@gajae-code/coding-agent 0.18.10 → 0.18.12

package/src/async/result-formatting.ts

@@ -0,0 +1,40 @@
+import { logger } from "@gajae-code/utils";
+import type { SessionManager } from "../session/session-manager";
+import { DEFAULT_ARTIFACT_MAX_BYTES, truncateHeadBytes } from "../session/streaming-output";
+
+const ASYNC_INLINE_RESULT_MAX_CHARS = 12_000;
+const ASYNC_PREVIEW_MAX_CHARS = 4_000;
+
+export async function formatAsyncResultForFollowUp(
+	sessionManager: SessionManager,
+	result: string,
+	allowArtifact = true,
+): Promise<string> {
+	if (result.length <= ASYNC_INLINE_RESULT_MAX_CHARS) return result;
+	const preview = `${result.slice(0, ASYNC_PREVIEW_MAX_CHARS)}\n\n[Output truncated. Showing first ${ASYNC_PREVIEW_MAX_CHARS.toLocaleString()} characters.]`;
+	// Denied owned deliveries must not leave unreferenced output artifacts.
+	if (!allowArtifact) return preview;
+	try {
+		const artifactId = await sessionManager.saveArtifact(result, "async");
+		if (artifactId) {
+			const bytes = Buffer.byteLength(result, "utf8");
+			const omittedBytes =
+				bytes > DEFAULT_ARTIFACT_MAX_BYTES
+					? bytes - truncateHeadBytes(result, DEFAULT_ARTIFACT_MAX_BYTES).bytes
+					: 0;
+			const notice = omittedBytes
+				? `Saved completion output is incomplete; omitted ${omittedBytes} UTF-8 bytes`
+				: "Saved completion output";
+			return `${preview}\n${notice}: artifact://${artifactId}`;
+		}
+	} catch (error) {
+		try {
+			logger.warn("Failed to persist async follow-up artifact", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+		} catch {
+			// Diagnostics must not discard a completed job's preview.
+		}
+	}
+	return `${preview}\n[Completion output storage unavailable; only the preview is available here.]`;
+}

package/src/autoresearch/git.ts

@@ -13,6 +13,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { isEnoent } from "@gajae-code/utils";
 import * as git from "../utils/git";
 import { HARNESS_FILENAME, normalizePathSpec } from "./harness";
 
@@ -49,10 +50,16 @@ export function getCurrentAutoresearchBranch(workDir: string): Promise<string |
  * Mission state under `.gjc/**` is intentionally NOT listed here: it is
  * runtime-owned and only the sanctioned `gjc autoresearch` CLI writes it.
  */
-export function isAutoresearchAuthorizedResearchPath(_cwd: string, rawPath: string): boolean {
+export function isAutoresearchAuthorizedResearchPath(cwd: string, rawPath: string): boolean {
 	const normalized = normalizePathSpec(rawPath);
 	if (normalized === ".") return false;
-	return normalized === HARNESS_FILENAME;
+	if (normalized !== HARNESS_FILENAME) return false;
+	try {
+		// Writes follow an existing harness symlink into its referent.
+		return !fs.lstatSync(path.join(cwd, HARNESS_FILENAME)).isSymbolicLink();
+	} catch (error) {
+		return isEnoent(error);
+	}
 }
 
 /**

package/src/autoresearch/prompts/prompt-setup.md

@@ -32,7 +32,7 @@ Do not edit product source, manifests, or dependencies. The harness must use exi
 ### Steps
 
 1. Inspect the target. Read source, identify what to measure, decide on the workload.
-2. Write `autoresearch.sh` only when it is an explicitly approved research artifact; otherwise use an existing benchmark command.
+2. Write or edit `autoresearch.sh` with a direct file tool only when it is an explicitly approved research artifact; do not use Bash, Python, or eval to change the harness. Otherwise use an existing benchmark command.
 3. Validate it: invoke `bash autoresearch.sh` through the regular `bash` tool. Confirm it exits 0 and emits at least one `METRIC` line. Iterate on the harness until it does.
 4. Start the mission with `gjc autoresearch` (cold intake: goal, constraints, deliverables, and an explicit mode) or `gjc autoresearch --spec <spec>` (handoff intake). Record the primary metric name and its direction (lower/higher is better) with the mission. The harness baseline is snapshotted at mission start and Phase 2 (the iteration loop) begins.
 

