@kaitranntt/ccs 8.1.4 → 8.2.0-dev.2

package/dist/web-server/routes/bar-routes.js

@@ -0,0 +1,415 @@
+"use strict";
+/**
+ * Bar Routes — /api/bar/summary aggregator
+ *
+ * One GET returns the full glance array for CCS Bar (macOS MenuBarExtra).
+ * Supports cached (instant) and ?refresh=true (live provider pull) modes.
+ *
+ * Design:
+ * - Calls data sources DIRECTLY (not via HTTP routes) so rate-limiters are irrelevant.
+ * - Force-fresh = invalidate quota-response-cache then call the fetcher server-side.
+ * - Debounce: if a fresh pull happened < 15s ago, serve cache even when refresh=true.
+ * - Per-account failure degrades THAT row (null fields + needsReauth/health:error);
+ *   other rows are unaffected — the payload always returns HTTP 200.
+ * - today_cost sourced from getTodayCostByAccount() (Phase 1A output).
+ * - health derived from runHealthChecks() summary (overall, not per-account for v1).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBarRouter = exports.resetForceFreshDebounce = void 0;
+const express_1 = require("express");
+const bar_analytics_1 = require("../usage/bar-analytics");
+// ============================================================================
+// Timing budgets (module-level; the bar must NEVER block on a slow provider)
+// ============================================================================
+/** Debounce window: skip force-fresh if last fresh pull was < 15s ago */
+const FORCE_FRESH_DEBOUNCE_MS = 15000;
+/** Hard ceiling for the whole /summary response. Past this we paint from cache. */
+const REQUEST_DEADLINE_MS = 2500;
+/** Per-account synchronous wait before falling back to stale cache (bg fetch continues). */
+const PER_ACCOUNT_TIMEOUT_MS = 5000;
+/** Bound for the cost side-load so a slow snapshot read can't dominate the response. */
+const SIDELOAD_TIMEOUT_MS = 1500;
+/**
+ * Bound for the native-subscription side-load. A slow or failed native fetch
+ * resolves to [] so the response paints CLIProxy rows only — never errors, never
+ * blocks. Native rows have their own 10-min cache, so the common path is instant.
+ */
+const NATIVE_SIDELOAD_TIMEOUT_MS = 1500;
+/** Timestamp of the last successful force-fresh pull (epoch ms, 0 = never) */
+let lastForceFreshAt = 0;
+/** Reset module state — called in tests to prevent cross-test pollution */
+function resetForceFreshDebounce() {
+    lastForceFreshAt = 0;
+}
+exports.resetForceFreshDebounce = resetForceFreshDebounce;
+/**
+ * Resolve a promise to its value, or to null if it doesn't settle within `ms`.
+ * The underlying promise keeps running (used to let a slow fetch warm the cache
+ * for the next open while the current response degrades gracefully).
+ */
+function withTimeout(p, ms) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                resolve(null);
+            }
+        }, ms);
+        p.then((v) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve(v);
+            }
+        }, () => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve(null);
+            }
+        });
+    });
+}
+/**
+ * Map a row to its wire shape. The native-only additions use snake_case parent
+ * keys ("quota_windows" / "stale_as_of") to match the existing payload's mixed
+ * casing; inner QuotaWindowDetail keys stay camelCase and pass through as-is.
+ * Rows without the native fields serialize byte-identically to before, so
+ * CLIProxy decode/encode tests are unaffected.
+ */
+function serializeBarRow(row) {
+    const { quotaWindows, staleAsOf, ...rest } = row;
+    const wire = { ...rest };
+    if (quotaWindows !== undefined)
+        wire.quota_windows = quotaWindows;
+    if (staleAsOf !== undefined && staleAsOf !== null)
+        wire.stale_as_of = staleAsOf;
+    return wire;
+}
+// ============================================================================
+// Per-account health derivation
+// ============================================================================
+/**
+ * Tri-state quota availability derived from the QuotaResult.
