npm - @coseung2/opencodex - Versions diffs - 2.8.0-cs.1 → 2.8.0-cs.11 - Mend

@coseung2/opencodex 2.8.0-cs.1 → 2.8.0-cs.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (28) hide show

package/README.md +9 -0
package/bin/ocx-notch.mjs +27 -1
package/bin/ocx.mjs +0 -0
package/gui/dist/assets/{index-CAnnes06.js → index-BYDeFyGN.js} +3 -3
package/gui/dist/assets/{index-OY43ubAq.css → index-CxisOo-q.css} +1 -1
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/packages/ocx-notch/README.md +7 -3
package/src/adapters/kiro-constants.ts +1 -1
package/src/adapters/kiro.ts +29 -6
package/src/cli/index.ts +67 -29
package/src/cli/status.ts +4 -3
package/src/config.ts +8 -3
package/src/oauth/account-pause.ts +31 -0
package/src/oauth/index.ts +11 -5
package/src/oauth/kiro-credentials.ts +18 -1
package/src/oauth/store.ts +25 -2
package/src/providers/quota.ts +312 -18
package/src/providers/registry.ts +1 -0
package/src/responses/parser.ts +9 -1
package/src/responses/state.ts +19 -2
package/src/server/lifecycle.ts +23 -0
package/src/server/management/oauth-account-routes.ts +51 -2
package/src/server/memory-watchdog.ts +72 -7
package/src/server/proxy-liveness.ts +5 -1
package/src/service.ts +14 -7
package/src/types.ts +9 -0
package/vendor/ocx-notch/win32-x64/ocx-notch.exe +0 -0

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-CAnnes06.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-OY43ubAq.css">
+    <script type="module" crossorigin src="/assets/index-BYDeFyGN.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CxisOo-q.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@coseung2/opencodex",
-  "version": "2.8.0-cs.1",
+  "version": "2.8.0-cs.11",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/packages/ocx-notch/README.md CHANGED Viewed

@@ -31,10 +31,13 @@ For OCX 2.8+, the notch automatically reads the existing `%USERPROFILE%\.opencod
 - The same native sample collects `GetPerformanceInfo` physical total/available and commit total/limit values. The header labels the smaller available headroom as `안정`, `주의`, or `위험`; caution and danger use 10%/2 GiB and 5%/1 GiB minimum-headroom thresholds respectively. No memory history is persisted.
 - `/api/usage?range=7d` refreshes around every 30 seconds; only the newest calendar day's model rows are aggregated into the displayed per-provider usage.
 - `/api/logs?tail=10` refreshes every ~2 seconds only while the Logs tab is visible. The response replaces the in-memory list, newest first, and OCX Notch never persists logs itself.
-- OpenAI account state and per-account quotas refresh around every 5 seconds. Other provider configuration, account pools, and cached `/api/provider-quotas` refresh around every 5 minutes.
+- OpenAI account state and per-account quotas refresh around every 5 seconds. Other provider configuration, account pools, and cached `/api/provider-quotas` refresh around every 5 minutes. For xAI OAuth, OCX reports the authoritative weekly Grok credit-pool usage and reset; the separate monthly spending cap is not presented as quota.
+- Provider setup reads OCX's `/api/provider-presets` catalog on demand. OAuth status is polled only while a browser/device sign-in or account reauthentication is active; device authorization URLs, instructions, and user codes remain visible in the modal.
 - `/api/system/memory` is requested only while expanded, at most every ~45 seconds, for optional heap detail.
-All HTTP calls use WinHTTP against `127.0.0.1:10100`. There is no WebView, database, log file, runtime download, or automatic startup behavior. The last window position and width are stored in `%LOCALAPPDATA%\OCX Notch\window.json`.
+All HTTP calls use WinHTTP against `127.0.0.1:10100`. There is no WebView, database, persistent usage history, runtime download, or automatic startup behavior. The last window position and width are stored in `%LOCALAPPDATA%\OCX Notch\window.json`.
+Startup failures and Rust panics are written to the bounded diagnostic log `%LOCALAPPDATA%\OCX Notch\ocx-notch.log`. Running `ocx-notch` while the widget is already open restores its opacity, repaints it, and moves it to the top of the monitor containing the cursor. Display-topology changes also clamp the window back into a visible work area.
 ## Interaction
@@ -48,8 +51,9 @@ All HTTP calls use WinHTTP against `127.0.0.1:10100`. There is no WebView, datab
 - Drag anywhere on the notch to move it; its chosen position is preserved while it expands, collapses, or refreshes.
 - Click a provider with multiple accounts to expand or collapse its account rows.
 - Click the pause icon beside an OpenAI account to exclude it from the rotation pool. A paused account shows a play icon that includes it again. The icon updates immediately and rolls back if OCX rejects the request.
+- Accounts that require renewed credentials expose an inline **재인증** action on the same row. OpenAI's main account is intentionally excluded; eligible OpenAI pool and generic OAuth accounts can start, cancel, and retry browser authentication.
 - Providers with quota data are shown first. Providers with usage but no quota stay behind the inline usage-only toggle.
 - Press **Esc** to collapse.
-- Right-click to set the real OCX account rotation threshold, fine-tune it by 1%, **Refresh**, or **Exit**. `Off` writes threshold `0`.
+- Right-click to add a provider, set the real OCX account rotation threshold, fine-tune it by 1%, **Refresh**, or **Exit**. The opaque provider modal groups supported presets into Account, Free, and Paid tabs. Canonical OpenAI adds another Codex account, OAuth presets use browser/device authorization, and required-key presets use masked API-key entry. Local, key-optional, endpoint-choice, and placeholder-URL presets are omitted because this compact modal cannot preserve those setup contracts safely. `Off` writes threshold `0`.
 Quota percentages are shown as used percentages with the same 5-hour/weekly/monthly/custom-window rows, reset countdowns, 5px progress bars, green fill, and green-to-amber threshold warning used by the OCX dashboard. Provider usage is merged by exact provider name, limited to the newest day, and formatted with Korean `만/억/조` units. OpenAI account rows show their own weekly/monthly quotas; OAuth and key-pool rows show their masked identity and active/health state, while provider-level quota remains associated with the active account. The native window uses a subtle 238/255 global alpha.

