@cortexkit/opencode-openai-auth 0.7.2 → 0.8.0

package/src/tui-compiled/{core/account-paths.ts → raw/core-account-paths.ts}

@@ -1,23 +1,28 @@
 import { realpathSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { basename, dirname, join, resolve } from 'node:path'
+import {
+  ACCOUNT_FILE_NAME,
+  ACCOUNT_STATE_FILE_NAME,
+  type AccountPaths,
+  deriveStatePath,
+} from '../shared/internal.ts'
 
 /**
- * Where the account store lives.
+ * Where OpenCode's account store lives.
  *
- * This is the ONLY definition. It used to be duplicated verbatim in both
- * `accounts.ts` and `refresh-file-lock.ts`, because `accounts.ts` imports the
- * lock and the reverse import would have been a cycle. Two copies of a path
- * resolver is a bad trade for that: the lock and the write must agree on the
- * exact file, and if the copies ever drifted, a writer would take a lock on one
- * path while writing another — mutual exclusion silently lost on a file holding
- * credentials. Nothing would fail a test, since each copy works on its own.
+ * This is the ONLY definition of this host's resolution rules. The store code
+ * itself takes both paths as arguments and resolves nothing, so the lock and
+ * the write it guards can never disagree about which file they mean — a
+ * disagreement would lose mutual exclusion on a file holding credentials while
+ * every test still passed, since each side works on its own.
  *
- * This module imports nothing from either side, so both can depend on it.
+ * The file names come from the core so the two hosts cannot drift apart on what
+ * the store is called.
  */
 
-export const ACCOUNT_FILE_NAME = 'openai-auth.json'
-export const ACCOUNT_STATE_FILE_NAME = 'openai-auth-state.json'
+export type { AccountPaths }
+export { ACCOUNT_FILE_NAME, ACCOUNT_STATE_FILE_NAME, deriveStatePath }
 
 function getConfigDir() {
   if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
@@ -36,13 +41,6 @@ export function getAccountStoragePath() {
   )
 }
 
-/** Derive the state-file path from the config path without reading env vars. */
-export function deriveStatePath(configPath: string): string {
-  return basename(configPath) === ACCOUNT_FILE_NAME
-    ? join(dirname(configPath), ACCOUNT_STATE_FILE_NAME)
-    : `${configPath}.state.json`
-}
-
 function normalizePathForComparison(path: string, platform: NodeJS.Platform) {
   const resolved = resolve(path)
   return platform === 'win32' || platform === 'darwin'
@@ -101,3 +99,16 @@ export function getAccountStatePath(configPath = getAccountStoragePath()) {
   }
   return deriveStatePath(configPath)
 }
+
+/**
+ * Both file paths a store call needs, resolved the way this host resolves them.
+ *
+ * Every call site that used to pass a single config path and let the store
+ * derive the state path now passes this pair instead, so the state-file
+ * override keeps being honoured in exactly the places it was before.
+ */
+export function getAccountPaths(
+  configPath = getAccountStoragePath(),
+): AccountPaths {
+  return { configPath, statePath: getAccountStatePath(configPath) }
+}

package/src/tui-compiled/raw/logger.ts

@@ -0,0 +1,53 @@
+/**
+ * OpenCode's log destination.
+ *
+ * The logger itself lives in the shared core so both hosts get the same
+ * redaction rules. What stays here is the part that is specific to this host:
+ * which file the lines go to, which level floor applies, and when the buffer is
+ * drained at process exit. Those are the only three things that read this
+ * host's environment variables, and the core reads none.
+ *
+ * The init runs at module load rather than from one call site because every
+ * entry point in this package — the plugin loader, the RPC server, the separate
+ * TUI process — reaches the logger through this module, and a core logger no
+ * host has initialised silently drops every line. Both values are passed as
+ * functions so the destination and level keep resolving on each write, which is
+ * what they do today.
+ */
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  flushLogs,
+  initLogger,
+  type Level,
+} from '../shared/internal.ts'
+
+export {
+  createLogger,
+  flushForTest,
+  flushLogs,
+  type Level,
+  redact,
+  redactStrings,
+  setLogLevel,
+} from '../shared/internal.ts'
+
+const LEVELS: readonly Level[] = ['error', 'warn', 'info', 'debug', 'trace']
+
+export function getLogFile(): string {
+  return (
+    process.env.OPENCODE_OPENAI_AUTH_LOG_FILE ??
+    join(tmpdir(), 'opencode-openai-auth.log')
+  )
+}
+
+export function getEnvLogLevel(): Level | undefined {
+  const env = process.env.OPENCODE_OPENAI_AUTH_LOG_LEVEL as Level | undefined
+  return env && LEVELS.includes(env) ? env : undefined
+}
+
+initLogger({ file: getLogFile, level: getEnvLogLevel })
+
+// Under `bun test` the buffer is drained explicitly by the tests that assert on
+// it, and registering a process-wide exit handler per test file is noise.
+if (process.env.NODE_ENV !== 'test') process.on('exit', flushLogs)

