@kaitranntt/ccs 7.56.0-dev.1 → 7.56.0-dev.3

package/dist/cliproxy/accounts/registry.js

@@ -30,48 +30,100 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.discoverExistingAccounts = exports.setAccountTier = exports.touchAccount = exports.renameAccount = exports.removeAccount = exports.resumeAccount = exports.pauseAccount = exports.setDefaultAccount = exports.registerAccount = exports.syncRegistryWithTokenFiles = exports.saveAccountsRegistry = exports.loadAccountsRegistry = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const lockfile = __importStar(require("proper-lockfile"));
 const auth_types_1 = require("../auth/auth-types");
 const config_generator_1 = require("../config-generator");
 const types_1 = require("./types");
 const token_file_ops_1 = require("./token-file-ops");
 /** Default registry structure */
-const DEFAULT_REGISTRY = {
-    version: 1,
-    providers: {},
-};
-/**
- * Load accounts registry
- */
-function loadAccountsRegistry() {
+function createDefaultRegistry() {
+    return {
+        version: 1,
+        providers: {},
+    };
+}
+function withAccountsRegistryLock(callback) {
+    const lockTarget = (0, config_generator_1.getCliproxyDir)();
+    let release;
+    if (!fs.existsSync(lockTarget)) {
+        fs.mkdirSync(lockTarget, { recursive: true, mode: 0o700 });
+    }
+    try {
+        release = lockfile.lockSync(lockTarget, { stale: 10000 });
+        return callback();
+    }
+    finally {
+        if (release) {
+            try {
+                release();
+            }
+            catch {
+                // Best-effort release
+            }
+        }
+    }
+}
+function readAccountsRegistryFromDisk() {
     const registryPath = (0, token_file_ops_1.getAccountsRegistryPath)();
     if (!fs.existsSync(registryPath)) {
-        return { ...DEFAULT_REGISTRY };
+        return createDefaultRegistry();
     }
+    const content = fs.readFileSync(registryPath, 'utf-8');
+    let data;
     try {
-        const content = fs.readFileSync(registryPath, 'utf-8');
-        const data = JSON.parse(content);
-        return {
-            version: data.version || 1,
-            providers: data.providers || {},
-        };
+        data = JSON.parse(content);
     }
-    catch {
-        return { ...DEFAULT_REGISTRY };
+    catch (error) {
+        throw new Error(`Accounts registry is corrupted: ${error.message}`);
     }
+    if (!data || typeof data !== 'object') {
+        throw new Error('Accounts registry is corrupted: expected object');
+    }
+    const parsed = data;
+    return {
+        version: typeof parsed.version === 'number' ? parsed.version : 1,
+        providers: parsed.providers && typeof parsed.providers === 'object'
+            ? parsed.providers
+            : {},
+    };
 }
-exports.loadAccountsRegistry = loadAccountsRegistry;
-/**
- * Save accounts registry
- */
-function saveAccountsRegistry(registry) {
+function writeAccountsRegistryToDisk(registry) {
     const registryPath = (0, token_file_ops_1.getAccountsRegistryPath)();
     const dir = path.dirname(registryPath);
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
-    fs.writeFileSync(registryPath, JSON.stringify(registry, null, 2) + '\n', {
+    const tempPath = `${registryPath}.tmp.${process.pid}`;
+    fs.writeFileSync(tempPath, JSON.stringify(registry, null, 2) + '\n', {
         mode: 0o600,
     });
+    fs.renameSync(tempPath, registryPath);
+}
+function mutateAccountsRegistry(mutator) {
+    return withAccountsRegistryLock(() => {
+        const registry = readAccountsRegistryFromDisk();
+        const initialSnapshot = JSON.stringify(registry);
+        const result = mutator(registry);
+        if (JSON.stringify(registry) !== initialSnapshot) {
+            writeAccountsRegistryToDisk(registry);
+        }
+        return result;
+    });
+}
+/**
+ * Load accounts registry
+ */
+function loadAccountsRegistry() {
+    return readAccountsRegistryFromDisk();
+}
+exports.loadAccountsRegistry = loadAccountsRegistry;
+/**
+ * Save accounts registry
+ */
+function saveAccountsRegistry(registry) {
+    withAccountsRegistryLock(() => {
+        writeAccountsRegistryToDisk(registry);
+    });
 }
 exports.saveAccountsRegistry = saveAccountsRegistry;
 /**
@@ -118,99 +170,96 @@ exports.syncRegistryWithTokenFiles = syncRegistryWithTokenFiles;
  * Called after successful OAuth to record the account
  *
  * For providers without email (kiro, ghcp):
