@hearsay-tools/squawk 0.0.0-stage → 0.17.0-pr3058.5683

package/dist/core/provider-auth.js

@@ -0,0 +1,661 @@
+import { RUNNER_IDS } from './agent-runner.js';
+import { productEnv } from './product-env.js';
+import { execFile } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { profileEnv } from './agent-profiles.js';
+import { withEnvPrefix } from './shell-env.js';
+export const PROVIDER_IDS = RUNNER_IDS;
+/**
+ * The explicit environment lock delegates model and credential configuration
+ * to each native coding agent. In that mode Cezar must not second-guess the
+ * agent's own credentials through the provider checks introduced by #652.
+ *
+ * Config-file model locks intentionally do not disable the checks: this bypass
+ * is an operator-level process policy and only the exact documented `1` opts in.
+ */
+export function providerAuthChecksDisabled(env = process.env) {
+    return productEnv('AGENT_MODELS_LOCKED', env) === '1';
+}
+const DEFAULT_MAX_BUFFER = 256 * 1024;
+const COMMAND_TIMEOUT_MS = 10_000;
+/**
+ * Asymmetric display cache lifetimes: keep connected answers longer; recheck negatives sooner.
+ * Actions verify before refusing. Runtime incidents override ordinary cached status.
+ */
+const CONNECTED_TTL_MS = 10 * 60_000;
+const UNSETTLED_TTL_MS = 60_000;
+/**
+ * How long before the same provider may be self-checked again after a runtime rejection
+ * (`verifyRuntimeAuthFailure`).
+ *
+ * A latch is raised from a PATTERN MATCH on a runner's error text, and a single failing run can emit
+ * several auth-shaped lines in a row. Without a floor, each line that re-latches after a successful
+ * self-check would buy its own CLI spawn. One self-check a minute is plenty for the case this exists
+ * for — a rejection that was transient against credentials that are still valid — and it bounds the
+ * pathological case (a CLI that reports logged in while the vendor keeps rejecting the token) to one
+ * probe per minute instead of one per error line.
+ */
+const RUNTIME_AUTH_VERIFY_COOLDOWN_MS = 60_000;
+/** The lifetime for a set of rows: minutes only when EVERY row is connected. A mixed answer takes
+ *  the short window, because the not-connected row in it is the one that might self-heal.
+ *
+ *  KNOWN COARSENESS: the window applies to the whole three-provider response, so one logged-out
+ *  provider drags the two connected ones into re-probing with it. That is wasted work rather than a
+ *  wrong answer, and it is now paid in the background; fixing it properly means per-provider
+ *  timestamps and merging partial probe results. */
+function cacheTtlFor(rows) {
+    return rows.every((row) => row.status === 'connected') ? CONNECTED_TTL_MS : UNSETTLED_TTL_MS;
+}
+const UNKNOWN_HINT = 'Authentication could not be verified. Try again.';
+const TIMEOUT_HINT = 'Authentication check timed out. Try again.';
+const RUNTIME_AUTH_HINT = 'Authentication was rejected during a run. Reconnect, then try again.';
+const ANSI_SEQUENCE = /\u001B\[[0-?]*[ -/]*[@-~]/g;
+const RUNTIME_AUTH_FAILURE_PATTERNS = [
+    /\b(?:failed to authenticate|authentication failed|unauthenticated|unauthorized)\b/i,
+    /\bproviderautherror\b/i,
+    /\b(?:oauth|access|refresh)?\s*token\b.{0,80}\b(?:revoked|expired|invalid)\b/i,
+    /\b(?:revoked|expired|invalid)\b.{0,80}\b(?:oauth|access|refresh)?\s*token\b/i,
+    /\b(?:oauth|token|credential|unauthorized|unauthenticated)\b.{0,80}\b401\b/i,
+    /\b401\b.{0,80}\b(?:oauth|token|credential|unauthorized|unauthenticated)\b/i,
+];
+const RUNTIME_API_KEY_FAILURE_PATTERNS = [
+    // Vendor-shaped errors can carry a process prefix before the actual
+    // authentication error, so anchor on that explicit error label.