package/src/adapters/kiro-constants.ts CHANGED Viewed

@@ -8,7 +8,7 @@ export const KIRO_TOOL_RESULT_CARRIER_MESSAGE = "The requested tool result is at
 export const KIRO_EMPTY_TOOL_RESULT_MESSAGE = "The tool completed without textual output.";
 export const KIRO_COMPLETION_INSTRUCTIONS =
-  `When tools are available, ordinary assistant text is mid-task commentary and does not end the turn. Continue using tools after progress updates. When the task is fully complete and no more tool calls are needed, call ${KIRO_COMPLETION_TOOL_NAME} exactly once with the complete user-facing final answer in \`answer\`. Do not provide the final answer as ordinary assistant text.`;
+  `When tools are available, ordinary assistant text is mid-task commentary and does not end the turn. Continue using tools after progress updates, but never repeat or paraphrase an earlier progress update; call the next real tool directly unless a new concise update adds material information. When the task is fully complete and no more tool calls are needed, call ${KIRO_COMPLETION_TOOL_NAME} exactly once with the complete user-facing final answer in \`answer\`. Do not provide the final answer as ordinary assistant text.`;
 export type KiroCompletionMode = "disabled" | "required" | "text_fallback";

package/src/adapters/kiro.ts CHANGED Viewed

@@ -468,17 +468,38 @@ export function buildKiroPayload(
     }
   };
-  for (const msg of kiroPayloadMessages(parsed)) {
+  const payloadMessages = kiroPayloadMessages(parsed);
+  const replayMessagePrefixLength = Math.min(
+    Math.max(0, parsed._replayMessagePrefixLen ?? 0),
+    payloadMessages.length,
+  );
+  for (let messageIndex = 0; messageIndex < payloadMessages.length; messageIndex++) {
+    const msg = payloadMessages[messageIndex];
+    const isReplayedMessage = messageIndex < replayMessagePrefixLength;
     if (msg.role === "user" || msg.role === "developer") {
       const text = userContentText((msg as { content: string | OcxContentPart[] }).content);
-      const images = extractKiroImages((msg as { content: string | OcxContentPart[] }).content);
+      // Historical text/tool structure remains replayable, but image bytes are scoped to the turn
+      // that introduced them. Re-sending completed-turn images makes Kiro inspect the same visual on
+      // every unrelated follow-up and repeatedly pays the multimodal context cost. The parser-owned
+      // prefix boundary keeps current user/tool-result images intact, including the bounded internal
+      // completion retry built from this same parsed request.
+      const images = isReplayedMessage
+        ? []
+        : extractKiroImages((msg as { content: string | OcxContentPart[] }).content);
       pushUser(text, images);
     } else if (msg.role === "assistant") {
       const aMsg = msg as OcxAssistantMessage;
-      const text = (aMsg.content || [])
+      const rawText = (aMsg.content || [])
         .filter((b): b is OcxTextContent => b.type === "text")
         .map(b => b.text)
         .join("");
+      // Responses commentary is transient UI progress, not durable assistant state. Replaying it
+      // into every Kiro tool-result continuation teaches the model to repeat the same update and
+      // grows the upstream context on each client-driven tool round. Keep the structural tool use,
+      // but omit commentary prose from normal history. The adapter-owned completion retry appends
+      // its one replayable assistant turn without a commentary phase below, so that bounded path is
+      // preserved.
+      const text = aMsg.phase === "commentary" ? "" : rawText;
       const toolCalls = (aMsg.content || [])
         .filter((b): b is OcxToolCall => b.type === "toolCall");
       const toolUses: KiroToolUse[] = toolCalls.map(tc => {
@@ -492,7 +513,7 @@ export function buildKiroPayload(
       });
       if (!text && toolUses.length === 0) {
         const hasReasoning = aMsg.content.some(part => part.type === "thinking" && part.thinking.trim());
-        if (hasReasoning) continue;
+        if (hasReasoning || aMsg.phase === "commentary") continue;
       }
       pushAssistant(text, toolUses);
     } else if (msg.role === "toolResult") {
@@ -502,7 +523,7 @@ export function buildKiroPayload(
       }
       const text = userContentText(tr.content);
       const resultText = text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE;
-      const images = extractKiroImages(tr.content);
+      const images = isReplayedMessage ? [] : extractKiroImages(tr.content);
       const toolUseId = normalizeToolId(tr.toolCallId);
       if (!priorCalls.has(toolUseId)) {
         throw new Error(`Kiro history contains an orphaned tool result for call ${JSON.stringify(tr.toolCallId)}`);
@@ -1779,7 +1800,9 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       retryParsed.context.messages.push({
         role: "assistant",
         content: [{ type: "text" as const, text: assistantText }],
-        phase: "commentary",
+        // Intentionally omit `phase:"commentary"`: normal client commentary is filtered from
+        // Kiro history, while this adapter-owned one-shot replay is the evidence the bounded
+        // completion retry must validate.
         model: retryParsed.modelId,
         timestamp: Date.now(),
       });