+ *
+ * We branch ONLY on the result's stable errorCode, never on a provider
+ * registry: ghcp is listed in MANAGED_QUOTA_PROVIDERS, yet fetchAccountQuota
+ * returns unsupported for every provider !== 'agy'. The result's
+ * 'quota_not_supported' code is the only honest signal that a provider has no
+ * quota API, so we use it here.
+ *
+ *   success                         → 'ok'
+ *   errorCode 'quota_not_supported' → 'unsupported' (no quota API; healthy)
+ *   anything else (null/timeout/reauth/other failure) → 'error'
+ */
+function deriveQuotaStatus(quota) {
+    if (quota?.success === true)
+        return 'ok';
+    if (quota && quota.errorCode === 'quota_not_supported')
+        return 'unsupported';
+    return 'error';
+}
+/**
+ * Health for a single account, derived from its own quota-fetch result.
+ *
+ * The menu bar is a per-account glance, so health is per-row — NOT the global
+ * system audit. (The system audit is also unsafe here: it shells out via a
+ * synchronous execSync that would block the event loop on the request path.)
+ *
+ * A provider with no quota API (quotaStatus 'unsupported', e.g. ghcp/kiro) is
+ * healthy — it must not show a permanent warning dot. 'warning' is reserved for
+ * genuine transient fetch failures, 'error' for accounts needing reauth.
+ *
+ *   needsReauth      → 'error'   (token expired; user action required)
+ *   quota unsupported → 'ok'     (no quota API is not a fault)
+ *   fetch failed      → 'warning' (transient/unknown; row degrades but isn't fatal)
+ *   success           → 'ok'
+ */
+function deriveHealth(quota, quotaStatus) {
+    if (quota?.needsReauth)
+        return 'error';
+    if (quotaStatus === 'unsupported')
+        return 'ok';
+    if (!quota || !quota.success)
+        return 'warning';
+    return 'ok';
+}
+// ============================================================================
+// Quota → bar row mapping
+// ============================================================================
+/**
+ * Extract the primary quota percentage from a QuotaResult.
+ * For Antigravity accounts: use the first model's percentage.
+ * Returns null on failure or missing data.
+ */
+function extractQuotaPercentage(quota) {
+    if (!quota.success || quota.models.length === 0)
+        return null;
+    // Use the first model (highest weight) as the representative percentage
+    return quota.models[0].percentage ?? null;
+}
+/**
+ * Extract the next reset timestamp from a QuotaResult.
+ * Returns null if not available.
+ */
+function extractNextReset(quota) {
+    if (!quota.success || quota.models.length === 0)
+        return null;
+    return quota.models[0].resetTime ?? null;
+}
+async function fetchAccountData(account, forceRefresh, deps) {
+    const provider = account.provider;
+    const accountId = account.id;
+    const now = new Date().toISOString();
+    // Read any prior cache up front so it survives as a stale fallback even when a
+    // refresh fetch is slow or fails (stale-while-revalidate).
+    const cached = deps.getCachedQuota(provider, accountId);
+    // Paused accounts: serve cache if present, otherwise degrade.
+    // Never trigger a live fetch for a user-paused account.
+    if (account.paused === true) {
+        return { quota: cached ?? null, cached: cached !== null, fetchedAt: now };
+    }
+    // Default mode serves a present cache instantly (no provider call).
+    if (!forceRefresh && cached) {
+        return { quota: cached, cached: true, fetchedAt: now };
+    }
+    // Force-fresh busts the route cache first (the stale value captured above
+    // still backs the fallback below).
+    if (forceRefresh) {
+        deps.invalidateQuotaCache(provider, accountId);
+    }
+    // Live fetch (force-refresh, or default-mode cache miss). It overwrites the
+    // cache on success and is bounded by PER_ACCOUNT_TIMEOUT_MS; if it overruns,
+    // the fetch keeps running (warming the cache for the next open) while this row
+    // degrades to the stale value so the payload never blocks.
+    const live = deps.fetchAccountQuota(provider, accountId).then((quota) => {
+        deps.setCachedQuota(provider, accountId, quota);
+        return quota;
+    });
+    const fresh = await withTimeout(live, PER_ACCOUNT_TIMEOUT_MS);
+    if (fresh)
+        return { quota: fresh, cached: false, fetchedAt: now };
+    return { quota: cached ?? null, cached: cached !== null, fetchedAt: now };
+}
+// ============================================================================
+// Row builder
+// ============================================================================
+/**
+ * Resolve the cost-lookup key for an account.
