaired.data);
+        return { data: migrated.data, repaired: repaired.repaired, migrated: migrated.migrated };
     }
     recordError(error) {
         this.errors.push(error instanceof Error ? error : new Error(String(error)));
     }
+    /**
+     * Timestamped 0o600 copy of the pre-migration bytes, written inside the
+     * held store lock before the migrated document replaces them. A migration
+     * re-run after a crash between backup and rewrite writes another backup;
+     * the loop suffix keeps same-millisecond names from overwriting each other.
+     */
+    backupAuthFile(content) {
+        if (!this.authPath || content === undefined)
+            return;
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        let backupPath = `${this.authPath}.backup-${stamp}`;
+        for (let attempt = 1; existsSync(backupPath); attempt++) {
+            backupPath = `${this.authPath}.backup-${stamp}-${attempt}`;
+        }
+        writeFileSync(backupPath, content, AUTH_FILE_WRITE_OPTIONS);
+    }
     updateReadState(data, revision) {
         this.data = data;
         this.readState.data = data;
@@ -336,10 +402,14 @@ export class AuthStorage {
             this.storage.withLock((current) => {
                 const parsed = this.parseStorageContent(current);
                 data = parsed.data;
-                // A written repair invalidates the revision read before it; leaving it
-                // unset makes the next reader re-read instead of trusting a stale stamp.
-                revision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);
-                return parsed.repaired
+                // A written repair or migration invalidates the revision read before
+                // it; leaving it unset makes the next reader re-read instead of
+                // trusting a stale stamp.
+                revision =
+                    parsed.repaired || parsed.migrated || !this.authPath ? undefined : getFileContentRevision(this.authPath);
+                if (parsed.migrated)
+                    this.backupAuthFile(current);
+                return parsed.repaired || parsed.migrated
                     ? { result: undefined, next: JSON.stringify(parsed.data, null, 2) }
                     : { result: undefined };
             });
@@ -358,10 +428,10 @@ export class AuthStorage {
         this.runtimeOverrides.delete(provider);
     }
     get(provider) {
-        return this.data[provider];
+        return readByProviderId(this.data, provider);
     }
     getProviderEnv(provider) {
-        const credential = this.data[provider];
+        const credential = readByProviderId(this.data, provider);
         return credential?.type === "api_key" && credential.env ? { ...credential.env } : undefined;
     }
     set(provider, credential) {
@@ -382,7 +452,7 @@ export class AuthStorage {
         });
     }
     listSlots(provider) {
-        return listSlots(this.data[provider]);
+        return listSlots(readByProviderId(this.data, provider));
     }
     setSlot(provider, slot) {
         this.storage.withLock((content) => {
@@ -433,9 +503,11 @@ export class AuthStorage {
     async reloadFromStorageAsync(options) {
         return this.storage.withLockAsync(async (content) => {
             const parsed = this.parseStorageContent(content);
-            const revision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);
+            const revision = parsed.repaired || parsed.migrated || !this.authPath ? undefined : getFileContentRevision(this.authPath);
             this.updateReadState(parsed.data, revision);
-            return parsed.repaired
+            if (parsed.migrated)
+                this.backupAuthFile(content);
+            return parsed.repaired || parsed.migrated
                 ? { result: parsed.data, next: JSON.stringify(parsed.data, null, 2) }
                 : { result: parsed.data };
         }, options);
@@ -648,7 +720,8 @@ export class AuthStorage {
 export function readStoredCredential(providerId, authPath = join(getAgentDir(), "auth.json")) {
     try {
         const data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), "utf-8")));
-        return data[providerId];
+        // Read boundary (senpi#1989): try canonical, then the legacy spelling.
+        return readByProviderId(data, providerId);
     }
     catch {
         return undefined;