package/src/capability/fs.ts

@@ -9,8 +9,8 @@ const dirCache = new Map<string, fs.Dirent[]>();
 export type ReadScope = "project" | "user" | "native";
 
 export interface FileIdentity {
-	readonly dev: number;
-	readonly ino: number;
+	readonly dev: bigint;
+	readonly ino: bigint;
 }
 
 export interface ReadFileOptions {
@@ -45,7 +45,7 @@ function isWithinOrEqual(root: string, candidate: string): boolean {
 async function isHomeIdentityStable(options?: ReadFileOptions): Promise<boolean> {
 	if (!options?.isolatedHome || !options.home || !options.homeIdentity) return true;
 	try {
-		const current = await fs.promises.stat(options.home);
+		const current = await fs.promises.stat(options.home, { bigint: true });
 		return current.dev === options.homeIdentity.dev && current.ino === options.homeIdentity.ino;
 	} catch {
 		return false;
@@ -69,7 +69,7 @@ async function isUserAgentIdentityStable(options?: ReadFileOptions): Promise<boo
 		}
 	}
 	try {
-		const current = await fs.promises.stat(options.userAgentDir);
+		const current = await fs.promises.stat(options.userAgentDir, { bigint: true });
 		return current.dev === options.userAgentIdentity.dev && current.ino === options.userAgentIdentity.ino;
 	} catch {
 		return false;
@@ -79,7 +79,7 @@ async function isUserAgentIdentityStable(options?: ReadFileOptions): Promise<boo
 async function isContainmentRootIdentityStable(options?: ReadFileOptions): Promise<boolean> {
 	if (!options?.isolatedHome || !options.containmentRoot || !options.containmentRootIdentity) return true;
 	try {
-		const current = await fs.promises.stat(options.containmentRoot);
+		const current = await fs.promises.stat(options.containmentRoot, { bigint: true });
 		return sameFileIdentity(current, options.containmentRootIdentity);
 	} catch {
 		return false;
@@ -152,8 +152,8 @@ async function isCurrentIsolatedPath(abs: string, options?: ReadFileOptions): Pr
 	}
 }
 
-function isSingleLinkRegularFile(stat: fs.Stats): boolean {
-	return stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1;
+function isSingleLinkRegularFile(stat: fs.Stats | fs.BigIntStats): boolean {
+	return stat.isFile() && !stat.isSymbolicLink() && (stat.nlink === 1n || stat.nlink === 1);
 }
 
 /** Reject hard-linked executable or configuration files in isolated discovery. */
@@ -165,8 +165,16 @@ export async function isSingleLinkRegularFileAt(filePath: string): Promise<boole
 	}
 }
 
-function sameFileIdentity(left: Pick<fs.Stats, "dev" | "ino">, right: Pick<fs.Stats, "dev" | "ino">): boolean {
-	return left.dev === right.dev && left.ino === right.ino;
+function sameFileIdentity(
+	left: Pick<fs.Stats, "dev" | "ino"> | Pick<fs.BigIntStats, "dev" | "ino">,
+	right: Pick<fs.Stats, "dev" | "ino"> | Pick<fs.BigIntStats, "dev" | "ino"> | FileIdentity,
+): boolean {
+	// Convert to bigint if needed for comparison
+	const leftDev = typeof left.dev === "bigint" ? left.dev : BigInt(left.dev);
+	const leftIno = typeof left.ino === "bigint" ? left.ino : BigInt(left.ino);
+	const rightDev = typeof right.dev === "bigint" ? right.dev : BigInt(right.dev);
+	const rightIno = typeof right.ino === "bigint" ? right.ino : BigInt(right.ino);
+	return leftDev === rightDev && leftIno === rightIno;
 }
 
