@ctrl-spc/cs 0.7.15 → 0.7.16

package/dist/agents.js

@@ -1,4 +1,9 @@
-import { accessSync, constants, readdirSync, statSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { configDir } from './config.js';
+import { userCodexHome, ensureCodexRunHome, removeCodexRunHome, CodexHomeFailure } from './codex-home.js';
+import { windowsSafeSpawn, killTree } from './win-shell.js';
+import { accessSync, constants, readdirSync, statSync, readFileSync, writeFileSync, mkdirSync, renameSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { delimiter, join, win32 } from 'node:path';
 const AGENTS = ['claude', 'codex'];
@@ -108,3 +113,172 @@ export function detectAgents() {
 export function agentPath(agent) {
     return resolve(agent);
 }
+/** Native status output only. Successful exit without a supported positive
+ * response is unknown; it may be a newer or unsupported CLI. */
+export function parseHarnessStatus(agent, output, exitCode) {
+    if (agent === 'claude') {
+        try {
+            const value = JSON.parse(output);
+            if (value?.loggedIn === true && exitCode === 0)
+                return { state: 'authenticated', reason: 'native-status' };
+            if (value?.loggedIn === false)
+                return { state: 'sign-in-required', reason: 'provider-rejected' };
+        }
+        catch { /* Unsupported output never implies rejection. */ }
+    }
+    else {
+        if (exitCode === 0 && /^Logged in using (ChatGPT|an API key)(?:\s|$)/m.test(output))
+            return { state: 'authenticated', reason: 'native-status' };
+        if (/^Not logged in\s*$/m.test(output))
+            return { state: 'sign-in-required', reason: 'provider-rejected' };
+    }
+    return { state: 'unknown', reason: 'unsupported' };
+}
+let evidenceDirectory = '';
+let evidence = {};
+const probeTimes = new Map();
+const probes = new Map();
+export function executionIdentity(agent) {
+    return createHash('sha256').update(JSON.stringify([agentPath(agent), agent === 'codex' ? userCodexHome() : process.env.CLAUDE_CONFIG_DIR ?? homedir(), process.platform])).digest('hex');
+}
+function loadHarnessEvidence() {
+    const directory = configDir();
+    if (evidenceDirectory === directory)
+        return;
+    evidenceDirectory = directory;
+    evidence = {};
+    probeTimes.clear();
+    try {
+        const saved = JSON.parse(readFileSync(join(directory, 'harness-auth.json'), 'utf8'));
+        for (const agent of AGENTS) {
+            const value = saved[agent];
+            if (!value)
+                continue;
+            const item = value.evidence;
+            if (value.identity !== executionIdentity(agent) || !item || !['authenticated', 'sign-in-required', 'unknown'].includes(item.state)
+                || !['native-status', 'dispatch-success', 'provider-rejected', 'not-installed', 'preparation-unavailable', 'timeout', 'unsupported', 'check-failed'].includes(item.reason)
+                || !Number.isFinite(Date.parse(item.observed_at))
+                || ![null, 'authenticated', 'sign-in-required'].includes(item.last_result)
+                || (item.last_result_at !== null && !Number.isFinite(Date.parse(item.last_result_at))))
+                continue;
+            evidence[agent] = { identity: value.identity, evidence: {
+                    state: item.state === 'sign-in-required' ? item.state : 'unknown',
+                    observed_at: item.observed_at, last_result: item.last_result, last_result_at: item.last_result_at,
+                    reason: item.state === 'sign-in-required' ? 'provider-rejected' : 'check-failed',
+                } };
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw new Error('Saved provider status could not be read.', { cause: error });
+    }
+}
+export function recordHarnessObservation(agent, state, reason, now = Date.now(), expectedIdentity) {
+    loadHarnessEvidence();
+    const identity = executionIdentity(agent);
+    if (expectedIdentity !== undefined && expectedIdentity !== identity)
+        return;
+    const prior = evidence[agent]?.evidence;
+    if (prior && Date.parse(prior.observed_at) > now)
+        return;
+    const observed_at = new Date(now).toISOString();
+    const item = {
+        state, observed_at, reason,
+        last_result: state === 'unknown' ? prior?.last_result ?? null : state,
+        last_result_at: state === 'unknown' ? prior?.last_result_at ?? null : observed_at,
+    };
+    evidence[agent] = { identity: executionIdentity(agent), evidence: item };
+    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    const temporary = join(configDir(), `harness-auth.${randomUUID()}.tmp`);
+    try {
+        writeFileSync(temporary, JSON.stringify(evidence), { flag: 'wx', mode: 0o600 });