+ *
+ * The attribution pipeline (buildAuthIndexToAccountMap) stores email as the
+ * map value, so costByAccount keys are emails. For providers where
+ * account.id == email (agy, gemini, anthropic, etc.) this is a no-op.
+ * For duplicate-email providers like codex, account.id may be "email#variant",
+ * so we prefer account.email for the lookup to ensure the keys match.
+ * Falls back to account.id when email is absent (e.g. kiro/ghcp).
+ */
+function resolveCostKey(account) {
+    return account.email ?? account.id;
+}
+function buildRow(account, fetchResult, costByAccount, 
+/** Set of cost-keys that are shared by more than one account. Cost is unknowable for these. */
+sharedCostKeys) {
+    const { quota, cached, fetchedAt } = fetchResult;
+    const costKey = resolveCostKey(account);
+    const quotaStatus = deriveQuotaStatus(quota);
+    const health = deriveHealth(quota, quotaStatus);
+    const isDefault = account.isDefault ?? false;
+    const lastActivityAt = account.lastUsedAt ?? null;
+    // When multiple accounts share the same cost-key (e.g. two codex accounts with
+    // the same email), we cannot attribute the combined cost to either individual
+    // account, so it is null=unknowable. A missing key on a single-owner account is
+    // ALSO null=unknown (no usage record on a possibly-stale snapshot), distinct from
+    // a genuine 0 spend — the UI renders "no data" vs "$0.00" honestly.
+    const todayCost = sharedCostKeys.has(costKey) ? null : (costByAccount[costKey] ?? null);
+    if (!quota || !quota.success) {
+        // Degraded row: preserve identity fields, null out quota data
+        return {
+            account_id: account.id,
+            provider: account.provider,
+            displayName: account.nickname ?? account.id,
+            tier: account.tier ?? null,
+            paused: account.paused ?? false,
+            quota_percentage: null,
+            quotaStatus,
+            next_reset: null,
+            is_default: isDefault,
+            last_activity_at: lastActivityAt,
+            today_cost: todayCost,
+            health,
+            cached,
+            fetchedAt,
+            needsReauth: quota?.needsReauth ?? false,
+        };
+    }
+    return {
+        account_id: account.id,
+        provider: account.provider,
+        displayName: account.nickname ?? account.id,
+        tier: quota.tier ?? account.tier ?? null,
+        paused: account.paused ?? false,
+        quota_percentage: extractQuotaPercentage(quota),
+        quotaStatus,
+        next_reset: extractNextReset(quota),
+        is_default: isDefault,
+        last_activity_at: lastActivityAt,
+        today_cost: todayCost,
+        health,
+        cached,
+        fetchedAt,
+        needsReauth: quota.needsReauth ?? false,
+    };
+}
+// ============================================================================
+// Router factory
+// ============================================================================
+/**
+ * Create the bar router with injected dependencies.
+ *
+ * Production usage: call without arguments (defaults resolve from real modules).
+ * Test usage: pass mock implementations for each dep.
+ */
+function createBarRouter(deps) {
+    const router = (0, express_1.Router)();
+    /**
+     * GET /summary[?refresh=true]
+     *
+     * Returns the menu-bar glance array for all CLIProxy accounts.
+     *
+     * Query params:
+     *   refresh=true  — force-fresh from provider (debounced to once per 15s)
+     */
+    router.get('/summary', async (req, res) => {
+        try {
+            const wantsRefresh = req.query['refresh'] === 'true';
+            // Determine effective refresh mode after applying debounce.
+            // IMPORTANT: set lastForceFreshAt at decision time (before awaiting any
+            // fetches) to prevent a read-modify-write race where two concurrent
+            // refresh=true requests both pass the debounce check before either
+            // records the timestamp.