package/src/cli/index.ts CHANGED Viewed

@@ -5,6 +5,7 @@ import { stripGrokConfig } from "../grok/inject";
 import { restoreLegacyOpenaiHistory } from "../codex/history-provider";
 import { reconcileJournal } from "../codex/journal";
 import {
+  applyProxyEnv,
   codexAutoStartEnabled,
   getConfigDir,
   loadConfig,
@@ -25,7 +26,7 @@ import { runTrayProxyRestart, runTrayProxyStart } from "./tray-proxy";
 import { installCrashGuards } from "../lib/crash-guard";
 import { hasHelpFlag, printSubcommandUsage, printUsage, printVersion } from "./help";
 import { findAvailablePort, isAddrInUse, PortUnavailableError, shouldPersistSelectedPort, waitForPortAvailable } from "../server/ports";
-import { findLiveProxy, probeHostname, type LiveProxy } from "../server/proxy-liveness";
+import { findLiveProxy, probeHostname, proxyIdentityAt, type LiveProxy } from "../server/proxy-liveness";
 import { stopProxy } from "../lib/process-control";
 import { loadServiceTokenFromFile } from "../lib/service-secrets";
 import { diagnoseService, isServiceOwnershipError, serviceCommand, serviceEnvironmentOwnedHere, serviceStartableFromTray, serviceStatusSummary, stopServiceIfInstalled, uninstallServiceIfInstalled } from "../service";
@@ -64,7 +65,7 @@ if (command !== undefined && command !== "help" && hasHelpFlag(args.slice(1))) {
   process.exit(0);
 }
-maybeAutoRestoreCodexShim(command, args);
+if (command !== "start") maybeAutoRestoreCodexShim(command, args);
 function parsePortOption(): number | undefined {
   if (args.length === 1) return undefined;
@@ -119,16 +120,22 @@ function startArgv(port?: number): string[] {
   return args;
 }
+function rejectAlreadyRunning(live: LiveProxy, fallbackPid: number | null = null): never {
+  console.error(`⚠️  Proxy already running (PID ${live.pid ?? fallbackPid ?? "unknown"}, port ${live.port}). Use 'ocx stop' first.`);
+  process.exit(1);
+}
 async function chooseListenPort(requestedPort?: number): Promise<number> {
   const config = loadConfig();
   const preferred = requestedPort ?? config.port ?? 10100;
   const hardPin = requestedPort !== undefined && requestedPort > 0;
+  const hostname = config.hostname ?? "127.0.0.1";
   // Soft start: brief prefer-retry then ephemeral hop.
   // Explicit `--port` (service wrappers / update restart): wait for the pinned port
   // to free without killing any listener (healthy ocx / foreign). Never hop.
   if (hardPin && preferred > 0) {
     const { reclaimListenPort } = await import("../server/port-reclaim");
-    await reclaimListenPort(preferred, config.hostname ?? "127.0.0.1", {
+    await reclaimListenPort(preferred, hostname, {
       // Ghost LISTEN rows with a dead PID can outlive the process for a while.
       // SetTcpEntry(DELETE_TCB) needs elevation (often returns 317), so the only
       // reliable non-admin recovery is to wait for the OS to release the TCB.
@@ -139,49 +146,67 @@ async function chooseListenPort(requestedPort?: number): Promise<number> {
       dropTcpRows: true,
     });
   }
+  let selected: number;
   try {
-    const selected = await findAvailablePort(preferred, config.hostname ?? "127.0.0.1", {
+    selected = await findAvailablePort(preferred, hostname, {
       // After reclaim, keep probing briefly — ghost rows sometimes clear between
       // the reclaim deadline and the final listen. Still never hop off `--port`.
       preferRetryMs: hardPin ? 5_000 : 750,
       preferRetryIntervalMs: 50,
-      allowEphemeralFallback: !hardPin,
+      allowEphemeralFallback: false,
     });
-    if (preferred > 0 && selected !== preferred) {
-      console.log(`⚠️  Port ${preferred} is busy; starting opencodex on ${selected}.`);
-    }
-    if (shouldPersistSelectedPort(config.port, selected, preferred)) {
-      config.port = selected;
-      saveConfig(config);
-    }
-    return selected;
   } catch (err) {
-    if (err instanceof PortUnavailableError) {
-      console.error(`❌ ${err.message}`);
-      console.error("   Stop whatever holds that port, or change config.port, then retry.");
-      process.exit(1);
+    if (err instanceof PortUnavailableError && !hardPin) {