 /**
@@ -174,13 +182,13 @@ function sameFileIdentity(left: Pick<fs.Stats, "dev" | "ino">, right: Pick<fs.St
  * Stat first and canonicalize second so a parent replacement in either seam
  * is detected by the descriptor identity check below.
  */
-async function statAuthorizedPath(abs: string, options?: ReadFileOptions): Promise<fs.Stats | null> {
+async function statAuthorizedPath(abs: string, options?: ReadFileOptions): Promise<fs.Stats | fs.BigIntStats | null> {
 	if (!options?.isolatedHome) return null;
 	if (!(await isHomeIdentityStable(options))) return null;
 	if (!(await isUserAgentIdentityStable(options))) return null;
-	let authorized: fs.Stats;
+	let authorized: fs.Stats | fs.BigIntStats;
 	try {
-		authorized = await fs.promises.stat(abs);
+		authorized = await fs.promises.stat(abs, { bigint: true });
 	} catch {
 		return null;
 	}
@@ -191,18 +199,18 @@ async function validateOpenedPath(
 	handle: fsPromises.FileHandle,
 	abs: string,
 	options: ReadFileOptions | undefined,
-	authorized: fs.Stats | null,
+	authorized: fs.Stats | fs.BigIntStats | null,
 	kind: "file" | "directory",
 ): Promise<boolean> {
 	if (!options?.isolatedHome) return true;
 	if (!(await isHomeIdentityStable(options))) return false;
 	if (!(await isUserAgentIdentityStable(options))) return false;
 	try {
-		const opened = await handle.stat();
+		const opened = await handle.stat({ bigint: true });
 		const validKind =
 			kind === "file" ? isSingleLinkRegularFile(opened) : opened.isDirectory() && !opened.isSymbolicLink();
 		if (!validKind || authorized === null || !sameFileIdentity(opened, authorized)) return false;
-		const current = await fs.promises.stat(abs);
+		const current = await fs.promises.stat(abs, { bigint: true });
 		if (!sameFileIdentity(opened, current)) return false;
 		return await isCurrentIsolatedPath(abs, options);
 	} catch {
@@ -212,7 +220,7 @@ async function validateOpenedPath(
 
 interface OpenedPath {
 	handle: fsPromises.FileHandle;
-	authorized: fs.Stats | null;
+	authorized: fs.Stats | fs.BigIntStats | null;
 }
 
 async function openIsolatedFile(abs: string, options?: ReadFileOptions): Promise<OpenedPath | null> {
@@ -279,7 +287,7 @@ export async function readFile(filePath: string, options?: ReadFileOptions): Pro
 /** Capture a stable physical identity for an authorized containment root. */
 export async function capturePathIdentity(filePath: string): Promise<FileIdentity | null> {
 	try {
-		const stat = await fs.promises.stat(path.resolve(filePath));
+		const stat = await fs.promises.stat(path.resolve(filePath), { bigint: true });
 		return { dev: stat.dev, ino: stat.ino };
 	} catch {
 		return null;
@@ -342,14 +350,14 @@ export async function readFileSize(filePath: string, options?: ReadFileOptions):
 async function validateDirectoryPath(
 	abs: string,
 	options: ReadFileOptions | undefined,
-	authorized: fs.Stats | null,
+	authorized: fs.Stats | fs.BigIntStats | null,
 ): Promise<boolean> {
 	if (!options?.isolatedHome) return true;
 	if (authorized === null) return false;
 	if (!(await isHomeIdentityStable(options))) return false;
 	if (!(await isUserAgentIdentityStable(options))) return false;
 	try {
-		const current = await fs.promises.stat(abs);
+		const current = await fs.promises.stat(abs, { bigint: true });
 		return (
 			current.isDirectory() && sameFileIdentity(current, authorized) && (await isCurrentIsolatedPath(abs, options))
 		);

package/src/capability/index.ts

@@ -482,7 +482,7 @@ export async function loadCapabilityForHome<T>(
 	// read another profile's SYSTEM/RULES/AGENTS, skills, commands, hooks,
 	// settings, or executable descriptors.
 	const canonicalHome = await canonicalizeThroughExistingAncestor(resolvedHome);
-	const homeStats = await fs.stat(canonicalHome);
+	const homeStats = await fs.stat(canonicalHome, { bigint: true });
 	const homeIdentity = { dev: homeStats.dev, ino: homeStats.ino };
 	const trustedHome = await canonicalizeThroughExistingAncestor(getTrustedHomeDir());
 	const isolatedHome = canonicalHome !== trustedHome;
@@ -510,7 +510,7 @@ export async function loadCapabilityForHome<T>(
 					"user agent directory",
 				)
 			: path.join(canonicalHome, getConfigDirName(), "agent");
-	const userAgentStats = await fs.stat(userAgentDir).catch(() => null);
+	const userAgentStats = await fs.stat(userAgentDir, { bigint: true }).catch(() => null);
 	const userAgentIdentity = userAgentStats ? { dev: userAgentStats.dev, ino: userAgentStats.ino } : null;
 	await assertExplicitHomeRoots(canonicalHome, cwd, Boolean(options.agentDir), effectiveProviderIds, isolatedHome);
 	const repoRootCandidate = await findRepoRoot(cwd, canonicalHome, {