+    /\b(?:api|authentication|auth)\s*error\b\s*[:=-]\s*(?:(?:http\s+)?401\b[\s:=-]*)?(?:(?:revoked|expired|invalid)\s+(?:api[-\s]?key|x-api-key)|(?:api[-\s]?key|x-api-key)\s*(?:(?:is|was|has been)\s+|[:=-]\s*)?(?:revoked|expired|invalid))\b/i,
+    // Otherwise require the credential rejection to be the complete line,
+    // optionally introduced by a generic error label or 401 status. This keeps
+    // implementation notes such as "coverage for invalid API key handling"
+    // from looking like live authentication failures.
+    /(?:^|\r?\n)\s*(?:error\s*[:=-]\s*)?(?:(?:http\s+)?401\b[\s:=-]*)?(?:(?:revoked|expired|invalid)\s+(?:api[-\s]?key|x-api-key)|(?:api[-\s]?key|x-api-key)\s+(?:(?:is|was|has been)\s+)?(?:revoked|expired|invalid))\s*(?:[.!]|$)/im,
+];
+export function isRuntimeProviderAuthFailure(message) {
+    return [...RUNTIME_AUTH_FAILURE_PATTERNS, ...RUNTIME_API_KEY_FAILURE_PATTERNS]
+        .some((pattern) => pattern.test(message));
+}
+function normalizedOutput(stdout) {
+    return stdout.replace(ANSI_SEQUENCE, '').trim().toLowerCase();
+}
+function normalizedLines(...outputs) {
+    return outputs.flatMap((output) => normalizedOutput(output).split(/\r?\n/))
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+function parseClaudeStatus(result) {
+    try {
+        const value = JSON.parse(result.stdout);
+        if (value.loggedIn === true && result.exitCode === 0)
+            return 'connected';
+        if (value.loggedIn === false && result.exitCode === 1)
+            return 'disconnected';
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function parseCodexStatus(result) {
+    const answers = normalizedLines(result.stdout, result.stderr)
+        .map((line) => {
+        if (line === 'logged in using chatgpt'
+            || line === 'logged in using an api key'
+            || line === 'logged in using agent identity'
+            || line === 'logged in using access token'
+            || line === 'logged in using personal access token'
+            || line === 'logged in using amazon bedrock api key'
+            || /^logged in using an api key - (?:\*{3}|\S{8}\*{3}\S{5})$/.test(line)) {
+            return 'connected';
+        }
+        if (line === 'not logged in' || line === 'run codex login to authenticate') {
+            return 'disconnected';
+        }
+        return null;
+    })
+        .filter((answer) => answer !== null);
+    if (answers.length !== 1)
+        return null;
+    if (answers[0] === 'connected' && result.exitCode === 0)
+        return 'connected';
+    if (answers[0] === 'disconnected' && result.exitCode === 1)
+        return 'disconnected';
+    return null;
+}
+function parseOpenCodeStatus(result) {
+    if (result.exitCode !== 0)
+        return null;
+    const lines = normalizedLines(result.stdout);
+    const storedSummaries = lines
+        .map((line) => line.match(/^[^a-z0-9]*(\d+)\s+credentials?$/)?.[1])
+        .filter((count) => count !== undefined);
+    if (storedSummaries.length !== 1)
+        return null;
+    const storedCount = Number(storedSummaries[0]);
+    if (!Number.isSafeInteger(storedCount))
+        return null;
+    const environmentSummaries = lines
+        .map((line) => line.match(/^[^a-z0-9]*(\d+)\s+environment\s+variables?$/)?.[1])
+        .filter((count) => count !== undefined);
+    const hasEnvironmentBlock = lines.some((line) => /^[^a-z0-9]*environment$/.test(line));
+    if (environmentSummaries.length > 1)
+        return null;
+    if (hasEnvironmentBlock !== (environmentSummaries.length === 1))
+        return null;
+    const environmentCount = environmentSummaries.length === 1
+        ? Number(environmentSummaries[0])
+        : 0;
+    if (!Number.isSafeInteger(environmentCount))
+        return null;
+    return storedCount > 0 || environmentCount > 0 ? 'connected' : 'disconnected';
+}