+            let doForceRefresh = false;
+            if (wantsRefresh) {
+                const sinceLastFresh = Date.now() - lastForceFreshAt;
+                if (sinceLastFresh >= FORCE_FRESH_DEBOUNCE_MS) {
+                    doForceRefresh = true;
+                    lastForceFreshAt = Date.now(); // claim the window before any async work
+                }
+                // else: debounce active — fall through to cache path
+            }
+            // Cost side-load is bounded so a slow usage-snapshot read can't stall the
+            // glance. (Health is per-account, derived from each quota result below —
+            // no blocking system audit on the request path.)
+            const details = await withTimeout(deps.loadCliproxyDetails(), SIDELOAD_TIMEOUT_MS);
+            const costByAccount = details
+                ? deps.getTodayCostByAccount(details)
+                : {};
+            // Flatten all accounts across providers
+            const summary = deps.getAllAccountsSummary();
+            const allAccounts = Object.values(summary).flat();
+            // Fix #11: compute which cost-keys are shared by >1 account so buildRow can
+            // report null (unknowable) rather than the combined total for those rows.
+            const costKeyCount = new Map();
+            for (const account of allAccounts) {
+                const key = resolveCostKey(account);
+                costKeyCount.set(key, (costKeyCount.get(key) ?? 0) + 1);
+            }
+            const sharedCostKeys = new Set(Array.from(costKeyCount.entries())
+                .filter(([, count]) => count > 1)
+                .map(([key]) => key));
+            // Build every row synchronously from whatever is in cache right now. This
+            // is the instant-paint fallback and the source of truth when the deadline
+            // fires before live fetches finish.
+            const cacheRows = () => {
+                const at = new Date().toISOString();
+                return allAccounts.map((account) => {
+                    const cached = deps.getCachedQuota(account.provider, account.id);
+                    return buildRow(account, { quota: cached ?? null, cached: cached !== null, fetchedAt: at }, costByAccount, sharedCostKeys);
+                });
+            };
+            // Fetch quota in parallel with per-account error isolation. Each row is
+            // bounded inside fetchAccountData; the whole gather is additionally raced
+            // against REQUEST_DEADLINE_MS so the response NEVER hangs on a slow
+            // provider — past the deadline we paint from cache and let background
+            // fetches warm the next open.
+            const CONCURRENCY_CAP = 5;
+            const gather = (async () => {
+                const rows = [];
+                for (let i = 0; i < allAccounts.length; i += CONCURRENCY_CAP) {
+                    const batch = allAccounts.slice(i, i + CONCURRENCY_CAP);
+                    const batchRows = await Promise.all(batch.map(async (account) => {
+                        const fetchResult = await fetchAccountData(account, doForceRefresh, deps);
+                        return buildRow(account, fetchResult, costByAccount, sharedCostKeys);
+                    }));
+                    rows.push(...batchRows);
+                }
+                return rows;
+            })();
+            const deadline = new Promise((resolve) => {
+                setTimeout(() => resolve(cacheRows()), REQUEST_DEADLINE_MS);
+            });
+            const rows = await Promise.race([gather, deadline]);
+            // Native subscription rows (Claude Code + Codex) are side-loaded AFTER the
+            // CLIProxy rows resolve, bounded so a slow/failed native fetch degrades to
+            // [] rather than blocking or erroring the response.
+            const getNative = deps.getNativeAccountRows ?? (async () => []);
+            const nativeRows = (await withTimeout(getNative(), NATIVE_SIDELOAD_TIMEOUT_MS)) ?? [];
+            res.json([...rows, ...nativeRows].map(serializeBarRow));
+        }
+        catch (err) {
+            console.error('[bar-routes] /summary error:', err.message);
+            res.status(500).json({ error: 'Internal server error' });
+        }
+    });
+    /**
+     * GET /analytics
+     *
+     * Rolls up the merged, multi-source usage (Claude Code, Codex, Droid, CLIProxy)
+     * into today / 7-day / 30-day spend, a 30-day sparkline, top models, and a
+     * per-surface breakdown. Reads the dashboard's stale-while-revalidate caches so
+     * recent activity shows even when the CLIProxy snapshot is frozen by a restart.
+     * Both loads are bounded so a slow read can't stall the menu; on miss the
+     * windows degrade to empty rather than failing the payload.