package/src/cli/accounts-cli.ts

@@ -14,6 +14,7 @@ import {
 	OAuthCredentialSelectorError,
 	type OAuthPinTarget,
 	resolveOAuthStorageProvider,
+	selectOrganizationMatches,
 } from "@gajae-code/ai/core";
 import { getAgentDir } from "@gajae-code/utils";
 import { ModelRegistry } from "../config/model-registry";
@@ -25,15 +26,21 @@ import {
 	clearPersistentPinForRemovedRows,
 } from "../session/account-inventory";
 import { CREDENTIAL_STORE_UNREADABLE_MESSAGE } from "../session/credential-store-errors";
-import { resolveStartupAuthConfig, type StartupAuthConfigSnapshot } from "../session/startup-auth-config";
+import {
+	type CredentialPreferenceEntryValue,
+	isValidCredentialPreferenceCap,
+	parsePreferenceAccount,
+	resolveStartupAuthConfig,
+	type StartupAuthConfigSnapshot,
+} from "../session/startup-auth-config";
 
-export const ACCOUNTS_ACTIONS = ["list", "check", "pin", "logout"] as const;
+export const ACCOUNTS_ACTIONS = ["list", "check", "pin", "prefer", "logout"] as const;
 export type AccountsAction = (typeof ACCOUNTS_ACTIONS)[number];
 
 export interface AccountsCommandArgs {
 	action: AccountsAction;
 	provider?: string;
-	selector?: string;
+	selectors?: readonly string[];
 	flags: {
 		json?: boolean;
 		persistent?: boolean;
@@ -92,9 +99,10 @@ function selectorFromInput(raw: string | undefined): AuthCredentialSelector {
 	if (/^id:[1-9]\d*$/.test(value)) return { kind: "id", value: value.slice(3) };
 	if (/^email:[^@\s]+@[^@\s]+$/.test(value)) return { kind: "email", value: value.slice(6) };
 	if (/^account:\S+$/.test(value)) return { kind: "account", value: value.slice(8) };
+	if (/^org:\S/.test(value)) return { kind: "org", value: value.slice(4).trim() };
 	if (/^[^@\s]+@[^@\s]+$/.test(value)) return { kind: "email", value };
 	throw new AccountsCommandError(
-		"Pin target must be a bare email or an id:<row-id>, email:<email>, or account:<account-id> selector.",
+		"Pin target must be a bare email or an id:<row-id>, email:<email>, account:<account-id>, or org:<organization id or name> selector.",
 	);
 }
 