+      // Runtime files are advisory: a live proxy can still own the preferred listener when
+      // both records are absent or stale. Check that listener before allocating an ephemeral
+      // port, so a missed discovery pass cannot shadow it and overwrite fresh runtime state.
+      if (preferred > 0) {
+        const identity = await proxyIdentityAt(preferred, { hostname });
+        if (identity) {
+          rejectAlreadyRunning({ pid: null, port: preferred, hostname, source: "config" });
+        }
+      }
+      const live = await findLiveProxy();
+      if (live) rejectAlreadyRunning(live);
+      selected = await findAvailablePort(0, hostname);
+      if (preferred > 0) {
+        console.log(`⚠️  Port ${preferred} is busy; starting opencodex on ${selected}.`);
+      }
+    } else {
+      if (err instanceof PortUnavailableError) {
+        console.error(`❌ ${err.message}`);
+        console.error("   Stop whatever holds that port, or change config.port, then retry.");
+        process.exit(1);
+      }
+      throw err;
     }
-    throw err;
   }
+  if (shouldPersistSelectedPort(config.port, selected, preferred)) {
+    config.port = selected;
+    saveConfig(config);
+  }
+  return selected;
 }
 async function handleStart(options: { block?: boolean } = {}) {
+  const requestedPort = parsePortOption();
+  // Identity probes must stay direct even when the shell supplied HTTP_PROXY
+  // without NO_PROXY. startServer applies the same idempotent normalization.
+  applyProxyEnv(loadConfig());
+  const existingPid = readPid();
+  const live = await findLiveProxy();
+  if (live) rejectAlreadyRunning(live, existingPid);
+  maybeAutoRestoreCodexShim(command, args);
+  if (existingPid) {
+    removePid(existingPid);
+  }
   // Native (WinSW) service mode has no batch wrapper to read the service token file
   // into the environment, so the app loads it here before the server binds. The server
   // auth path reads OPENCODEX_API_AUTH_TOKEN from the environment.
   const serviceToken = loadServiceTokenFromFile(process.env);
   if (serviceToken) process.env.OPENCODEX_API_AUTH_TOKEN = serviceToken;
-  const requestedPort = parsePortOption();
   if (!currentExternalCodexModelProvider()) reconcileJournal();
-  const existingPid = readPid();
-  if (existingPid) {
-    const live = await findLiveProxy();
-    if (live) {
-      console.error(`⚠️  Proxy already running (PID ${live.pid ?? existingPid}, port ${live.port}). Use 'ocx stop' first.`);
-      process.exit(1);
-    }
-    removePid(existingPid);
-  }
   // Interactive-only update prompt. Must run BEFORE we bind a port / write a
   // PID: choosing "Update now" installs globally and exits, so we never want a
@@ -213,16 +238,29 @@ async function handleStart(options: { block?: boolean } = {}) {
         }
         continue;
       }
+      const live = await findLiveProxy();
+      if (live) rejectAlreadyRunning(live);
       console.log(`⚠️  Port ${port} was taken while starting; picking another...`);
       port = await chooseListenPort(requestedPort);
     }
   }
+  const config = loadConfig();
+  const preferred = requestedPort ?? config.port ?? 10100;
+  if (port !== preferred && preferred > 0) {
+    // Recheck immediately before any runtime-state write: another proxy may have won the
+    // preferred listener after soft fallback selection completed.
+    const identity = await proxyIdentityAt(preferred, { hostname: config.hostname });
+    if (identity) {
+      server.stop(true);
+      rejectAlreadyRunning({ pid: null, port: preferred, hostname: config.hostname, source: "config" });
+    }
+  }
   // A single request's streaming error must never crash the daemon serving every
   // other Codex session — capture the full stack to crash.log and stay up.
   installCrashGuards();
   writePid(process.pid);
-  const config = loadConfig();
   writeRuntimePort({ pid: process.pid, port, hostname: config.hostname });
   // No pre-emptive snapshot here. `injectCodexConfig` journals the exact bytes it
   // is about to transform; snapshotting earlier only captured a baseline that could