+        renameSync(temporary, join(configDir(), 'harness-auth.json'));
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+export function harnessAuthEvidence(now = Date.now()) {
+    loadHarnessEvidence();
+    return Object.fromEntries(AGENTS.flatMap(agent => {
+        const saved = evidence[agent];
+        if (!saved)
+            return [];
+        const item = saved.evidence;
+        const age = now - Date.parse(item.observed_at);
+        const current = saved.identity === executionIdentity(agent) && age >= -5000 && age < 120_000;
+        return [[agent, { ...item, state: saved.identity !== executionIdentity(agent) || item.state === 'authenticated' && !current ? 'unknown' : item.state }]];
+    }));
+}
+/** Called only by Presence. Same executable and seeded credential context as
+ * dispatch; no probe starts an agent conversation or carries product credentials. */
+export async function probeHarnessAuth(agent, now = Date.now()) {
+    loadHarnessEvidence();
+    if (probes.has(agent))
+        return probes.get(agent);
+    if (now - (probeTimes.get(agent) ?? -Infinity) < 60_000)
+        return;
+    probeTimes.set(agent, now);
+    let closed = true;
+    let home = null;
+    const cleanup = () => { if (home) {
+        removeCodexRunHome(home);
+        home = null;
+    } ; probes.delete(agent); };
+    const pending = (async () => {
+        const bin = agentPath(agent);
+        if (!bin) {
+            recordHarnessObservation(agent, 'unknown', 'not-installed');
+            return;
+        }
+        if (agent === 'codex' && process.platform !== 'win32') {
+            const prepared = ensureCodexRunHome({ url: 'http://127.0.0.1:1/mcp' }, null, `status-${randomUUID()}`, false);
+            if (prepared instanceof CodexHomeFailure) {
+                recordHarnessObservation(agent, 'unknown', 'preparation-unavailable');
+                return;
+            }
+            home = prepared;
+        }
+        try {
+            const args = agent === 'codex' ? ['login', 'status'] : ['auth', 'status'];
+            const launch = windowsSafeSpawn(bin, args);
+            const result = await new Promise((resolve) => {
+                const child = spawn(bin, launch.args, { shell: launch.shell, windowsHide: true, detached: process.platform !== 'win32',
+                    env: home ? { ...process.env, CODEX_HOME: home } : process.env, stdio: ['ignore', 'pipe', 'pipe'] });
+                closed = false;
+                let output = '', timedOut = false;
+                const collect = (chunk) => { output = (output + chunk.toString()).slice(-16_384); };
+                child.stdout.on('data', collect);
+                child.stderr.on('data', collect);
+                const timer = setTimeout(() => {
+                    timedOut = true;
+                    if (process.platform !== 'win32' && child.pid) {
+                        try {
+                            process.kill(-child.pid, 'SIGKILL');
+                        }
+                        catch {
+                            killTree(child);
+                        }
+                    }
+                    else
+                        killTree(child);
+                    resolve({ output: '', code: -1, timedOut: true });
+                }, 5000);
+                child.once('error', () => { closed = true; clearTimeout(timer); cleanup(); resolve({ output: '', code: -1, timedOut }); });
+                child.once('close', code => { closed = true; clearTimeout(timer); cleanup(); resolve({ output, code: code ?? -1, timedOut }); });
+            });
+            const resultState = result.timedOut ? { state: 'unknown', reason: 'timeout' } : parseHarnessStatus(agent, result.output, result.code);
+            recordHarnessObservation(agent, resultState.state, resultState.reason);
+        }
+        catch (error) {
+            recordHarnessObservation(agent, 'unknown', 'check-failed');
+        }
+        finally {
+            if (closed)
+                cleanup();
+        }
+    })().finally(() => { if (closed)
+        cleanup(); });
+    probes.set(agent, pending);
+    return pending;
+}

package/dist/codex-home.js

@@ -1,8 +1,16 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
+import { chmodSync, copyFileSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { configDir } from './config.js';
+export class CodexHomeFailure {
+    cause;
+    kind = 'preparation-unavailable';
+    message = 'Codex credentials or its local execution configuration could not be prepared.';
+    constructor(cause) {
+        this.cause = cause;
+    }
+}
 /**
  * 18c SLICE 8 — A CODEX WORKER IS ISOLATED LIKE A CLAUDE WORKER.