@@ -286,15 +294,171 @@ async function runPin(
 	});
 }
 
+/**
+ * Split `<account>=<percent>` into the account and its usage cap. The cap follows the whole account, so an `=` before
+ * the last `@` belongs to an email local part (`user=2@example.com`), and a suffix that does not start with a digit is
+ * part of the account (account ids may end in `=`); a digit-led suffix must be a valid cap.
+ */
+function parsePreferArgument(raw: string): { account: string; cap: number | undefined } {
+	const separator = raw.lastIndexOf("=");
+	const rawCap = separator < 0 || separator < raw.lastIndexOf("@") ? "" : raw.slice(separator + 1).trim();
+	if (!/^\d/.test(rawCap)) return { account: raw.trim(), cap: undefined };
+	const cap = /^\d+(\.\d+)?$/.test(rawCap) ? Number(rawCap) : Number.NaN;
+	if (!isValidCredentialPreferenceCap(cap)) {
+		throw new AccountsCommandError(
+			`Usage cap in ${JSON.stringify(raw)} must be a percent above 0 and at most 100, e.g. me@example.com=75; no preference was written.`,
+		);
+	}
+	return { account: raw.slice(0, separator).trim(), cap };
+}
+
+/**
+ * Portable config text for a resolved OAuth row: its email, else its account id, whichever no other OAuth row of the
+ * provider shares. Numeric row ids are never persisted as preferences; a row with neither unique value is refused.
+ * Each candidate text is written only when {@link parsePreferenceAccount} reads it back as the same selector, so a
+ * successful write neither fails the next startup nor retargets the row: the email is written bare when that
+ * round-trips, else as `email:<address>` (an address such as `account:team@example.com` would otherwise parse as an
+ * account id, and `email:team@example.com` would lose its prefix).
+ */
+function portablePreferenceAccount(
+	row: CredentialInventoryRecord,
+	providerRows: readonly CredentialInventoryRecord[],
+): string | undefined {
+	const oauthRows = providerRows.filter(other => other.credentialKind === "oauth");
+	const email = row.email?.trim().toLowerCase();
+	if (email && oauthRows.filter(other => other.email?.trim().toLowerCase() === email).length === 1) {
+		const selector: AuthCredentialSelector = { kind: "email", value: row.email!.trim() };
+		const written = [selector.value, `email:${selector.value}`].find(text => readsBackAs(text, selector));
+		if (written) return written;
+	}
+	const accountId = row.accountId?.trim();
+	if (accountId && oauthRows.filter(other => other.accountId?.trim() === accountId).length === 1) {
+		const written = `account:${accountId}`;
+		if (readsBackAs(written, { kind: "account", value: accountId })) return written;
+	}
+	return undefined;
+}
+
+/** Whether startup parses `text` as exactly `selector`, kind and value. */
+function readsBackAs(text: string, selector: AuthCredentialSelector): boolean {
+	const parsed = parsePreferenceAccount(text);
+	return parsed?.kind === selector.kind && parsed.value === selector.value;
+}
+
+async function writePersistentPreferences(
+	provider: string,
+	entries: readonly CredentialPreferenceEntryValue[] | undefined,
+): Promise<void> {
+	const settings = await Settings.init();
+	await settings.commitAtomicBatchWithCurrent(current => {
+		const currentAuth = current.auth === undefined ? {} : asRecord(current.auth);
+		const rawPreferences = currentAuth?.credentialPreferences;
+		const preferences = rawPreferences === undefined ? {} : asRecord(rawPreferences);
+		if (!currentAuth || !preferences) {
+			throw new AccountsCommandError("Global auth.credentialPreferences is malformed; no preference was written.");
+		}
+		const next: Record<string, unknown> = { ...preferences };
+		if (entries) next[provider] = entries;
+		else delete next[provider];
+		return [{ path: "auth.credentialPreferences", op: "set", value: next }];
+	});
+}
+
+async function runPrefer(
+	providerArg: string | undefined,
+	accountArgs: readonly string[] | undefined,
+	flags: AccountsCommandArgs["flags"],
+): Promise<void> {
+	const provider = canonicalProvider(providerArg);
+	const accounts = accountArgs ?? [];
+	if (flags.clear && accounts.length > 0) {
+		throw new AccountsCommandError("Use either preferred accounts or --clear, not both.");
+	}
+	if (!flags.clear && accounts.length === 0) {
+		throw new AccountsCommandError(
+			"Prefer requires one or more accounts in order (e.g. me@example.com shared@example.com=75), or --clear.",
+		);
+	}
+	if (flags.clear) {
+		await writePersistentPreferences(provider, undefined);
+		if (flags.json) writeJson({ ok: true, provider, cleared: true });
+		else writeText([`Cleared preferred accounts for ${provider}; selection uses normal ranking.`]);
+		return;
+	}
+
+	const requested = accounts.map(parsePreferArgument);
+	await withAuthStorageAndModels(async (storage, modelRegistry, startupAuth) => {
+		if (
+			!modelRegistry.getConfiguredProviderIds().includes(provider) &&
+			modelRegistry.getAll().every(model => model.provider !== provider)
+		) {
+			throw new AccountsCommandError(`Provider ${provider} is not configured; no preference was written.`);
+		}
+		const providerRows = storage.listCredentialInventory(provider);
+		const seenIds = new Set<number>();
+		const resolved = requested.map(({ account, cap }) => {
+			let target: OAuthPinTarget;
+			try {
+				target = storage.resolveOAuthPinTarget(provider, selectorFromInput(account));
+			} catch (error) {
+				throw toAccountsCommandError(error) ?? error;
+			}
+			if (seenIds.has(target.credentialId)) {
+				throw new AccountsCommandError(`${account} is listed more than once; no preference was written.`);
+			}
+			seenIds.add(target.credentialId);
+			const row = providerRows.find(candidate => candidate.id === target.credentialId);
+			const portable = row ? portablePreferenceAccount(row, providerRows) : undefined;
+			if (!portable) {
+				throw new AccountsCommandError(
+					`${account} has no unique email or account id to store as a preference; no preference was written.`,
+				);
+			}
+			return { account: portable, cap: cap === 100 ? undefined : cap };
+		});
+		const entries: CredentialPreferenceEntryValue[] = resolved.map(({ account, cap }) =>
+			cap === undefined ? account : { [account]: cap },
+		);
+		await writePersistentPreferences(provider, entries);
+		if (flags.json) {
+			writeJson({ ok: true, provider, preferences: entries });
+			return;
+		}
+		writeText([
+			`Preferred accounts for ${provider}, tried in order:`,
+			...resolved.map(
+				({ account, cap }, index) =>
+					`  ${index + 1}. ${account}${cap === undefined ? " (until rate-limited)" : ` (until ${cap}% used)`}`,
+			),
+			`Then: remaining accounts by ${startupAuth.credentialRankingMode} ranking. Takes effect for new sessions.`,
+		]);
+	});
+}
+
 function accountMatches(row: CredentialInventoryRecord, rawAccount: string): boolean {
 	const value = rawAccount.trim();
 	if (value.length === 0) return false;
 	if (/^[1-9]\d*$/.test(value) && row.id === Number(value)) return true;
 	if (/^id:[1-9]\d*$/i.test(value) && row.id === Number(value.slice(3))) return true;
+	// Labels carry the organization name, so a bare email matches every organization of that account.
+	if (row.email?.toLowerCase() === value.toLowerCase()) return true;
 	const identity = inventoryIdentity(row);
 	return identity?.toLowerCase() === value.toLowerCase();
 }
 