package/src/tui-compiled/{rpc/port-file.ts → raw/rpc-port-file.ts}

@@ -10,7 +10,7 @@ import {
   writeFile,
 } from 'node:fs/promises'
 import { join, resolve } from 'node:path'
-import { createLogger } from '../logger'
+import { createLogger } from './logger.ts'
 
 const log = createLogger('rpc')
 

package/src/tui-compiled/raw/rpc-protocol.ts

@@ -0,0 +1,12 @@
+/**
+ * The RPC payload types now live in the shared core, because both hosts build
+ * the same payloads. This file stays on disk as a re-export so the existing
+ * build entry and every importer that names `rpc/protocol` keep working.
+ */
+export type {
+  ApplyRequest,
+  ApplyResult,
+  CommandModalName,
+  OpenDialogPayload,
+  RpcNotification,
+} from '../shared/internal.ts'

package/src/{rpc/rpc-client.ts → tui-compiled/raw/rpc-rpc-client.ts}

@@ -1,5 +1,5 @@
-import { discoverPortFile, type PortFileEntry } from './port-file'
-import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
+import { discoverPortFile, type PortFileEntry } from './rpc-port-file.ts'
+import type { ApplyRequest, ApplyResult, RpcNotification } from './rpc-protocol.ts'
 
 export interface RpcClient {
   pending: (

package/src/{sidebar-state.ts → tui-compiled/raw/sidebar-state.ts}

@@ -155,8 +155,8 @@ import { createHash, randomUUID } from 'node:crypto'
 import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
-import { acquireRefreshFileLock } from './core/refresh-file-lock'
-import { createLogger } from './logger'
+import { acquireRefreshFileLock } from '../shared/internal.ts'
+import { createLogger } from './logger.ts'
 
 const logSb = createLogger('sidebar')
 

package/src/{tui/command-dialogs.tsx → tui-compiled/raw/tui-command-dialogs.tsx}

@@ -1,16 +1,16 @@
 /** @jsxImportSource @opentui/solid */
+
+import { errorMessage, openUrl } from '../shared/internal.ts'
 import type { TuiPluginApi } from '@opencode-ai/plugin/tui'
-import { createLogger } from '../logger'
-import type { OpenDialogPayload } from '../rpc/protocol.js'
+import { createLogger } from './logger.ts'
+import type { OpenDialogPayload } from './rpc-protocol.ts'
 import {
   type AccountQuota,
   getCollapsedQuotaSummary,
   getSidebarState,
   resolveSessionSidebarRouting,
   type SidebarState,
-} from '../sidebar-state.js'
-import { errorMessage } from '../util/error'
-import { openUrl } from '../util/open-url'
+} from './sidebar-state.ts'
 
 const log = createLogger('rpc-tui')
 

package/src/{tui.tsx → tui-compiled/raw/tui.tsx}

@@ -16,10 +16,10 @@ import {
   onCleanup,
   Show,
 } from 'solid-js'
-import { createLogger } from './logger.js'
-import type { ApplyRequest, CommandModalName } from './rpc/protocol.js'
-import { createRpcClient } from './rpc/rpc-client.js'
-import { resolveRpcDir } from './rpc/rpc-dir.js'
+import { createLogger } from './logger.ts'
+import type { ApplyRequest, CommandModalName } from './rpc-protocol.ts'
+import { createRpcClient } from './rpc-rpc-client.ts'
+import { resolveRpcDir } from './rpc-rpc-dir.ts'
 import {
   type AccountQuota,
   computeQuotaPacing,
@@ -33,8 +33,8 @@ import {
   resolveSessionSidebarRouting,
   resolveSessionStickyAccount,
   type SidebarState,
-} from './sidebar-state.js'
-import { openCommandDialog } from './tui/command-dialogs.js'
+} from './sidebar-state.ts'
+import { openCommandDialog } from './tui-command-dialogs.tsx'
 import {
   type AppearancePrefs,
   computeEffectiveOrder,
@@ -45,7 +45,7 @@ import {
   readTuiPreferencesFile,
   resolveOpenaiAuthPrefs,
   watchTuiPreferences,
-} from './tui-preferences.js'
+} from './tui-preferences.ts'
 
 const RPC_POLL_MS = 500
 let rpcPollStarted = false
@@ -61,14 +61,15 @@ export function buildApplyRequest(
   return { command, arguments: arguments_, sessionId }
 }
 