  *
@@ -319,8 +327,6 @@ subagentsEnabled = true, runtimePlatform = process.platform) {
     const source = join(userCodexHome(), 'auth.json');
     /* No credential, no isolated home. See the block comment above: this is the
        exact shape that hangs, and hanging is worse than inheriting. */
-    if (!existsSync(source))
-        return null;
     const home = codexRunHomePath(homeKey);
     try {
         /* FROM EMPTY. See above: a retry of the same request would otherwise start
@@ -352,10 +358,9 @@ subagentsEnabled = true, runtimePlatform = process.platform) {
         writeFileSync(join(home, OWNER_FILE), JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }), { mode: 0o600 });
         return home;
     }
-    catch {
-        /* Same reasoning as the missing credential: an isolated home we cannot write
-           is not a reason to fail the user's run. */
-        return null;
+    catch (cause) {
+        removeCodexRunHome(home);
+        return new CodexHomeFailure(cause);
     }
 }
 /**
@@ -366,8 +371,6 @@ subagentsEnabled = true, runtimePlatform = process.platform) {
  */
 export function ensurePanel3CodexOwnerHome(server, ownerRunId, runtimePlatform = process.platform) {
     const source = join(userCodexHome(), 'auth.json');
-    if (!existsSync(source))
-        return null;
     const home = panel3CodexOwnerHomePath(ownerRunId);
     try {
         mkdirSync(home, { recursive: true, mode: 0o700 });
@@ -376,8 +379,8 @@ export function ensurePanel3CodexOwnerHome(server, ownerRunId, runtimePlatform =
         writeFileSync(join(home, 'config.toml'), codexRunConfigToml(server, null, runtimePlatform, false, true), { mode: 0o600 });
         return home;
     }
-    catch {
-        return null;
+    catch (cause) {
+        return new CodexHomeFailure(cause);
     }
 }
 /** Product-owned persistent state only. Windows owners use the installed Codex

package/dist/companion-ui.js

@@ -288,25 +288,42 @@ async function api(path, opts) {
 async function boot() {
   try {
     const r = await api('/api/session');
-    if (!r.ok || r.data.signedIn === null) {
-      renderSessionUnavailable(r.data.sessionError || r.data.error);
+    if (!r.ok || r.data.signedIn === null || r.data.sessionRenewing || (r.data.signedIn && r.data.connectionState !== 'online')) {
+      renderSessionUnavailable(r.data.sessionError || r.data.error, r.data);
     } else if (r.data.signedIn) renderHome(r.data);
     else renderSignIn(r.data || {});
   } catch (_) { renderSessionUnavailable(); }
 }
 
-function renderSessionUnavailable(message) {
+function renderSessionUnavailable(message, session) {
+  session = session || {};
   stopBadgePoll();
   app.replaceChildren();
   const wrap = el('div', 'auth');
   const card = el('div', 'auth-card');
-  card.append(logo(), el('h1', 'auth-title', 'Connection unavailable'));
+  card.append(logo(), el('h1', 'auth-title', session.sessionRenewing ? 'Renewing session' : 'Connection unavailable'));
+  const status = el('p', 'auth-sub', session.sessionRenewing ? 'Your saved sign-in is being renewed. Your work remains saved.' : 'Your saved sign-in is preserved. Check the connection or start the local service.');
+  status.setAttribute('role', 'status'); card.append(status);
   card.append(el('p', 'auth-sub', message || 'Sign-in could not be checked. Check your connection and try again.'));
   const retry = el('button', 'btn btn-primary', 'Try again');
   retry.addEventListener('click', boot);
   card.append(retry);
+  if (session.connectionState === 'unknown') {
+    const start = el('button', 'btn', 'Start');
+    start.addEventListener('click', async function () {
+      if (start.disabled) return;
+      start.disabled = true; start.textContent = 'Starting…';
+      try { const result = await api('/api/start', {method:'POST'}); if (!result.ok) throw new Error(result.data.error || 'The local service could not start.'); await boot(); }