- * - nickname is REQUIRED and used as accountId
- * - Uniqueness is enforced to prevent overwriting
+ * - internal accountId is derived from token metadata
+ * - nickname is optional metadata
  *
  * For providers with email:
  * - email is used as accountId
  * - nickname is auto-generated from email if not provided
  */
 function registerAccount(provider, tokenFile, email, nickname, projectId) {
-    const registry = loadAccountsRegistry();
-    // Initialize provider section if needed
-    if (!registry.providers[provider]) {
-        registry.providers[provider] = {
-            default: 'default',
-            accounts: {},
-        };
-    }
-    const providerAccounts = registry.providers[provider];
-    if (!providerAccounts) {
-        throw new Error('Failed to initialize provider accounts');
-    }
-    // Determine account ID based on provider type
-    let accountId;
-    let accountNickname;
-    if (types_1.PROVIDERS_WITHOUT_EMAIL.includes(provider)) {
-        // For kiro/ghcp: nickname is REQUIRED and used as accountId
-        if (!nickname || nickname === 'default') {
-            throw new Error(`Nickname is required when adding ${provider} accounts. ` +
-                `Use --nickname <name> or provide a nickname in the UI.`);
+    return mutateAccountsRegistry((registry) => {
+        syncRegistryWithTokenFiles(registry);
+        if (!registry.providers[provider]) {
+            registry.providers[provider] = {
+                default: 'default',
+                accounts: {},
+            };
         }
-        // Validate nickname format
-        const validationError = (0, token_file_ops_1.validateNickname)(nickname);
-        if (validationError) {
-            throw new Error(validationError);
+        const providerAccounts = registry.providers[provider];
+        if (!providerAccounts) {
+            throw new Error('Failed to initialize provider accounts');
         }
-        // Check uniqueness
-        for (const [existingId, _account] of Object.entries(providerAccounts.accounts)) {
-            if (existingId.toLowerCase() === nickname.toLowerCase()) {
-                throw new Error(`An account with nickname "${nickname}" already exists for ${provider}. ` +
-                    `Choose a different nickname.`);
+        let accountId;
+        let accountNickname;
+        if (types_1.PROVIDERS_WITHOUT_EMAIL.includes(provider)) {
+            accountId = email
+                ? (0, token_file_ops_1.extractAccountIdFromTokenFile)(tokenFile, email)
+                : (0, token_file_ops_1.deriveNoEmailProviderAccountId)(provider, tokenFile, providerAccounts.accounts);
+            const existingAccount = providerAccounts.accounts[accountId];
+            if (nickname) {
+                const validationError = (0, token_file_ops_1.validateNickname)(nickname);
+                if (validationError) {
+                    throw new Error(validationError);
+                }
+                const existingAccounts = Object.entries(providerAccounts.accounts).map(([id, account]) => ({
+                    id,
+                    nickname: account.nickname,
+                }));
+                if ((0, token_file_ops_1.hasAccountNameConflict)(existingAccounts, nickname, accountId)) {
+                    throw new Error(`An account with nickname "${nickname}" already exists for ${provider}. ` +
+                        `Choose a different nickname.`);
+                }
             }
+            accountNickname =
+                nickname || existingAccount?.nickname || (email ? (0, token_file_ops_1.generateNickname)(email) : accountId);
         }
-        accountId = nickname;
-        accountNickname = nickname;
-    }
-    else {
-        // For other providers: use email as accountId, fallback to filename extraction
-        accountId = (0, token_file_ops_1.extractAccountIdFromTokenFile)(tokenFile, email);
-        accountNickname = nickname || (0, token_file_ops_1.generateNickname)(email);
-    }
-    const isFirstAccount = Object.keys(providerAccounts.accounts).length === 0;
-    // Create or update account
-    const accountMeta = {
-        email,
-        nickname: accountNickname,
-        tokenFile,
-        createdAt: new Date().toISOString(),
-        lastUsedAt: new Date().toISOString(),
-    };
-    // Include projectId for Antigravity accounts
-    if (provider === 'agy' && projectId) {