-// Read package metadata from either the raw src/ entry or its generated
-// src/tui-compiled/ counterpart. Avoid a JSON import because package.json sits
-// outside the declaration build's rootDir.
+// Read package metadata from the development source or either generated TUI
+// variant. Avoid a JSON import because package.json sits outside the declaration
+// build's rootDir.
 const PLUGIN_VERSION: string = (() => {
   const here = dirname(fileURLToPath(import.meta.url))
   for (const packageFile of [
     join(here, '..', 'package.json'),
     join(here, '..', '..', 'package.json'),
+    join(here, '..', '..', '..', 'package.json'),
   ]) {
     try {
       const raw = readFileSync(packageFile, 'utf8')

package/src/{core/account-paths.ts → tui-compiled/runtime/core-account-paths.ts}

@@ -1,23 +1,28 @@
 import { realpathSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { basename, dirname, join, resolve } from 'node:path'
+import {
+  ACCOUNT_FILE_NAME,
+  ACCOUNT_STATE_FILE_NAME,
+  type AccountPaths,
+  deriveStatePath,
+} from '../shared/internal.ts'
 
 /**
- * Where the account store lives.
+ * Where OpenCode's account store lives.
  *
- * This is the ONLY definition. It used to be duplicated verbatim in both
- * `accounts.ts` and `refresh-file-lock.ts`, because `accounts.ts` imports the
- * lock and the reverse import would have been a cycle. Two copies of a path
- * resolver is a bad trade for that: the lock and the write must agree on the
- * exact file, and if the copies ever drifted, a writer would take a lock on one
- * path while writing another — mutual exclusion silently lost on a file holding
- * credentials. Nothing would fail a test, since each copy works on its own.
+ * This is the ONLY definition of this host's resolution rules. The store code
+ * itself takes both paths as arguments and resolves nothing, so the lock and
+ * the write it guards can never disagree about which file they mean — a
+ * disagreement would lose mutual exclusion on a file holding credentials while
+ * every test still passed, since each side works on its own.
  *
- * This module imports nothing from either side, so both can depend on it.
+ * The file names come from the core so the two hosts cannot drift apart on what
+ * the store is called.
  */
 
-export const ACCOUNT_FILE_NAME = 'openai-auth.json'
-export const ACCOUNT_STATE_FILE_NAME = 'openai-auth-state.json'
+export type { AccountPaths }
+export { ACCOUNT_FILE_NAME, ACCOUNT_STATE_FILE_NAME, deriveStatePath }
 
 function getConfigDir() {
   if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
@@ -36,13 +41,6 @@ export function getAccountStoragePath() {
   )
 }
 
-/** Derive the state-file path from the config path without reading env vars. */
-export function deriveStatePath(configPath: string): string {
-  return basename(configPath) === ACCOUNT_FILE_NAME
-    ? join(dirname(configPath), ACCOUNT_STATE_FILE_NAME)
-    : `${configPath}.state.json`
-}
-
 function normalizePathForComparison(path: string, platform: NodeJS.Platform) {
   const resolved = resolve(path)
   return platform === 'win32' || platform === 'darwin'
@@ -101,3 +99,16 @@ export function getAccountStatePath(configPath = getAccountStoragePath()) {
   }
   return deriveStatePath(configPath)
 }
+
+/**
+ * Both file paths a store call needs, resolved the way this host resolves them.
+ *
+ * Every call site that used to pass a single config path and let the store
+ * derive the state path now passes this pair instead, so the state-file
+ * override keeps being honoured in exactly the places it was before.
+ */
+export function getAccountPaths(
+  configPath = getAccountStoragePath(),
+): AccountPaths {
+  return { configPath, statePath: getAccountStatePath(configPath) }
+}