+function parsePiStatus(result) {
+    if (result.exitCode !== 0)
+        return null;
+    const lines = normalizedLines(result.stdout);
+    if (lines.some((line) => /^provider\s+model\s+context\s+max-out\s+thinking\s+images$/.test(line))) {
+        return 'connected';
+    }
+    if (lines.some((line) => line.includes('no models available'))
+        && lines.some((line) => line.includes('/login'))) {
+        return 'disconnected';
+    }
+    return null;
+}
+/**
+ * OMP (Oh My Pi) v18.4.11: `omp models --json` exits 0 and prints `{"models":[...]}` — an object
+ * wrapping the array, not a bare array. With no credentials the array is empty; with any provider
+ * key (stored login or an environment variable) it lists that provider's models. Like OpenCode's
+ * environment count, a configured credential permits a run, so a non-empty list is `connected`;
+ * a vendor rejection is still latched at runtime. Recorded from the real OMP v18.4.11 binary on
+ * 2026-10-05 (`omp models --json`, no credentials, then with ANTHROPIC_API_KEY set); upstream is
+ * `can1357/oh-my-pi` (tag v18.4.11, main @ 7318a70cf4ed), `docs/cli-reference.md` (models command).
+ */
+function parseOmpStatus(result) {
+    if (result.exitCode !== 0)
+        return null;
+    try {
+        const value = JSON.parse(result.stdout);
+        if (!Array.isArray(value?.models))
+            return null;
+        return value.models.length > 0 ? 'connected' : 'disconnected';
+    }
+    catch {
+        return null;
+    }
+}
+// Verified against Cursor CLI 2026.09.15 status --format json implementation.
+function parseCursorStatus(result) {
+    try {
+        const value = JSON.parse(result.stdout);
+        // `agent status` checks stored login tokens only (CLI 2026.09.15), while sessions
+        // also accept environment credentials. Like OpenCode's environment count,
+        // configured credentials permit a run; a vendor rejection is latched at runtime.
+        if (result.exitCode === 0 && (process.env.CURSOR_API_KEY?.trim() || process.env.CURSOR_AUTH_TOKEN?.trim())) {
+            return 'connected';
+        }
+        if (value.isAuthenticated === true && result.exitCode === 0)
+            return 'connected';
+        if (value.isAuthenticated === false && result.exitCode === 0
+            && (value.status === 'unauthenticated' || value.status === 'partially-authenticated'))
+            return 'disconnected';
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+const DESCRIPTORS = [
+    {
+        id: 'claude',
+        executable: () => productEnv('CLAUDE_BIN') ?? 'claude',
+        statusArgs: ['auth', 'status', '--json'],
+        loginArgs: ['auth', 'login'],
+        installHint: 'Install Claude Code, then run `claude auth login`.',
+        parse: parseClaudeStatus,
+    },
+    {
+        id: 'codex',
+        executable: () => productEnv('CODEX_BIN') ?? 'codex',
+        statusArgs: ['login', 'status'],
+        loginArgs: ['login'],
+        installHint: 'Install the Codex CLI, then run `codex login`.',
+        parse: parseCodexStatus,
+    },
+    {
+        id: 'opencode',
+        executable: () => productEnv('OPENCODE_BIN') ?? 'opencode',
+        statusArgs: ['auth', 'list'],
+        loginArgs: ['auth', 'login'],
+        installHint: 'Install OpenCode, then run `opencode auth login`.',
+        parse: parseOpenCodeStatus,
+    },
+    {
+        id: 'pi',
+        executable: () => productEnv('PI_BIN') ?? 'pi',
+        statusArgs: ['--list-models'],
+        loginArgs: ['/login'],
+        installHint: 'Install pi, then run `pi /login`.',
+        parse: parsePiStatus,
+    },
+    {
+        id: 'cursor',
+        executable: () => productEnv('CURSOR_BIN') ?? 'agent',
+        statusArgs: ['status', '--format', 'json'],
+        loginArgs: ['login'],
+        installHint: 'Install Cursor CLI, then run `agent login`.',