-        accountMeta.projectId = projectId;
-    }
-    providerAccounts.accounts[accountId] = accountMeta;
-    // Set as default if first account
-    if (isFirstAccount) {
-        providerAccounts.default = accountId;
-    }
-    saveAccountsRegistry(registry);
-    return {
-        id: accountId,
-        provider,
-        isDefault: accountId === providerAccounts.default,
-        email,
-        nickname: accountNickname,
-        tokenFile,
-        createdAt: providerAccounts.accounts[accountId].createdAt,
-        lastUsedAt: providerAccounts.accounts[accountId].lastUsedAt,
-        projectId: providerAccounts.accounts[accountId].projectId,
-    };
+        else {
+            accountId = (0, token_file_ops_1.extractAccountIdFromTokenFile)(tokenFile, email);
+            accountNickname = nickname || (0, token_file_ops_1.generateNickname)(email);
+        }
+        const isFirstAccount = Object.keys(providerAccounts.accounts).length === 0;
+        const existingAccount = providerAccounts.accounts[accountId];
+        const accountMeta = {
+            email,
+            nickname: accountNickname,
+            tokenFile,
+            createdAt: existingAccount?.createdAt || new Date().toISOString(),
+            lastUsedAt: new Date().toISOString(),
+        };
+        if (provider === 'agy' && projectId) {
+            accountMeta.projectId = projectId;
+        }
+        providerAccounts.accounts[accountId] = accountMeta;
+        if (isFirstAccount) {
+            providerAccounts.default = accountId;
+        }
+        return {
+            id: accountId,
+            provider,
+            isDefault: accountId === providerAccounts.default,
+            email,
+            nickname: accountNickname,
+            tokenFile,
+            createdAt: providerAccounts.accounts[accountId].createdAt,
+            lastUsedAt: providerAccounts.accounts[accountId].lastUsedAt,
+            projectId: providerAccounts.accounts[accountId].projectId,
+        };
+    });
 }
 exports.registerAccount = registerAccount;
 /**
  * Set default account for a provider
  */
 function setDefaultAccount(provider, accountId) {
-    const registry = loadAccountsRegistry();
-    const providerAccounts = registry.providers[provider];
-    if (!providerAccounts || !providerAccounts.accounts[accountId]) {
-        return false;
-    }
-    providerAccounts.default = accountId;
-    saveAccountsRegistry(registry);
-    return true;
+    return mutateAccountsRegistry((registry) => {
+        const providerAccounts = registry.providers[provider];
+        if (!providerAccounts || !providerAccounts.accounts[accountId]) {
+            return false;
+        }
+        providerAccounts.default = accountId;
+        return true;
+    });
 }
 exports.setDefaultAccount = setDefaultAccount;
 /**
@@ -218,22 +267,22 @@ exports.setDefaultAccount = setDefaultAccount;
  * Moves token file to paused/ subdir so CLIProxyAPI won't discover it
  */
 function pauseAccount(provider, accountId) {
-    const registry = loadAccountsRegistry();
-    const providerAccounts = registry.providers[provider];
-    if (!providerAccounts?.accounts[accountId]) {
-        return false;
-    }
-    const accountMeta = providerAccounts.accounts[accountId];
-    // Skip if already paused (idempotent)
-    if (accountMeta.paused) {
+    return mutateAccountsRegistry((registry) => {
+        const providerAccounts = registry.providers[provider];
+        if (!providerAccounts?.accounts[accountId]) {
+            return false;
+        }
+        const accountMeta = providerAccounts.accounts[accountId];
+        if (accountMeta.paused) {
+            return true;
+        }
+        if (!(0, token_file_ops_1.moveTokenToPaused)(accountMeta.tokenFile)) {
+            return false;
+        }
+        providerAccounts.accounts[accountId].paused = true;
+        providerAccounts.accounts[accountId].pausedAt = new Date().toISOString();
         return true;
-    }
-    // Move token file to paused directory (if it exists in auth dir)
-    (0, token_file_ops_1.moveTokenToPaused)(accountMeta.tokenFile);
-    providerAccounts.accounts[accountId].paused = true;
-    providerAccounts.accounts[accountId].pausedAt = new Date().toISOString();
-    saveAccountsRegistry(registry);
-    return true;
+    });
 }
 exports.pauseAccount = pauseAccount;
 /**
@@ -241,45 +290,44 @@ exports.pauseAccount = pauseAccount;