package/src/tui-compiled/runtime/logger.ts

@@ -0,0 +1,53 @@
+/**
+ * OpenCode's log destination.
+ *
+ * The logger itself lives in the shared core so both hosts get the same
+ * redaction rules. What stays here is the part that is specific to this host:
+ * which file the lines go to, which level floor applies, and when the buffer is
+ * drained at process exit. Those are the only three things that read this
+ * host's environment variables, and the core reads none.
+ *
+ * The init runs at module load rather than from one call site because every
+ * entry point in this package — the plugin loader, the RPC server, the separate
+ * TUI process — reaches the logger through this module, and a core logger no
+ * host has initialised silently drops every line. Both values are passed as
+ * functions so the destination and level keep resolving on each write, which is
+ * what they do today.
+ */
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  flushLogs,
+  initLogger,
+  type Level,
+} from '../shared/internal.ts'
+
+export {
+  createLogger,
+  flushForTest,
+  flushLogs,
+  type Level,
+  redact,
+  redactStrings,
+  setLogLevel,
+} from '../shared/internal.ts'
+
+const LEVELS: readonly Level[] = ['error', 'warn', 'info', 'debug', 'trace']
+
+export function getLogFile(): string {
+  return (
+    process.env.OPENCODE_OPENAI_AUTH_LOG_FILE ??
+    join(tmpdir(), 'opencode-openai-auth.log')
+  )
+}
+
+export function getEnvLogLevel(): Level | undefined {
+  const env = process.env.OPENCODE_OPENAI_AUTH_LOG_LEVEL as Level | undefined
+  return env && LEVELS.includes(env) ? env : undefined
+}
+
+initLogger({ file: getLogFile, level: getEnvLogLevel })
+
+// Under `bun test` the buffer is drained explicitly by the tests that assert on
+// it, and registering a process-wide exit handler per test file is noise.
+if (process.env.NODE_ENV !== 'test') process.on('exit', flushLogs)

package/src/{rpc/port-file.ts → tui-compiled/runtime/rpc-port-file.ts}

@@ -10,7 +10,7 @@ import {
   writeFile,
 } from 'node:fs/promises'
 import { join, resolve } from 'node:path'
-import { createLogger } from '../logger'
+import { createLogger } from './logger.ts'
 
 const log = createLogger('rpc')
 

package/src/tui-compiled/runtime/rpc-protocol.ts

@@ -0,0 +1,12 @@
+/**
+ * The RPC payload types now live in the shared core, because both hosts build
+ * the same payloads. This file stays on disk as a re-export so the existing
+ * build entry and every importer that names `rpc/protocol` keep working.
+ */
+export type {
+  ApplyRequest,
+  ApplyResult,
+  CommandModalName,
+  OpenDialogPayload,
+  RpcNotification,
+} from '../shared/internal.ts'

package/src/tui-compiled/{rpc/rpc-client.ts → runtime/rpc-rpc-client.ts}

@@ -1,5 +1,5 @@
-import { discoverPortFile, type PortFileEntry } from './port-file'
-import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
+import { discoverPortFile, type PortFileEntry } from './rpc-port-file.ts'
+import type { ApplyRequest, ApplyResult, RpcNotification } from './rpc-protocol.ts'
 
 export interface RpcClient {
   pending: (

package/src/tui-compiled/{sidebar-state.ts → runtime/sidebar-state.ts}

@@ -155,8 +155,8 @@ import { createHash, randomUUID } from 'node:crypto'
 import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
-import { acquireRefreshFileLock } from './core/refresh-file-lock'
-import { createLogger } from './logger'
+import { acquireRefreshFileLock } from '../shared/internal.ts'
+import { createLogger } from './logger.ts'
 
 const logSb = createLogger('sidebar')
 

package/src/tui-compiled/{tui/command-dialogs.tsx → runtime/tui-command-dialogs.tsx}

@@ -7,10 +7,9 @@ import { createElement as _$createElement } from "opentui:runtime-module:%40open
 import { createComponent as _$createComponent } from "opentui:runtime-module:%40opentui%2Fsolid";
 /** @jsxImportSource @opentui/solid */
 
-import { createLogger } from "../logger";
-import { getCollapsedQuotaSummary, getSidebarState, resolveSessionSidebarRouting } from "../sidebar-state.js";
-import { errorMessage } from "../util/error";
-import { openUrl } from "../util/open-url";
+import { errorMessage, openUrl } from "../shared/internal.ts";
+import { createLogger } from "./logger.ts";
+import { getCollapsedQuotaSummary, getSidebarState, resolveSessionSidebarRouting } from "./sidebar-state.ts";
 const log = createLogger('rpc-tui');
 export function buildCachekeepDialogOptions(payload) {
   const enabled = payload.knobs.enabled === true;