package/src/cli/status.ts CHANGED Viewed

@@ -3,7 +3,7 @@ import { codexAutoStartEnabled, getConfigPath, getPidPath, readConfigDiagnostics
 import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "../codex/plugins-doctor";
 import { findLiveProxy, isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
 import type { OcxConfig } from "../types";
-import { diagnoseService, serviceLogPath } from "../service";
+import { diagnoseService, serviceStatusSummary } from "../service";
 import { collectStartupHealth, type StartupHealth } from "../codex/autostart-health";
 import { getCodexRoutingKind } from "../codex/inject";
 import { diagnoseCodexShim } from "../codex/shim";
@@ -172,9 +172,10 @@ export async function collectStatus(): Promise<CliStatusView> {
   // A service can be registered and still not serve: the manager reports the job
   // either way. `live` was already identity-probed a few lines above, so cross-check
   // rather than print registration as if it were service.
+  const baseServiceSummary = serviceStatusSummary(service);
   const serviceSummary = service.installed && !live
-    ? `${service.summary} — registered but NOT serving; see ${serviceLogPath()} and re-run 'ocx service install'`
-    : service.summary;
+    ? `${baseServiceSummary} — registered but NOT serving; re-run 'ocx service install'`
+    : baseServiceSummary;
   const codexShim = diagnoseCodexShim();
   const codexShimSummary = codexShim.summary;
   const startup = collectStartupHealth(config, {