  * Moves token file back from paused/ to auth/ so CLIProxyAPI can discover it
  */
 function resumeAccount(provider, accountId) {
-    const registry = loadAccountsRegistry();
-    const providerAccounts = registry.providers[provider];
-    if (!providerAccounts?.accounts[accountId]) {
-        return false;
-    }
-    const accountMeta = providerAccounts.accounts[accountId];
-    // Skip if already active (idempotent)
-    if (!accountMeta.paused) {
+    return mutateAccountsRegistry((registry) => {
+        const providerAccounts = registry.providers[provider];
+        if (!providerAccounts?.accounts[accountId]) {
+            return false;
+        }
+        const accountMeta = providerAccounts.accounts[accountId];
+        if (!accountMeta.paused) {
+            return true;
+        }
+        if (!(0, token_file_ops_1.moveTokenFromPaused)(accountMeta.tokenFile)) {
+            return false;
+        }
+        providerAccounts.accounts[accountId].paused = false;
+        providerAccounts.accounts[accountId].pausedAt = undefined;
         return true;
-    }
-    // Move token file back from paused directory (if it exists in paused dir)
-    (0, token_file_ops_1.moveTokenFromPaused)(accountMeta.tokenFile);
-    providerAccounts.accounts[accountId].paused = false;
-    providerAccounts.accounts[accountId].pausedAt = undefined;
-    saveAccountsRegistry(registry);
-    return true;
+    });
 }
 exports.resumeAccount = resumeAccount;
 /**
  * Remove an account
  */
 function removeAccount(provider, accountId) {
-    const registry = loadAccountsRegistry();
-    const providerAccounts = registry.providers[provider];
-    if (!providerAccounts || !providerAccounts.accounts[accountId]) {
-        return false;
-    }
-    // Delete token file from both auth and paused directories
-    const tokenFile = providerAccounts.accounts[accountId].tokenFile;
-    (0, token_file_ops_1.deleteTokenFile)(tokenFile);
-    // Remove from registry
-    delete providerAccounts.accounts[accountId];
-    // Update default if needed
-    const remainingAccounts = Object.keys(providerAccounts.accounts);
-    if (providerAccounts.default === accountId && remainingAccounts.length > 0) {
-        providerAccounts.default = remainingAccounts[0];
-    }
-    saveAccountsRegistry(registry);
-    return true;
+    return mutateAccountsRegistry((registry) => {
+        const providerAccounts = registry.providers[provider];
+        if (!providerAccounts || !providerAccounts.accounts[accountId]) {
+            return false;
+        }
+        const tokenFile = providerAccounts.accounts[accountId].tokenFile;
+        if (!(0, token_file_ops_1.deleteTokenFile)(tokenFile)) {
+            return false;
+        }
+        delete providerAccounts.accounts[accountId];
+        const remainingAccounts = Object.keys(providerAccounts.accounts);
+        if (providerAccounts.default === accountId && remainingAccounts.length > 0) {
+            providerAccounts.default = remainingAccounts[0];
+        }
+        return true;
+    });
 }
 exports.removeAccount = removeAccount;
 /**
@@ -290,46 +338,47 @@ function renameAccount(provider, accountId, newNickname) {
     if (validationError) {
         throw new Error(validationError);
     }
-    const registry = loadAccountsRegistry();
-    const providerAccounts = registry.providers[provider];
-    if (!providerAccounts?.accounts[accountId]) {
-        return false;
-    }
-    // Check if nickname is already used by another account
-    for (const [id, account] of Object.entries(providerAccounts.accounts)) {
-        if (id !== accountId && account.nickname?.toLowerCase() === newNickname.toLowerCase()) {
+    return mutateAccountsRegistry((registry) => {
+        const providerAccounts = registry.providers[provider];
+        if (!providerAccounts?.accounts[accountId]) {
+            return false;
+        }
+        const existingAccounts = Object.entries(providerAccounts.accounts).map(([id, account]) => ({
+            id,
+            nickname: account.nickname,
+        }));
+        if ((0, token_file_ops_1.hasAccountNameConflict)(existingAccounts, newNickname, accountId)) {
             throw new Error(`Nickname "${newNickname}" is already used by another account`);
         }
-    }
-    providerAccounts.accounts[accountId].nickname = newNickname;
-    saveAccountsRegistry(registry);
-    return true;
+        providerAccounts.accounts[accountId].nickname = newNickname;