+        parse: parseCursorStatus,
+    },
+    {
+        id: 'omp',
+        executable: () => productEnv('OMP_BIN') ?? 'omp',
+        statusArgs: ['models', '--json'],
+        loginArgs: ['login'],
+        installHint: 'Install OMP (curl -fsSL https://omp.sh/install | sh), then run `omp login`.',
+        parse: parseOmpStatus,
+        // `omp models --json` lists every model of every configured provider at ~350 bytes each:
+        // OpenRouter alone is 561 models (~200 KB) on v18.4.11, and four keys pass 256 KiB. An
+        // overflow answers `unknown`, which hides a logged-in OMP from every picker (Ruling 19).
+        maxBuffer: 4 * 1024 * 1024,
+    },
+];
+function defaultRunProviderCommand(executable, args, timeoutMs, env, options) {
+    return new Promise((resolve) => {
+        execFile(executable, args, {
+            timeout: timeoutMs,
+            windowsHide: true,
+            maxBuffer: options?.maxBuffer ?? DEFAULT_MAX_BUFFER,
+            // Inherit, then override: an auth probe is a short read-only CLI call, not a spawned
+            // agent, so it does not go through `buildChildEnv`'s allowlist — the CLI still needs the
+            // host's PATH and HOME to run at all. `env` is only ever a profile's config-dir variable.
+            ...(env && Object.keys(env).length > 0 ? { env: { ...process.env, ...env } } : {}),
+        }, (error, stdout, stderr) => {
+            const commandError = error;
+            const code = commandError?.code;
+            resolve({
+                stdout: String(stdout),
+                stderr: String(stderr),
+                exitCode: typeof code === 'number' ? code : error ? null : 0,
+                errorCode: typeof code === 'string' ? code : undefined,
+                timedOut: commandError?.code === 'ETIMEDOUT'
+                    || (commandError?.killed === true && commandError.signal === 'SIGTERM'),
+            });
+        });
+    });
+}
+function quoteExecutable(executable, platform) {
+    if (platform === 'win32') {
+        return `"${executable.replace(/[%&!"]/g, '^$&')}"`;
+    }
+    return `'${executable.replaceAll("'", "'\\''")}'`;
+}
+/** The per-account cache key. ONE definition: a probe that wrote under a different spelling than
+ *  a peek reads would silently make every peek a miss, and every page load pay for a CLI spawn. */
+function profileCacheKey(provider, profileId) {
+    return `${provider}\u0000${profileId}`;
+}
+function descriptorFor(provider) {
+    const descriptor = DESCRIPTORS.find(({ id }) => id === provider);
+    if (!descriptor)
+        throw new Error(`Unknown provider: ${provider}`);
+    return descriptor;
+}
+/** One deferred re-verification when the cooldown declines a check. Detached and unref'd by
+ *  default; tests capture the retry instead of waiting out the window. */
+function defaultScheduleRuntimeRetry(fn, delayMs) {
+    const timer = setTimeout(fn, delayMs);
+    timer.unref();
+    return () => clearTimeout(timer);
+}
+export class ProviderAuthService {
+    runCommand;
+    now;
+    platform;
+    createAuthFailureId;
+    scheduleRuntimeRetry;
+    runtimeFailures = new Map();
+    /** One self-check at a time per provider, and not more often than the cooldown. Both guard the
+     *  same thing — a CLI spawn per auth-shaped error line — from the two directions it can arrive
+     *  from: concurrently, and in quick succession. */
+    verifyingRuntimeFailures = new Set();
+    lastRuntimeVerification = new Map();
+    /** One pending cooldown-expiry re-check per provider, cancellable. See
+     *  {@link ProviderAuthService.scheduleRuntimeVerification}. */
+    deferredRuntimeVerifications = new Map();
+    nextRuntimeFailureGeneration = 0;
+    nextProbeGeneration = 0;
+    completed;
+    inFlight;
+    /** Per-account probe results, keyed by `profileCacheKey` (spec 2026-07-29-agent-profiles).