+      catch (error) { status.textContent = error.message || 'The local service could not start. Try again.'; start.disabled = false; start.textContent = 'Start'; }
+    });
+    card.append(start);
+  }
   wrap.append(card);
   app.append(wrap);
+  badgePollTimer = setInterval(function () { void api('/api/session').then(function (r) {
+    if (!card.isConnected || !r.ok || r.data.signedIn === null || r.data.sessionRenewing || (r.data.signedIn && r.data.connectionState !== 'online')) return;
+    if (r.data.signedIn) renderHome(r.data); else renderSignIn(r.data);
+  }).catch(function () {}); }, 3000);
 }
 
 /** The passive "Agent tools" badge (feature 05). Read-only: no button, no
@@ -370,6 +387,7 @@ async function pollBadgeOnce() {
     // Home may have been torn down while the fetch was in flight.
     if (!badge.isConnected) return;
     if (r.ok && r.data.signedIn === false) { renderSignIn(r.data); return; }
+    if (r.ok && (r.data.sessionRenewing || (r.data.signedIn && r.data.connectionState !== 'online'))) { renderSessionUnavailable(r.data.sessionError, r.data); return; }
     const fresh = agentToolsBadge(!r.ok || r.data.signedIn === null
       ? { reason: 'unavailable', message: r.data.sessionError }
       : r.data.agentTools);
@@ -398,6 +416,8 @@ function renderSignIn(session) {
   app.replaceChildren();
   const wrap = el('div', 'auth');
   const card = el('div', 'auth-card');
+  if (session.sessionState === 'signed-out') { const status = el('p', 'auth-sub', 'Signed out'); status.setAttribute('role', 'status'); card.append(status); }
+  if (session.sessionState === 'rejected') { const warning = el('p', 'auth-sub', 'CTRL+SPC sign-in was rejected. Sign in here to reconnect. Provider sign-in and stopped assignments remain separate.'); warning.setAttribute('role', 'status'); card.append(warning); }
   card.append(logo());
   card.append(el('h1', 'auth-title', 'Sign in'));
   card.append(el('p', 'auth-sub', 'The board your agents report to. Sign in to link this computer to your account.'));

package/dist/companion.js

@@ -1,11 +1,12 @@
+import { isAuthSessionMissingError } from '@supabase/supabase-js';
 import { createServer } from 'node:http';
 import { timingSafeEqual } from 'node:crypto';
 import { COMPANION_PORT } from './env.js';
 import { openBrowser } from './browser.js';
-import { companionToken, getMachineIdentity, readSession, clearSession, readCodebasePaths, writeCodebasePath } from './config.js';
+import { companionToken, getMachineIdentity, readSession, readSessionRecord, clearSession, readCodebasePaths, writeCodebasePath } from './config.js';
 import { getClient, signIn, NotLoggedIn, confirmedSessionRejection } from './supabase.js';
-import { stopPresence, liveClient, isPresenceRunning } from './presence.js';
-import { startLocalRuntime, localRuntimeOwned, stopLocalOwnerForSignal, inspectLocalRuntime, checkLegacyUpgrade } from './daemon-lifecycle.js';
+import { liveClient } from './presence.js';
+import { startLocalRuntime, localRuntimeOwned, stopLocalOwnerForSignal, inspectLocalRuntime, checkLegacyUpgrade, notifySessionChanged } from './daemon-lifecycle.js';
 import { CLI_VERSION } from './package-version.js';
 import { detectAgents } from './agents.js';
 import { agentToolsBadgeState, unregisterFromClaude, unregisterFromCodex, } from './mcp.js';
@@ -113,7 +114,10 @@ export async function serveCompanion({ open = false } = {}) {
     }
     closeCompanion = () => new Promise((resolve, reject) => {
         server.close((error) => error ? reject(error) : resolve());
-        server.closeIdleConnections();
+        // An attached browser may still be awaiting a status request during a
+        // connection outage. Closing this GUI must also close its own active HTTP
+        // connections; they cannot keep the already-stopped runtime alive.