+/**
+ * Rows a `--account` value designates. `org:` prefers an exact organization-id match over display-name
+ * matches; more than one result is reported as ambiguous by the caller, never resolved by guessing.
+ */
+function selectLogoutTargets<T extends { row: CredentialInventoryRecord }>(
+	targets: readonly T[],
+	rawAccount: string,
+): T[] {
+	const value = rawAccount.trim();
+	if (/^org:/i.test(value)) return selectOrganizationMatches(targets, value.slice(4), target => target.row);
+	return targets.filter(target => accountMatches(target.row, value));
+}
+
 function removalCandidates(
 	inventory: readonly CredentialInventoryRecord[],
 	targets: readonly CredentialRemovalTarget[],
@@ -335,9 +499,7 @@ async function runLogout(providerArg: string | undefined, flags: AccountsCommand
 	try {
 		const inventory = storage.listCredentialInventory(provider);
 		const targets = removalCandidates(inventory, storage.listCredentialRemovalTargets(provider));
-		const selected = flags.all
-			? targets
-			: targets.filter(candidate => accountMatches(candidate.row, flags.account ?? ""));
+		const selected = flags.all ? targets : selectLogoutTargets(targets, flags.account ?? "");
 		if (selected.length !== 1 && !flags.all) throwLogoutResolutionError(provider, flags.account, targets);
 		if (selected.length === 0) throwLogoutResolutionError(provider, flags.account, targets);
 		const result = storage.removeAuthCredentialsHard(
@@ -383,7 +545,13 @@ export async function runAccountsCommand(cmd: AccountsCommandArgs): Promise<void
 				await runCheck(cmd.provider, cmd.flags);
 				return;
 			case "pin":
-				await runPin(cmd.provider, cmd.selector, cmd.flags);
+				if ((cmd.selectors?.length ?? 0) > 1) {
+					throw new AccountsCommandError("Pin takes one selector; use `gjc accounts prefer` for an ordered list.");
+				}
+				await runPin(cmd.provider, cmd.selectors?.[0], cmd.flags);
+				return;
+			case "prefer":
+				await runPrefer(cmd.provider, cmd.selectors, cmd.flags);
 				return;
 			case "logout":
 				await runLogout(cmd.provider, cmd.flags);