package/src/config.ts CHANGED Viewed

@@ -775,6 +775,10 @@ const configSchema = z.object({
   syncCodexSubagentDefaults: z.boolean().optional().catch(undefined),
   codexShimAutoRestore: z.boolean().optional(),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
+  // OAuth account ids come from external identity providers (JWT sub, ARN-derived
+  // hashes, UUIDs), so validate only length, never charset: a foreign id must not
+  // drop the whole paused set on config load.
+  pausedOauthAccountIds: z.record(z.string(), z.array(z.string().min(1).max(128))).optional(),
   codexAccountNamespaces: codexAccountNamespacesSchema.optional(),
   // Model ids excluded from the Grok Build managed block (dashboard switches).
   grokExcludedModels: z.array(z.string()).optional(),
@@ -2045,9 +2049,10 @@ export function resolveEnvValue(value: string | undefined): string | undefined {
  */
 export function applyProxyEnv(config: OcxConfig): void {
   const proxy = resolveEnvValue(config.proxy);
-  if (!proxy) return;
-  if (!process.env.HTTP_PROXY?.trim() && !process.env.http_proxy?.trim()) process.env.HTTP_PROXY = proxy;
-  if (!process.env.HTTPS_PROXY?.trim() && !process.env.https_proxy?.trim()) process.env.HTTPS_PROXY = proxy;
+  if (proxy) {
+    if (!process.env.HTTP_PROXY?.trim() && !process.env.http_proxy?.trim()) process.env.HTTP_PROXY = proxy;
+    if (!process.env.HTTPS_PROXY?.trim() && !process.env.https_proxy?.trim()) process.env.HTTPS_PROXY = proxy;
+  }
   const existing = process.env.NO_PROXY ?? process.env.no_proxy ?? "";
   const entries = existing.split(",").map(s => s.trim()).filter(Boolean);
   const seen = new Set(entries.map(e => e.toLowerCase()));

package/src/oauth/account-pause.ts ADDED Viewed

@@ -0,0 +1,31 @@
+import type { OcxConfig } from "../types";
+/**
+ * Per-provider OAuth account pause state, mirroring the Codex account pool's
+ * `pausedCodexAccountIds` so manually paused rows survive restarts.
+ *
+ * Pause is an administrative exclusion: a paused account cannot be activated and
+ * is skipped when a provider's active selection is promoted. Credentials are
+ * never touched by pause/resume.
+ */
+export function isOauthAccountPaused(config: OcxConfig, provider: string, accountId: string): boolean {
+  return config.pausedOauthAccountIds?.[provider]?.includes(accountId) ?? false;
+}
+/** Persist the account's pool eligibility without changing credentials or runtime health. */
+export function setOauthAccountPaused(config: OcxConfig, provider: string, accountId: string, paused: boolean): void {
+  const byProvider = { ...(config.pausedOauthAccountIds ?? {}) };
+  const ids = new Set(byProvider[provider] ?? []);
+  if (paused) ids.add(accountId);
+  else ids.delete(accountId);
+  if (ids.size > 0) byProvider[provider] = [...ids];
+  else delete byProvider[provider];
+  if (Object.keys(byProvider).length > 0) config.pausedOauthAccountIds = byProvider;
+  else delete config.pausedOauthAccountIds;
+}
+export function forgetOauthAccountPause(config: OcxConfig, provider: string, accountId: string): void {
+  setOauthAccountPaused(config, provider, accountId, false);
+}

package/src/oauth/index.ts CHANGED Viewed

@@ -878,11 +878,17 @@ export async function runLogin(
       if (!existing.accountId && !existing.email) {
         throw new Error("Could not verify signed-in account identity for reauth.");
       }
-      const identityMatches = existing.accountId && cred.accountId
-        ? existing.accountId === cred.accountId
-        : existing.email && cred.email
-          ? existing.email.toLowerCase() === cred.email.toLowerCase()
-          : false;
+      // Kiro social accounts share one device-scoped profile ARN, so reauth identity
+      // must compare the signed-in email first; otherwise reauthenticating a different
+      // Google account would silently overwrite the selected slot. Other providers keep
+      // accountId-first matching.
+      const identityMatches = provider === "kiro" && existing.email && cred.email
+        ? existing.email.toLowerCase() === cred.email.toLowerCase()
+        : existing.accountId && cred.accountId
+          ? existing.accountId === cred.accountId
+          : existing.email && cred.email
+            ? existing.email.toLowerCase() === cred.email.toLowerCase()
+            : false;
       if (!identityMatches) {
         throw new Error("Signed-in account does not match the selected account. Sign in with the same account.");
       }