+     *  Separate from `completed` because a second Claude login is a different answer to the same
+     *  question, and sharing one slot would let whichever probe ran last speak for both. Each
+     *  entry carries the generation of the probe that wrote it, so an older probe landing after a
+     *  newer verification cannot overwrite the correction — the fence `completed` gets from
+     *  `startFreshProbe`/`rememberProbedRow`, on this cache's own key. */
+    completedProfiles = new Map();
+    inFlightProfiles = new Map();
+    constructor(options) {
+        this.runCommand = options?.runCommand ?? defaultRunProviderCommand;
+        this.now = options?.now ?? Date.now;
+        this.platform = options?.platform ?? process.platform;
+        this.createAuthFailureId = options?.createAuthFailureId ?? randomUUID;
+        this.scheduleRuntimeRetry = options?.scheduleRuntimeRetry ?? defaultScheduleRuntimeRetry;
+    }
+    /**
+     * Serve known status while refreshing expired entries in the background. A cold cache or
+     * refresh:true waits for a probe.
+     */
+    status(options) {
+        if (productEnv('DRY_RUN') === '1' || providerAuthChecksDisabled()) {
+            return Promise.resolve({
+                providers: PROVIDER_IDS.map((provider) => ({ provider, status: 'connected' })),
+            });
+        }
+        if (options?.refresh) {
+            // Joining a probe already running satisfies "true now" and preserves the in-flight identity
+            // contract (one shared promise for concurrent callers).
+            return this.inFlight ? this.inFlight.visible : this.startFreshProbe().visible;
+        }
+        if (this.completed) {
+            // Checked BEFORE `inFlight` on purpose: a reader arriving during a background revalidation
+            // must be served from cache, not attached to the probe it was meant to avoid.
+            if (this.now() - this.completed.timestamp >= cacheTtlFor(this.completed.response.providers)) {
+                if (!this.inFlight)
+                    void this.startFreshProbe().raw.catch(() => { });
+            }
+            return Promise.resolve(this.withRuntimeFailures(this.completed.response));
+        }
+        if (this.inFlight)
+            return this.inFlight.visible;
+        return this.startFreshProbe().visible;
+    }
+    reportRuntimeAuthFailure(provider) {
+        if (productEnv('DRY_RUN') === '1' || providerAuthChecksDisabled())
+            return null;
+        const current = this.runtimeFailures.get(provider);
+        const failure = {
+            generation: ++this.nextRuntimeFailureGeneration,
+            authFailureId: current?.authFailureId ?? this.createAuthFailureId(),
+        };
+        this.runtimeFailures.set(provider, failure);
+        return {
+            status: {
+                provider,
+                status: 'disconnected',
+                hint: RUNTIME_AUTH_HINT,
+                authFailureId: failure.authFailureId,
+            },
+            generation: failure.generation,
+            transitioned: current === undefined,
+        };
+    }
+    /** Clear only the incident the caller actually observed. A stale retry must
+     * never erase a rejection that arrived after the user began recovery. */
+    clearRuntimeAuthFailure(provider, authFailureId) {
+        const current = this.runtimeFailures.get(provider);
+        if (!current || current.authFailureId !== authFailureId)
+            return false;
+        this.runtimeFailures.delete(provider);
+        return true;
+    }
+    /**
+     * Verify the observed runtime incident with the failing account’s native CLI. Clear only a
+     * connected result for the same generation. Coalesce probes; a cooldown decline schedules one
+     * deferred check. Return recovered status or null.