package/src/cli/auth-broker-cli.ts

@@ -25,6 +25,7 @@ import {
 	AuthStorage,
 	type CredentialDisabledEvent,
 	DEFAULT_AUTH_BROKER_BIND,
+	formatOAuthIdentityLabel,
 	getEnvApiKey,
 	getOAuthProviders,
 	listProvidersWithEnvKey,
@@ -568,19 +569,21 @@ interface MigrateSkip {
 
 function credentialIdentity(provider: string, credential: AuthCredential): string {
 	if (credential.type === "api_key") return "(api key)";
-	return credential.email ?? credential.accountId ?? credential.projectId ?? `<${provider} oauth>`;
+	return formatOAuthIdentityLabel(credential) ?? `<${provider} oauth>`;
 }
 
 /**
  * Build the set of "identities already on the broker" so re-runs are idempotent.
- * For OAuth, identity = email|accountId|projectId. For api_key, we collapse
- * to a single marker per provider (broker has no concept of "multiple api keys
- * per provider with different identities"; upsert would coalesce them).
+ * For OAuth, identity = email|accountId|projectId, scoped to the organization
+ * when the credential carries one (one account can sign in to several
+ * organizations). For api_key, we collapse to a single marker per provider
+ * (broker has no concept of "multiple api keys per provider with different
+ * identities"; upsert would coalesce them).
  */
 function indexBrokerSnapshot(snapshot: {
 	credentials: Array<{
 		provider: string;
-		credential: { type: string; email?: string; accountId?: string; projectId?: string };
+		credential: { type: string; email?: string; accountId?: string; projectId?: string; organizationId?: string };
 	}>;
 }): Map<string, Set<string>> {
 	const out = new Map<string, Set<string>>();
@@ -589,22 +592,29 @@ function indexBrokerSnapshot(snapshot: {
 		if (entry.credential.type === "api_key") {
 			ids.add("@api_key");
 		} else {
-			if (entry.credential.email) ids.add(`email:${entry.credential.email}`);
-			if (entry.credential.accountId) ids.add(`accountId:${entry.credential.accountId}`);
-			if (entry.credential.projectId) ids.add(`projectId:${entry.credential.projectId}`);
+			const org = organizationSuffix(entry.credential.organizationId);
+			if (entry.credential.email) ids.add(`email:${entry.credential.email}${org}`);
+			if (entry.credential.accountId) ids.add(`accountId:${entry.credential.accountId}${org}`);
+			if (entry.credential.projectId) ids.add(`projectId:${entry.credential.projectId}${org}`);
 		}
 		out.set(entry.provider, ids);
 	}
 	return out;
 }
 
+function organizationSuffix(organizationId: string | undefined): string {
+	const trimmed = organizationId?.trim();
+	return trimmed ? `|org:${trimmed}` : "";
+}
+
 function brokerAlreadyHas(existing: Map<string, Set<string>>, provider: string, credential: AuthCredential): boolean {
 	const ids = existing.get(provider);
 	if (!ids) return false;
 	if (credential.type === "api_key") return ids.has("@api_key");
-	if (credential.email && ids.has(`email:${credential.email}`)) return true;
-	if (credential.accountId && ids.has(`accountId:${credential.accountId}`)) return true;
-	if (credential.projectId && ids.has(`projectId:${credential.projectId}`)) return true;
+	const org = organizationSuffix(credential.organizationId);
+	if (credential.email && ids.has(`email:${credential.email}${org}`)) return true;
+	if (credential.accountId && ids.has(`accountId:${credential.accountId}${org}`)) return true;
+	if (credential.projectId && ids.has(`projectId:${credential.projectId}${org}`)) return true;
 	return false;
 }
 