+        return true;
+    });
 }
 exports.renameAccount = renameAccount;
 /**
  * Update last used timestamp for an account
  */
 function touchAccount(provider, accountId) {
-    const registry = loadAccountsRegistry();
-    const providerAccounts = registry.providers[provider];
-    if (providerAccounts?.accounts[accountId]) {
-        providerAccounts.accounts[accountId].lastUsedAt = new Date().toISOString();
-        saveAccountsRegistry(registry);
-    }
+    mutateAccountsRegistry((registry) => {
+        const providerAccounts = registry.providers[provider];
+        if (providerAccounts?.accounts[accountId]) {
+            providerAccounts.accounts[accountId].lastUsedAt = new Date().toISOString();
+        }
+    });
 }
 exports.touchAccount = touchAccount;
 /**
  * Update account tier
  */
 function setAccountTier(provider, accountId, tier) {
-    const registry = loadAccountsRegistry();
-    const providerAccounts = registry.providers[provider];
-    if (!providerAccounts?.accounts[accountId]) {
-        return false;
-    }
-    providerAccounts.accounts[accountId].tier = tier;
-    saveAccountsRegistry(registry);
-    return true;
+    return mutateAccountsRegistry((registry) => {
+        const providerAccounts = registry.providers[provider];
+        if (!providerAccounts?.accounts[accountId]) {
+            return false;
+        }
+        providerAccounts.accounts[accountId].tier = tier;
+        return true;
+    });
 }
 exports.setAccountTier = setAccountTier;
 /**
@@ -345,166 +394,89 @@ function discoverExistingAccounts() {
     if (!fs.existsSync(authDir)) {
         return;
     }
-    const registry = loadAccountsRegistry();
     const files = fs.readdirSync(authDir);
-    // Track whether any accounts were discovered (to avoid saving empty registry)
-    let discoveredCount = 0;
-    for (const file of files) {
-        if (!file.endsWith('.json'))
-            continue;
-        const filePath = path.join(authDir, file);
-        try {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            const data = JSON.parse(content);
-            // Skip if no type field
-            if (!data.type)
+    mutateAccountsRegistry((registry) => {
+        syncRegistryWithTokenFiles(registry);
+        for (const file of files) {
+            if (!file.endsWith('.json'))
                 continue;
-            // Build reverse mapping from PROVIDER_TYPE_VALUES (type value -> provider)
-            // e.g., "antigravity" -> "agy", "kiro" -> "kiro", "codewhisperer" -> "kiro"
-            const typeValue = data.type.toLowerCase();
-            let provider;
-            for (const [prov, typeValues] of Object.entries(auth_types_1.PROVIDER_TYPE_VALUES)) {
-                if (typeValues.includes(typeValue)) {
-                    provider = prov;
-                    break;
+            const filePath = path.join(authDir, file);
+            try {
+                const content = fs.readFileSync(filePath, 'utf-8');
+                const data = JSON.parse(content);
+                if (!data.type)
+                    continue;
+                const typeValue = data.type.toLowerCase();
+                let provider;
+                for (const [prov, typeValues] of Object.entries(auth_types_1.PROVIDER_TYPE_VALUES)) {
+                    if (typeValues.includes(typeValue)) {
+                        provider = prov;
+                        break;
+                    }
                 }
-            }
-            // Skip if unknown provider type
-            if (!provider) {
-                continue;
-            }
-            // Extract email if available, fallback to filename-based ID
-            let email = data.email || undefined;
-            // Fallback: extract email from filename (e.g., "kiro-google-user@example.com.json")
-            if (!email && file.includes('@')) {
-                const match = file.match(/([^-]+@[^.]+\.[^.]+)(?=\.json$)/);
-                if (match) {
-                    email = match[1];
+                if (!provider) {
+                    continue;
                 }
-            }
-            // Initialize provider section if needed
-            if (!registry.providers[provider]) {
-                registry.providers[provider] = {
-                    default: 'default',
-                    accounts: {},
-                };
-            }