+     */
+    async verifyRuntimeAuthFailure(provider, profile, observed) {
+        if (productEnv('DRY_RUN') === '1' || providerAuthChecksDisabled())
+            return null;
+        const failure = this.runtimeFailures.get(provider);
+        if (!failure)
+            return null;
+        const expectedGeneration = observed?.generation ?? failure.generation;
+        if (failure.generation !== expectedGeneration)
+            return null;
+        if (this.verifyingRuntimeFailures.has(provider))
+            return null;
+        const lastVerifiedAt = this.lastRuntimeVerification.get(provider);
+        if (lastVerifiedAt !== undefined && this.now() - lastVerifiedAt < RUNTIME_AUTH_VERIFY_COOLDOWN_MS) {
+            this.scheduleRuntimeVerification(provider, profile, RUNTIME_AUTH_VERIFY_COOLDOWN_MS - (this.now() - lastVerifiedAt), expectedGeneration);
+            return null;
+        }
+        this.verifyingRuntimeFailures.add(provider);
+        let probed;
+        try {
+            this.lastRuntimeVerification.set(provider, this.now());
+            probed = await this.probe(descriptorFor(provider), profile?.configDir);
+        }
+        finally {
+            this.verifyingRuntimeFailures.delete(provider);
+        }
+        if (probed.status !== 'connected')
+            return null;
+        // Fence the clear against the captured GENERATION, not just the id: while the latch stands a
+        // new failure report keeps the same `authFailureId`, so an id comparison alone would let this
+        // answer — gathered for the incident as it was — clear a newer failure reported mid-probe,
+        // one the latch-edge watcher will never re-check. Generations are unique per report.
+        const current = this.runtimeFailures.get(provider);
+        if (!current || current.generation !== expectedGeneration)
+            return null;
+        if (!this.clearRuntimeAuthFailure(provider, failure.authFailureId))
+            return null;
+        if (profile) {
+            // Per-account knowledge goes to the per-account cache. Folding it into the whole-response
+            // cache would let a named account's answer speak for the default row for the TTL that
+            // follows — the same sharing bug the `(provider, profileId)` key was introduced to prevent.
+            // The FRESH generation fences the write against an older per-account probe that is still in
+            // flight and lands afterwards.
+            const stamped = { ...probed, profileId: profile.id };
+            this.completedProfiles.set(profileCacheKey(provider, profile.id), {
+                status: stamped,
+                timestamp: this.now(),
+                generation: ++this.nextProbeGeneration,
+            });
+            return stamped;
+        }
+        this.rememberProbedRow(probed);
+        return probed;
+    }
+    /**
+     * Schedule one cooldown retry bound to its account aim and incident generation. Replace earlier
+     * retries; a cleared or changed incident makes the retry a no-op.
+     */
+    scheduleRuntimeVerification(provider, profile, delayMs, generation) {
+        this.deferredRuntimeVerifications.get(provider)?.();
+        const cancel = this.scheduleRuntimeRetry(() => {
+            this.deferredRuntimeVerifications.delete(provider);
+            void this.verifyRuntimeAuthFailure(provider, profile, { generation }).catch(() => { });
+        }, Math.max(delayMs, 0));
+        this.deferredRuntimeVerifications.set(provider, cancel);
+    }
+    /**
+     * Merge one probed row without extending the full-response TTL. Fence against newer probes; on a
+     * cold cache merge after the in-flight full probe.