package/src/cli/doctor/install-repairs.ts

@@ -14,7 +14,7 @@ import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { isCompiledBinary, VERSION } from "@gajae-code/utils";
+import { isCompiledBinary, logger, VERSION } from "@gajae-code/utils";
 import { isUpdateChannel } from "../../config/update-channel";
 import {
 	activationRecordPath,
@@ -27,8 +27,10 @@ import {
 	snapshotRegularFile,
 } from "../install-activation";
 import {
+	ActivationRetryCandidateRepointError,
 	acquireBinaryUpdateLock,
 	fetchAndVerifyOfficialPinnedCandidate,
+	InstallationAccessDeniedError,
 	isProtectedSourcePathForInstall,
 	replaceBinaryForUpdate,
 	smokeTestPinnedCandidate,
@@ -111,8 +113,10 @@ export interface InstallRepairResult {
 	readonly reason?: string;
 	readonly recordPath?: string;
 	readonly sideEffectStarted: boolean;
-	/** Present only for a pre-mutation Windows sharing violation (nothing was renamed). */
+	/** Native Windows status returned by exact replacement. */
 	readonly windowsErrorCode?: string;
+	readonly stagingCleanupWarning?: string;
+	readonly retainedPaths?: InstallationAccessDeniedError["retainedPaths"];
 	readonly before?: { readonly identity?: FileIdentity; readonly digest?: string };
 	readonly after?: { readonly identity?: FileIdentity; readonly digest?: string; readonly version?: string };
 }
@@ -317,17 +321,43 @@ export async function repairStandaloneBinary(
 		};
 	} catch (error) {
 		const pendingActivation = error instanceof Error && error.message === "installation_pending_activation";
+		const accessDeniedError = error instanceof InstallationAccessDeniedError ? error : undefined;
+		const repointError = error instanceof ActivationRetryCandidateRepointError ? error : undefined;
 		const reason = pendingActivation
 			? "sharing_violation"
-			: error instanceof Error && /^[a-z][a-z0-9_]{0,63}$/.test(error.message)
-				? error.message
-				: "installation_execution_unverified";
+			: accessDeniedError
+				? accessDeniedError.code
+				: repointError
+					? repointError.reasonCode
+					: error instanceof Error && /^[a-z][a-z0-9_]{0,63}$/.test(error.message)
+						? error.message
+						: "installation_execution_unverified";
+		if (accessDeniedError)
+			logger.warn("Doctor standalone binary restore failed with access denied", {
+				targetPath,
+				code: accessDeniedError.code,
+				...(accessDeniedError.windowsErrorCode ? { windowsErrorCode: accessDeniedError.windowsErrorCode } : {}),
+				...(accessDeniedError.stagingCleanupWarning
+					? { stagingCleanupWarning: accessDeniedError.stagingCleanupWarning }
+					: {}),
+				...(accessDeniedError.retainedPaths ? { retainedPaths: accessDeniedError.retainedPaths } : {}),
+			});
+		if (repointError)
+			logger.warn("Doctor standalone binary restore retained a retry candidate after record repoint failed", {
+				path: repointError.candidatePath,
+				reason: repointError.reasonCode,
+			});
 		return {
 			state: pendingActivation ? "pending_activation" : started ? "failed" : "blocked",
 			reason,
 			sideEffectStarted: started,
 			before,
 			recordPath,
+			...(accessDeniedError?.windowsErrorCode ? { windowsErrorCode: accessDeniedError.windowsErrorCode } : {}),
+			...(accessDeniedError?.stagingCleanupWarning
+				? { stagingCleanupWarning: accessDeniedError.stagingCleanupWarning }
+				: {}),
+			...(accessDeniedError?.retainedPaths ? { retainedPaths: accessDeniedError.retainedPaths } : {}),
 		};
 	} finally {
 		await release();

package/src/cli/fast-help.ts

@@ -8,7 +8,7 @@ export function getExtraHelpText(): string {
   ${APP_NAME} session              - List, inspect, create, remove, or attach sessions
   ${APP_NAME} state                - Inspect or manage persisted GJC state
   ${APP_NAME} auth-broker         - Manage the auth-broker (credential vault)
-  ${APP_NAME} accounts             - List, check, pin, and remove stored OAuth accounts
+  ${APP_NAME} accounts             - List, check, pin, prefer, and remove stored OAuth accounts
   ${APP_NAME} models presets       - Inspect, refresh, pin, rollback, or disable the signed model preset registry
   ${APP_NAME} auth-gateway        - Run an auth-gateway forward proxy
   ${APP_NAME} harness              - Run harness control-plane commands