-            const providerAccounts = registry.providers[provider];
-            if (!providerAccounts)
-                continue;
-            // Skip if token file already registered (under any accountId)
-            const existingTokenFiles = Object.values(providerAccounts.accounts).map((a) => a.tokenFile);
-            if (existingTokenFiles.includes(file)) {
-                // Token file exists - check if we need to update projectId for agy accounts
-                const projectIdValue = typeof data.project_id === 'string' && data.project_id.trim()
-                    ? data.project_id.trim()
-                    : null;
-                if (provider === 'agy' && projectIdValue) {
-                    const existingEntry = Object.entries(providerAccounts.accounts).find(([, meta]) => meta.tokenFile === file);
-                    // Update if missing or changed
-                    if (existingEntry && existingEntry[1].projectId !== projectIdValue) {
-                        existingEntry[1].projectId = projectIdValue;
-                        discoveredCount++; // Count projectId updates as changes
+                let email = data.email || undefined;
+                if (!email && file.includes('@')) {
+                    const match = file.match(/([^-]+@[^.]+\.[^.]+)(?=\.json$)/);
+                    if (match) {
+                        email = match[1];
                     }
                 }
-                continue;
-            }
-            // Determine accountId based on provider type
-            let accountId;
-            if (types_1.PROVIDERS_WITHOUT_EMAIL.includes(provider) && !email) {
-                // For kiro/ghcp without email: extract from filename or generate unique
-                // Pattern: kiro-github-ABC123.json -> github-ABC123
-                const filenameId = (0, token_file_ops_1.extractAccountIdFromTokenFile)(file, undefined);
-                if (filenameId !== 'default') {
-                    accountId = filenameId;
+                if (!registry.providers[provider]) {
+                    registry.providers[provider] = {
+                        default: 'default',
+                        accounts: {},
+                    };
                 }
-                else {
-                    // Generate unique ID: provider + incrementing index
-                    let index = 1;
-                    while (providerAccounts.accounts[`${provider}-${index}`]) {
-                        index++;
+                const providerAccounts = registry.providers[provider];
+                if (!providerAccounts)
+                    continue;
+                const existingTokenFiles = Object.values(providerAccounts.accounts).map((a) => a.tokenFile);
+                if (existingTokenFiles.includes(file)) {
+                    const projectIdValue = typeof data.project_id === 'string' && data.project_id.trim()
+                        ? data.project_id.trim()
+                        : null;
+                    if (provider === 'agy' && projectIdValue) {
+                        const existingEntry = Object.entries(providerAccounts.accounts).find(([, meta]) => meta.tokenFile === file);
+                        if (existingEntry && existingEntry[1].projectId !== projectIdValue) {
+                            existingEntry[1].projectId = projectIdValue;
+                        }
                     }
-                    accountId = `${provider}-${index}`;
+                    continue;
                 }
-            }
-            else {
-                // For providers with email: use email or filename extraction
-                accountId = (0, token_file_ops_1.extractAccountIdFromTokenFile)(file, email);
-            }
-            // Skip if account already registered
-            if (providerAccounts.accounts[accountId]) {
-                continue;
-            }
-            // Set as default if first account
-            if (Object.keys(providerAccounts.accounts).length === 0) {
-                providerAccounts.default = accountId;
-            }
-            // Get file stats for creation time
-            const stats = fs.statSync(filePath);
-            // Register account with auto-generated nickname
-            // Use mtime as lastUsedAt (when token was last modified = last auth/refresh)
-            const lastModified = stats.mtime || stats.birthtime || new Date();
-            const accountMeta = {
-                email,