+     */
+    rememberProbedRow(status) {
+        const generation = ++this.nextProbeGeneration;
+        if (this.completed) {
+            this.mergeProbedRow(status, generation);
+            return;
+        }
+        const inFlight = this.inFlight;
+        if (!inFlight)
+            return;
+        void inFlight.raw.catch(() => { }).then(() => {
+            // A newer full probe landing first (its generation outranks ours) makes this a no-op: its
+            // rows are the fresher answer and must not be patched by an older correction.
+            if (!this.completed || this.completed.generation >= generation)
+                return;
+            this.mergeProbedRow(status, generation);
+        });
+    }
+    mergeProbedRow(status, generation) {
+        if (!this.completed)
+            return;
+        this.completed = {
+            ...this.completed,
+            generation,
+            response: {
+                providers: this.completed.response.providers.map((row) => (row.provider === status.provider ? status : row)),
+            },
+        };
+    }
+    /**
+     * The command that logs `provider` in, as a copyable one-liner.
+     *
+     * `configDir` points the login at a specific agent account (spec 2026-07-29-agent-profiles) —
+     * without it, "Connect" on a second Claude account would sign the user into the FIRST one and
+     * report success. Returns `null` when the dir cannot be embedded safely on this platform, and
+     * the caller must then refuse rather than fall back to the bare command: a login aimed at the
+     * wrong account is the failure this whole path exists to prevent.
+     */
+    loginCommand(provider, configDir) {
+        const descriptor = descriptorFor(provider);
+        const command = [quoteExecutable(descriptor.executable(), this.platform), ...descriptor.loginArgs].join(' ');
+        const env = configDir ? profileEnv(provider, configDir) : {};
+        return withEnvPrefix(command, env, this.platform);
+    }
+    installHint(provider) {
+        return descriptorFor(provider).installHint;
+    }
+    withRuntimeFailures(response) {
+        if (this.runtimeFailures.size === 0)
+            return response;
+        return {
+            providers: response.providers.map((row) => {
+                const failure = this.runtimeFailures.get(row.provider);
+                return failure
+                    ? {
+                        provider: row.provider,
+                        status: 'disconnected',
+                        hint: RUNTIME_AUTH_HINT,
+                        authFailureId: failure.authFailureId,
+                    }
+                    : row;
+            }),
+        };
+    }
+    startFreshProbe() {
+        const generation = ++this.nextProbeGeneration;
+        const raw = Promise.all(DESCRIPTORS.map((descriptor) => this.probe(descriptor)))
+            .then((providers) => {
+            const response = { providers };
+            if (!this.completed || generation >= this.completed.generation) {
+                this.completed = { response, timestamp: this.now(), generation };
+            }
+            return response;
+        });
+        // One derived visible promise per raw probe preserves the historical
+        // in-flight identity contract while still consulting the current latch
+        // only after the async vendor commands resolve.
+        const probe = {
+            raw,
+            visible: raw.then((response) => this.withRuntimeFailures(response)),
+        };
+        this.inFlight = probe;
+        void raw.finally(() => {
+            if (this.inFlight === probe)
+                this.inFlight = undefined;
+        });
+        return probe;
+    }
+    /**
+     * Probe one named account, cached by provider and profile id. Keep default status unchanged. Do
+     * not apply the coarse provider runtime latch to every named account.
+     */
+    async profileStatus(provider, profile) {
+        if (productEnv('DRY_RUN') === '1') {
+            return { provider, status: 'connected', profileId: profile.id };
+        }
+        const key = profileCacheKey(provider, profile.id);
+        const cached = this.completedProfiles.get(key);
+        if (cached && this.now() - cached.timestamp < cacheTtlFor([cached.status]))
+            return cached.status;
+        const pending = this.inFlightProfiles.get(key);
+        if (pending)
+            return pending;
+        const generation = ++this.nextProbeGeneration;
+        const probe = this.probe(descriptorFor(provider), profile.configDir)
+            .then((status) => {
+            const stamped = { ...status, profileId: profile.id };
+            const current = this.completedProfiles.get(key);
+            // A verification (or newer probe) that wrote while this probe was in flight keeps its
+            // place: an older answer must not overwrite a fresher row, the same fence the default
+            // cache's generation guard provides. The caller still gets this probe's own answer.