+        server.closeAllConnections();
     });
     // Local control starts before cloud sign-in. The GUI remains usable offline.
     try {
@@ -244,7 +248,17 @@ async function handleApi(req, res, path, query) {
         const machine = getMachineIdentity();
         let email = null;
         let sessionError = null;
-        const session = readSession();
+        let record = null;
+        try {
+            record = readSessionRecord();
+        }
+        catch {
+            sessionError = 'Local sign-in storage could not be read. Your service controls remain available.';
+        }
+        const local = await inspectLocalRuntime(Date.now() + 2000).catch(() => null);
+        const renewal = local?.status?.sessionRenewing === true;
+        const connectionState = local?.status?.cloud ?? 'unknown';
+        const session = record?.state === 'signed-in' ? record.tokens : null;
         if (session) {
             try {
                 const { data, error } = await (await requestClient()).auth.getUser(session.access_token);
@@ -256,9 +270,10 @@ async function handleApi(req, res, path, query) {
             }
             catch (error) {
                 if (error instanceof NotLoggedIn) {
-                    sessionError = 'Saved sign-in needs to be checked by the service. Run cs start on this computer, then try again.';
+                    sessionError = 'The local service needs to check your sign-in. Use Start in Companion if the service is stopped, then check again.';
                 }
-                else if (!confirmedSessionRejection(error)) {
+                else if (!confirmedSessionRejection(error) && !isAuthSessionMissingError(error)) {
+                    // getUser received an explicit stored JWT; Auth normalizes its typed session_not_found rejection to this class.
                     sessionError = 'Sign-in could not be checked. Check your connection and try again.';
                 }
             }
@@ -266,6 +281,9 @@ async function handleApi(req, res, path, query) {
         json(res, 200, {
             signedIn: sessionError ? null : email !== null,
             sessionError,
+            sessionRenewing: renewal,
+            connectionState,
+            sessionState: record?.state ?? 'signed-out',
             email,
             machineName: machine.name,
             platform: process.platform,
@@ -284,6 +302,7 @@ async function handleApi(req, res, path, query) {
         }
         try {
             const result = await signIn(email, password);
+            await notifySessionChanged();
             await startPresenceUnlessDaemonServes((err) => {
                 console.warn(`Presence did not start after sign-in: ${err.message}`);
             });
@@ -295,30 +314,19 @@ async function handleApi(req, res, path, query) {
         return;
     }
     if (req.method === 'POST' && path === '/api/logout') {
-        // Logout also unregisters ctrl-spc from the detected agents (Phase 3), so no
-        // dead server entry is left behind for the next agent run.