-                nickname: (0, token_file_ops_1.generateNickname)(email),
-                tokenFile: file,
-                createdAt: stats.birthtime?.toISOString() || new Date().toISOString(),
-                lastUsedAt: lastModified.toISOString(),
-            };
-            // Read project_id for Antigravity accounts (read-only field from auth token)
-            const discoveredProjectId = typeof data.project_id === 'string' && data.project_id.trim()
-                ? data.project_id.trim()
-                : null;
-            if (provider === 'agy' && discoveredProjectId) {
-                accountMeta.projectId = discoveredProjectId;
-            }
-            providerAccounts.accounts[accountId] = accountMeta;
-            discoveredCount++;
-        }
-        catch {
-            // Skip invalid files
-            continue;
-        }
-    }
-    // Only save if at least one account was discovered or updated
-    // This prevents creating accounts.json with empty provider sections
-    if (discoveredCount === 0) {
-        return;
-    }
-    // Reload-merge pattern: reduce race condition with concurrent OAuth registration
-    // Reload fresh registry and merge discovered accounts (fresh registry wins on conflicts)
-    const freshRegistry = loadAccountsRegistry();
-    for (const [providerName, discovered] of Object.entries(registry.providers)) {
-        if (!discovered)
-            continue;
-        // Skip empty provider sections (no accounts discovered)
-        if (Object.keys(discovered.accounts).length === 0)
-            continue;
-        const prov = providerName;
-        if (!freshRegistry.providers[prov]) {
-            freshRegistry.providers[prov] = discovered;
-        }
-        else {
-            // Merge accounts, preferring fresh registry's existing entries but updating projectId
-            const freshProviderAccounts = freshRegistry.providers[prov];
-            if (!freshProviderAccounts)
-                continue;
-            for (const [id, meta] of Object.entries(discovered.accounts)) {
-                if (!freshProviderAccounts.accounts[id]) {
-                    freshProviderAccounts.accounts[id] = meta;
-                    // Set default if none exists
-                    if (!freshProviderAccounts.default || freshProviderAccounts.default === 'default') {
-                        freshProviderAccounts.default = id;
-                    }
+                const accountId = types_1.PROVIDERS_WITHOUT_EMAIL.includes(provider) && !email
+                    ? (0, token_file_ops_1.deriveNoEmailProviderAccountId)(provider, file, providerAccounts.accounts)
+                    : (0, token_file_ops_1.extractAccountIdFromTokenFile)(file, email);
+                if (providerAccounts.accounts[accountId]) {
+                    continue;
                 }
-                else if (meta.projectId && !freshProviderAccounts.accounts[id].projectId) {
-                    // Update existing account with projectId if discovered from auth file
-                    freshProviderAccounts.accounts[id].projectId = meta.projectId;
+                if (Object.keys(providerAccounts.accounts).length === 0) {
+                    providerAccounts.default = accountId;
                 }
+                const stats = fs.statSync(filePath);
+                const lastModified = stats.mtime || stats.birthtime || new Date();
+                const accountMeta = {
+                    email,
+                    nickname: email ? (0, token_file_ops_1.generateNickname)(email) : accountId,
+                    tokenFile: file,
+                    createdAt: stats.birthtime?.toISOString() || new Date().toISOString(),
+                    lastUsedAt: lastModified.toISOString(),
+                };
+                const discoveredProjectId = typeof data.project_id === 'string' && data.project_id.trim()
+                    ? data.project_id.trim()
+                    : null;
+                if (provider === 'agy' && discoveredProjectId) {
+                    accountMeta.projectId = discoveredProjectId;
+                }
+                providerAccounts.accounts[accountId] = accountMeta;
+            }
+            catch {
+                continue;
             }
         }
-    }
-    saveAccountsRegistry(freshRegistry);
+    });
 }
 exports.discoverExistingAccounts = discoverExistingAccounts;
 //# sourceMappingURL=registry.js.map