+            if (current === undefined || generation >= current.generation) {
+                this.completedProfiles.set(key, { status: stamped, timestamp: this.now(), generation });
+            }
+            return stamped;
+        })
+            .finally(() => {
+            if (this.inFlightProfiles.get(key) === probe)
+                this.inFlightProfiles.delete(key);
+        });
+        this.inFlightProfiles.set(key, probe);
+        return probe;
+    }
+    /**
+     * Drop a cached per-account answer — used when an account's dir changes under us.
+     *
+     * TARGETED by default, because this cache is warmed at boot and is meant to survive: clearing
+     * every account because ONE was repointed would throw away knowledge that is still true and make
+     * the other accounts re-probe. Called with no argument it clears everything, which is what a
+     * shutdown or a whole-store reload wants.
+     */
+    forgetProfileStatus(provider, profileId) {
+        if (provider === undefined || profileId === undefined) {
+            this.completedProfiles.clear();
+            return;
+        }
+        this.completedProfiles.delete(profileCacheKey(provider, profileId));
+    }
+    /**
+     * Read cached account status without spawning or enforcing TTL. Inventory callers can show
+     * last-known status; callers needing a fresh answer must probe.
+     */
+    peekProfileStatus(provider, profileId) {
+        if (productEnv('DRY_RUN') === '1') {
+            return { provider, status: 'connected', profileId };
+        }
+        return this.completedProfiles.get(profileCacheKey(provider, profileId))?.status;
+    }
+    /** The cached default-profile rows, or `undefined` when the probe has never completed. Same
+     *  no-spawn contract as {@link peekProfileStatus}. */
+    peekStatus() {
+        if (productEnv('DRY_RUN') === '1') {
+            return { providers: PROVIDER_IDS.map((provider) => ({ provider, status: 'connected' })) };
+        }
+        if (!this.completed)
+            return undefined;
+        return this.withRuntimeFailures(this.completed.response);
+    }
+    async probe(descriptor, configDir) {
+        let result;
+        // The default profile is probed with the SAME three-argument call it always was — no
+        // trailing `undefined`. `runCommand` is an injected seam, and handing every existing
+        // implementation an extra argument it never asked for would be a change in the zero-config
+        // path for no gain.
+        const env = configDir ? profileEnv(descriptor.id, configDir) : undefined;
+        try {
+            result = await (descriptor.maxBuffer !== undefined
+                ? this.runCommand(descriptor.executable(), descriptor.statusArgs, COMMAND_TIMEOUT_MS, env, { maxBuffer: descriptor.maxBuffer })
+                : env === undefined
+                    ? this.runCommand(descriptor.executable(), descriptor.statusArgs, COMMAND_TIMEOUT_MS)
+                    : this.runCommand(descriptor.executable(), descriptor.statusArgs, COMMAND_TIMEOUT_MS, env));
+        }
+        catch {
+            return { provider: descriptor.id, status: 'unknown', hint: UNKNOWN_HINT };
+        }
+        if (result.errorCode === 'ENOENT') {
+            return { provider: descriptor.id, status: 'not-installed', hint: descriptor.installHint };
+        }
+        if (result.timedOut) {
+            return { provider: descriptor.id, status: 'unknown', hint: TIMEOUT_HINT };
+        }
+        if (result.errorCode) {
+            return { provider: descriptor.id, status: 'unknown', hint: UNKNOWN_HINT };
+        }
+        const status = descriptor.parse(result);
+        if (status !== null)
+            return { provider: descriptor.id, status };
+        return { provider: descriptor.id, status: 'unknown', hint: UNKNOWN_HINT };
+    }
+}
+//# sourceMappingURL=provider-auth.js.map