-        if (isPresenceRunning()) {
-            await stopPresence({ unregister: true });
-        }
-        else {
-            /* ═══ A COMPANION THAT DEFERRED TO A DAEMON STILL HAS TO UNREGISTER. ═══
-               `stopPresence` returns early when this process holds no presence
-               (`presence.ts:603-604`), so without this branch logout would delete
-               `session.json` and leave the `ctrl-spc` entry in Claude's and Codex's
-               configs pointing at a server whose session is gone.
-      
-               Only the unregistration is copied, deliberately. The other two things
-               `stopPresence` does belong to a process that owns them, and this one
-               owns neither: the running tools server is the daemon's, and the daemon
-               still owns and heartbeats `cliv2_agents`. Stamping `stopped_at` from
-               here would mark a machine offline that is genuinely online. */
+        try {
+            await clearSession();
+            await notifySessionChanged();
             const agents = detectAgents();
             if (agents.includes('claude'))
                 void unregisterFromClaude();
             if (agents.includes('codex'))
                 void unregisterFromCodex();
         }
-        clearSession();
+        catch (error) {
+            json(res, 503, { ok: false, error: error instanceof Error ? error.message : 'Sign-out could not be confirmed.' });
+            return;
+        }
         json(res, 200, { ok: true });
         return;
     }

package/dist/config.js

@@ -1,6 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync, openSync, closeSync, fsyncSync, renameSync } from 'node:fs';
 import { homedir, hostname, platform } from 'node:os';
-import { randomBytes, createHash } from 'node:crypto';
+import { randomBytes, randomUUID, createHash } from 'node:crypto';
 import { execSync, execFileSync } from 'node:child_process';
 import { join } from 'node:path';
 /** Own config dir, isolated from the v1 CLI: `~/.config/ctrl-spc-v2`. */
@@ -196,26 +196,157 @@ export function clearSupersededMachineIds() {
     }
     catch { /* leave as-is */ }
 }
+/** Missing, intentionally signed out, and unreadable storage are different facts. */
+export function readSessionRecord() {
+    let text;
+    try {
+        text = readFileSync(filePath('session.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new Error('Local sign-in could not be read.', { cause: error });
+    }
+    try {
+        const value = JSON.parse(text);
+        if (!value || typeof value !== 'object')
+            throw new Error('Invalid record');
+        if (value.schema === undefined && typeof value.access_token === 'string' && value.access_token) {
+            if (value.refresh_token !== undefined && typeof value.refresh_token !== 'string')
+                throw new Error('Invalid credential');
+            // A stable legacy identity permits the first refresh to upgrade in place.
+            return { schema: 1, generation: createHash('sha256').update(text).digest('hex'), accountId: null,
+                state: 'signed-in', tokens: { access_token: value.access_token, refresh_token: value.refresh_token ?? '' } };
+        }
+        if (value.schema !== 1 || typeof value.generation !== 'string' || !value.generation
+            || !(value.accountId === null || (typeof value.accountId === 'string' && value.accountId)))
+            throw new Error('Invalid identity');
+        if (value.state === 'signed-out' || value.state === 'rejected') {
+            if ('tokens' in value)
+                throw new Error('Inactive record contains credentials');
+            return { schema: 1, generation: value.generation, accountId: value.accountId, state: value.state };
+        }
+        if (value.state !== 'signed-in' || typeof value.tokens?.access_token !== 'string' || !value.tokens.access_token
+            || typeof value.tokens.refresh_token !== 'string')
+            throw new Error('Invalid credentials');
+        return { schema: 1, generation: value.generation, accountId: value.accountId, state: 'signed-in',
+            tokens: { access_token: value.tokens.access_token, refresh_token: value.tokens.refresh_token } };
+    }
+    catch (error) {
+        throw new Error('Local sign-in storage is incomplete or invalid.', { cause: error });
+    }
+}
+/** Compatibility for passive consumers: inactive records never expose tokens. */
 export function readSession() {
-    const path = filePath('session.json');
-    if (!existsSync(path))
-        return null;
+    const record = readSessionRecord();
+    return record?.state === 'signed-in' ? record.tokens : null;
+}
+async function changeSession(change) {
+    // Dynamic import avoids config -> process helpers -> config initialization.