package/src/tui-compiled/{tui.tsx → runtime/tui.tsx}

@@ -12,12 +12,12 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createEffect, createSignal, For, onCleanup, Show } from "opentui:runtime-module:solid-js";
-import { createLogger } from "./logger.js";
-import { createRpcClient } from "./rpc/rpc-client.js";
-import { resolveRpcDir } from "./rpc/rpc-dir.js";
-import { computeQuotaPacing, DEFAULT_SIDEBAR_STATE, getCollapsedQuotaSummary, getPresentQuotaWindows, getSidebarState, resolveActiveAccount, resolveSessionSidebarRouting, resolveSessionStickyAccount } from "./sidebar-state.js";
-import { openCommandDialog } from "./tui/command-dialogs.js";
-import { computeEffectiveOrder, DEFAULT_SLOT_ORDER, PLUGIN_KEY, queueTuiPreferenceUpdate, readTuiPreferencesFile, resolveOpenaiAuthPrefs, watchTuiPreferences } from "./tui-preferences.js";
+import { createLogger } from "./logger.ts";
+import { createRpcClient } from "./rpc-rpc-client.ts";
+import { resolveRpcDir } from "./rpc-rpc-dir.ts";
+import { computeQuotaPacing, DEFAULT_SIDEBAR_STATE, getCollapsedQuotaSummary, getPresentQuotaWindows, getSidebarState, resolveActiveAccount, resolveSessionSidebarRouting, resolveSessionStickyAccount } from "./sidebar-state.ts";
+import { openCommandDialog } from "./tui-command-dialogs.tsx";
+import { computeEffectiveOrder, DEFAULT_SLOT_ORDER, PLUGIN_KEY, queueTuiPreferenceUpdate, readTuiPreferencesFile, resolveOpenaiAuthPrefs, watchTuiPreferences } from "./tui-preferences.ts";
 const RPC_POLL_MS = 500;
 let rpcPollStarted = false;
 const log = createLogger('rpc-tui');
@@ -30,12 +30,12 @@ export function buildApplyRequest(command, arguments_, sessionId) {
   };
 }
 
-// Read package metadata from either the raw src/ entry or its generated
-// src/tui-compiled/ counterpart. Avoid a JSON import because package.json sits
-// outside the declaration build's rootDir.
+// Read package metadata from the development source or either generated TUI
+// variant. Avoid a JSON import because package.json sits outside the declaration
+// build's rootDir.
 const PLUGIN_VERSION = (() => {
   const here = dirname(fileURLToPath(import.meta.url));
-  for (const packageFile of [join(here, '..', 'package.json'), join(here, '..', '..', 'package.json')]) {
+  for (const packageFile of [join(here, '..', 'package.json'), join(here, '..', '..', 'package.json'), join(here, '..', '..', '..', 'package.json')]) {
     try {
       const raw = readFileSync(packageFile, 'utf8');
       const version = JSON.parse(raw).version;

package/src/tui-compiled/shared/internal.ts

@@ -0,0 +1,6 @@
+// Generated by scripts/build-tui.ts. Do not edit.
+export * from './logger.ts'
+export * from './paths.ts'
+export * from './refresh-file-lock.ts'
+export * from './util/error.ts'
+export * from './util/open-url.ts'

package/src/{logger.ts → tui-compiled/shared/logger.ts}

@@ -5,10 +5,8 @@ import {
   renameSync,
   statSync,
 } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
 
-type Level = 'error' | 'warn' | 'info' | 'debug' | 'trace'
+export type Level = 'error' | 'warn' | 'info' | 'debug' | 'trace'
 const ORDER: Record<Level, number> = {
   error: 0,
   warn: 1,
@@ -16,23 +14,63 @@ const ORDER: Record<Level, number> = {
   debug: 3,
   trace: 4,
 }
-const isTestEnv = process.env.NODE_ENV === 'test'
 const MAX_BYTES = 5 * 1024 * 1024
 