package/src/oauth/kiro-credentials.ts CHANGED Viewed

@@ -266,6 +266,23 @@ function kiroCliImportSelectorConfigured(): boolean {
   return Boolean(process.env.KIROCLI_DB_PATH?.trim() || process.env.KIRO_CLI_DB_FILE?.trim());
 }
+/**
+ * True only when a custom KIROCLI_DB_PATH / KIRO_CLI_DB_FILE selector points at a
+ * DIFFERENT database than the native kiro-cli store. A selector that resolves to the
+ * native store (the common Windows case where the installer path is exported into the
+ * environment) is not ambiguous for logout rollback: the file being snapshotted is
+ * exactly the one `kiro-cli logout` mutates.
+ */
+function kiroCliImportSelectorConflictsWithNative(): boolean {
+  const configured = process.env.KIROCLI_DB_PATH?.trim() || process.env.KIRO_CLI_DB_FILE?.trim();
+  if (!configured) return false;
+  const configuredPath = expandPath(configured);
+  const normalize = process.platform === "win32"
+    ? (value: string) => win32.normalize(value).toLowerCase()
+    : (value: string) => posix.normalize(value);
+  return !nativeKiroCliSessionEntries().some(entry => normalize(entry.path) === normalize(configuredPath));
+}
 function selectTokenRow(db: Database): { value: string } | null | "ambiguous" | "selected_missing" {
   const rows = db.query("SELECT key, value FROM auth_kv WHERE key LIKE ? ORDER BY key ASC").all("%:token") as Array<{ key: string; value: string }>;
   const selectedKey = process.env.KIROCLI_TOKEN_KEY?.trim();
@@ -488,7 +505,7 @@ export function inspectKiroCliSessionSnapshot(): {
   blocked: boolean;
 } {
   const diagnostics: KiroImportDiagnostic[] = [];
-  if (kiroCliImportSelectorConfigured()) {
+  if (kiroCliImportSelectorConflictsWithNative()) {
     diagnostics.push({ location: "kiro-cli-db-env", status: "token_ambiguous" });
     return { snapshot: null, diagnostics, blocked: true };
   }

package/src/oauth/store.ts CHANGED Viewed

@@ -456,20 +456,43 @@ export async function saveCredential(
   if (!safe) return;
   await mutateStore(store => {
     const set = store[provider];
-    const identity = safe.accountId ?? safe.email;
+    // Kiro social logins share one device-scoped CodeWhisperer profile ARN, so the
+    // profile ARN cannot distinguish Google accounts. Prefer the signed-in email for
+    // Kiro identity so a second Google account appends a pool row instead of silently
+    // replacing the first. Other providers keep accountId-first identity semantics.
+    const identityKey = (candidate: OAuthCredentials): string | undefined =>
+      provider === "kiro"
+        ? (candidate.email ?? candidate.accountId)
+        : (candidate.accountId ?? candidate.email);
+    const identity = identityKey(safe);
     if (!set || SINGLE_SLOT_PROVIDERS.has(provider)) {
       const id = newAccountId(safe);
       store[provider] = { activeAccountId: id, accounts: [{ id, credential: safe, addedAt: Date.now() }] };
       return;
     }
     if (identity) {
-      const existing = set.accounts.find(a => (a.credential.accountId ?? a.credential.email) === identity);
+      const existing = set.accounts.find(a => identityKey(a.credential) === identity);
       if (existing) {
         existing.credential = safe;
         delete existing.needsReauth;
         set.activeAccountId = existing.id;
         return;
       }
+      // Kiro legacy rows created before email was extracted carry only the profile ARN.
+      // Upgrade an email-less row in place when the new credential proves it is the
+      // same underlying Kiro profile, instead of appending a duplicate for the same human.
+      if (provider === "kiro" && safe.email && safe.kiro?.profileArn) {
+        const legacy = set.accounts.find(a =>
+          a.credential.email === undefined
+          && a.credential.kiro?.profileArn === safe.kiro?.profileArn,
+        );
+        if (legacy) {
+          legacy.credential = safe;
+          delete legacy.needsReauth;
+          set.activeAccountId = legacy.id;
+          return;
+        }
+      }
       // Legacy migration: a pre-identity row (no accountId/email) for this provider is the
       // SAME human re-logging in after the identity extraction shipped — upgrading the
       // active identity-less row in place prevents a stale duplicate that stays selectable