+    const { inspectProcess, processIdentityMatches } = await import('./win-shell.js');
+    const deadline = Date.now() + 5000;
+    const owner = await inspectProcess(process.pid, deadline);
+    if (!owner)
+        throw new Error('Cannot verify the sign-in writer process.');
+    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    const lock = filePath('session.lock');
+    const nonce = randomUUID();
+    let held = false;
+    while (Date.now() < deadline) {
+        try {
+            const fd = openSync(lock, 'wx', 0o600);
+            try {
+                writeFileSync(fd, JSON.stringify({ nonce, owner }));
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            held = true;
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        let prior;
+        try {
+            prior = JSON.parse(readFileSync(lock, 'utf8'));
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError) && error.code !== 'ENOENT')
+                throw error;
+        }
+        if (prior && typeof prior.nonce === 'string' && Number.isInteger(prior.owner?.pid)) {
+            const live = await inspectProcess(prior.owner.pid, deadline);
+            if (!live || !processIdentityMatches(prior.owner, live)) {
+                // Recheck the resource identity after asynchronous process inspection.
+                try {
+                    if (JSON.parse(readFileSync(lock, 'utf8')).nonce === prior.nonce)
+                        rmSync(lock);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+        }
+        await new Promise(resolve => setTimeout(resolve, 25));
+    }
+    if (!held)
+        throw new Error('Local sign-in is busy or its writer cannot be verified. Try again.');
+    const temp = filePath('session.' + nonce + '.tmp');
     try {
-        return JSON.parse(readFileSync(path, 'utf8'));
+        const record = change(readSessionRecord());
+        if (record) {
+            const fd = openSync(temp, 'wx', 0o600);
+            try {
+                writeFileSync(fd, JSON.stringify(record));
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            renameSync(temp, filePath('session.json'));
+        }
+        return record;
     }
-    catch {
-        return null;
+    finally {
+        rmSync(temp, { force: true });
+        if (JSON.parse(readFileSync(lock, 'utf8')).nonce === nonce)
+            rmSync(lock);
     }
 }
-export function writeSession(session) {
-    writeJson('session.json', session);
+export async function writeSession(session, accountId = null, expectedGeneration) {
+    if (!session.access_token || !session.refresh_token)
+        throw new Error('Sign-in did not return complete credentials.');
+    return (await changeSession(prior => {
+        if (expectedGeneration !== undefined && (prior?.generation ?? null) !== expectedGeneration)
+            throw new Error('The local sign-in changed while this request was being verified. Try again.');
+        return { schema: 1, generation: randomUUID(), accountId, state: 'signed-in', tokens: session };
+    }));
 }
-export function clearSession() {
-    const path = filePath('session.json');
-    if (!existsSync(path))
-        return false;
-    rmSync(path);
-    return true;
+export async function rotateSession(generation, session, accountId) {
+    let changed = false;
+    await changeSession(prior => {
+        if (prior?.state !== 'signed-in' || prior.generation !== generation || (prior.accountId !== null && prior.accountId !== accountId))
+            return null;
+        changed = true;
+        return { ...prior, accountId, tokens: session };
+    });
+    return changed;
+}
+export async function rejectSession(generation) {
+    await changeSession(prior => prior?.state === 'signed-in' && prior.generation === generation
+        ? { schema: 1, generation: randomUUID(), accountId: prior.accountId, state: 'rejected' } : null);
+}
+export async function clearSession() {
+    let wasSignedIn = false;
+    await changeSession(prior => {
+        wasSignedIn = prior?.state === 'signed-in';
+        return { schema: 1, generation: randomUUID(), accountId: prior?.accountId ?? null, state: 'signed-out' };
+    });
+    return wasSignedIn;
 }
 /** This machine's project mappings, stored locally (not in the cloud) so
  *  absolute paths never leave the machine. Keyed by project id. */