-function logFile(): string {
-  return (
-    process.env.OPENCODE_OPENAI_AUTH_LOG_FILE ??
-    join(tmpdir(), 'opencode-openai-auth.log')
-  )
-}
+/**
+ * Where lines are written, and the level floor, as the host supplied them.
+ *
+ * Both start unset. A host decides where its log lives — that decision reads
+ * host environment variables and host directories, neither of which belongs in
+ * shared code — and calls `initLogger` before it runs any command. Until then
+ * every `log.*` call is a silent no-op: throwing would turn the first command a
+ * host forgot to wire into a crash, and buffering would hold credential-bearing
+ * lines for an init that may never arrive.
+ */
+let logFileSource: string | (() => string) | undefined
+let initLevelSource: Level | (() => Level | undefined) | undefined
 let runtimeLevel: Level | undefined
+
+export interface InitLoggerOptions {
+  /**
+   * Path of the file lines are appended to, or a function returning it.
+   *
+   * A function is what a host passes when its destination can move while the
+   * process runs — an operator or a test changing the variable that names the
+   * log file expects the next line to land in the new file, and a value
+   * captured once at init would keep writing to the old one.
+   */
+  file: string | (() => string)
+  /** Level floor applied when no `setLogLevel` call has overridden it. */
+  level?: Level | (() => Level | undefined)
+}
+
+/**
+ * Point the logger at a host's file and level. Idempotent: calling it again
+ * replaces both. A runtime level installed by `setLogLevel` is deliberately
+ * left alone, because it is the operator's explicit choice and outranks the
+ * floor a host computed at start-up.
+ */
+export function initLogger(options: InitLoggerOptions): void {
+  logFileSource = options.file
+  initLevelSource = options.level
+}
+
 export function setLogLevel(l: Level | undefined) {
   if (l === undefined || l in ORDER) runtimeLevel = l
 }
+
+function logFilePath(): string | undefined {
+  if (logFileSource === undefined) return undefined
+  const resolved =
+    typeof logFileSource === 'function' ? logFileSource() : logFileSource
+  return resolved || undefined
+}
+
 function configuredLevel(): Level {
   if (runtimeLevel) return runtimeLevel
-  const env = process.env.OPENCODE_OPENAI_AUTH_LOG_LEVEL as Level | undefined
-  if (env && env in ORDER) return env
+  const floor =
+    typeof initLevelSource === 'function' ? initLevelSource() : initLevelSource
+  if (floor && floor in ORDER) return floor
   return 'info'
 }
 
@@ -123,9 +161,8 @@ function chmodPrivate(path: string) {
     /* never throw */
   }
 }
-function rotateIfNeeded() {
+function rotateIfNeeded(f: string) {
   try {
-    const f = logFile()
     if (!(existsSync(f) && statSync(f).size > MAX_BYTES)) return
     for (let i = ROTATE_KEEP - 1; i >= 1; i--) {
       if (existsSync(`${f}.${i}`)) {
@@ -141,13 +178,19 @@ function rotateIfNeeded() {
     /* never throw */
   }
 }
-function flush() {
+
+/**
+ * Write whatever is buffered. Safe to call synchronously from a process-exit
+ * handler, which is how each host drains the buffer on shutdown.
+ */
+export function flushLogs() {
   if (!buffer.length) return
+  const file = logFilePath()
   const text = buffer.join('')
   buffer = []
+  if (!file) return
   try {
-    rotateIfNeeded()
-    const file = logFile()
+    rotateIfNeeded(file)
     if (existsSync(file)) chmodPrivate(file)
     appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 })
   } catch {
@@ -158,10 +201,9 @@ function schedule() {
   if (!timer)
     timer = setTimeout(() => {
       timer = undefined
-      flush()
+      flushLogs()
     }, 500)
 }
-if (!isTestEnv) process.on('exit', flush)
 
 function safeSerialize(data: unknown): string {
   try {
@@ -172,13 +214,16 @@ function safeSerialize(data: unknown): string {
 }
 
 function emit(channel: string, level: Level, message: string, data?: unknown) {
+  // No destination means no host has initialised the logger. Drop the line
+  // rather than buffering it: see the note on logFileSource above.
+  if (logFileSource === undefined) return
   if (ORDER[level] > ORDER[configuredLevel()]) return
   const line =
     `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${message}` +
     (data === undefined ? '' : safeSerialize(data)) +
     '\n'
   buffer.push(line)
-  if (buffer.length >= 50) flush()
+  if (buffer.length >= 50) flushLogs()
   else schedule()
 }
 
@@ -192,5 +237,21 @@ export function createLogger(channel: string) {
   }
 }
 export async function flushForTest() {
-  flush()
+  flushLogs()
+}
+
+/**
+ * Return the logger to its uninitialised state. Only a test needs this: a
+ * single process runs every test file, so a file path left over from one test
+ * would keep a later "logger was never initialised" case writing lines.
+ */
+export function resetLoggerForTest() {
+  buffer = []
+  if (timer) {
+    clearTimeout(timer)
+    timer = undefined
+  }
+  logFileSource = undefined
+  initLevelSource = undefined
+  runtimeLevel = undefined
 }