+     */
+    router.get('/analytics', async (_req, res) => {
+        try {
+            const [daily, hourly] = await Promise.all([
+                withTimeout(deps.loadDailyUsage(), SIDELOAD_TIMEOUT_MS).catch(() => []),
+                withTimeout(deps.loadHourlyUsage(), SIDELOAD_TIMEOUT_MS).catch(() => []),
+            ]);
+            const analytics = (0, bar_analytics_1.computeBarAnalyticsFromDaily)(daily ?? [], hourly ?? [], new Date());
+            res.json(analytics);
+        }
+        catch (err) {
+            console.error('[bar-routes] /analytics error:', err.message);
+            res.status(500).json({ error: 'Internal server error' });
+        }
+    });
+    return router;
+}
+exports.createBarRouter = createBarRouter;
+// ============================================================================
+// Default production router (sync imports — matches all other route modules)
+// ============================================================================
+const query_1 = require("../../cliproxy/accounts/query");
+const quota_response_cache_1 = require("../../cliproxy/quota/quota-response-cache");
+const quota_fetcher_1 = require("../../cliproxy/quota/quota-fetcher");
+const data_aggregator_1 = require("../usage/data-aggregator");
+const cliproxy_snapshot_reader_1 = require("../usage/cliproxy-snapshot-reader");
+const aggregator_1 = require("../usage/aggregator");
+const native_quota_collector_1 = require("../usage/native-quota-collector");
+/** Production bar router — wired to real dependencies */
+const barRouter = createBarRouter({
+    getAllAccountsSummary: query_1.getAllAccountsSummary,
+    getCachedQuota: quota_response_cache_1.getCachedQuota,
+    setCachedQuota: quota_response_cache_1.setCachedQuota,
+    invalidateQuotaCache: quota_response_cache_1.invalidateQuotaCache,
+    fetchAccountQuota: quota_fetcher_1.fetchAccountQuota,
+    getTodayCostByAccount: data_aggregator_1.getTodayCostByAccount,
+    loadCliproxyDetails: cliproxy_snapshot_reader_1.loadCliproxySnapshotDetails,
+    loadDailyUsage: () => (0, aggregator_1.getCachedDailyData)(),
+    loadHourlyUsage: () => (0, aggregator_1.getCachedHourlyData)(),
+    getNativeAccountRows: () => (0, native_quota_collector_1.getNativeAccountRows)(),
+});
+exports.default = barRouter;
+//# sourceMappingURL=bar-routes.js.map

package/dist/web-server/routes/bar-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bar-routes.js","sourceRoot":"","sources":["../../../src/web-server/routes/bar-routes.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,qCAAiC;AAOjC,0DAAsE;AAkItE,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,KAAM,CAAC;AAEvC,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,IAAK,CAAC;AAElC,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,IAAK,CAAC;AAErC,wFAAwF;AACxF,MAAM,mBAAmB,GAAG,IAAK,CAAC;AAElC;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,IAAK,CAAC;AAEzC,8EAA8E;AAC9E,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAEzB,2EAA2E;AAC3E,SAAgB,uBAAuB;IACrC,gBAAgB,GAAG,CAAC,CAAC;AACvB,CAAC;AAFD,0DAEC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC,EACD,GAAG,EAAE;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAkB;IACzC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACjD,MAAM,IAAI,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,qBAAqB;QAAE,OAAO,aAAa,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,YAAY,CACnB,KAAyB,EACzB,WAA2C;IAE3C,IAAI,KAAK,EAAE,WAAW;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,WAAW,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,wEAAwE;IACxE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAkB;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;AAC3C,CAAC;AAYD,KAAK,UAAU,gBAAgB,CAC7B,OAAoB,EACpB,YAAqB,EACrB,IAAmB;IAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,+EAA+E;IAC/E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAc,QAAQ,EAAE,SAAS,CAAC,CAAC;IAErE,8DAA8D;IAC9D,wDAAwD;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC5E,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAA4B,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1F,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC9D,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC5E,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,OAAoB;IAC1C,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CACf,OAAoB,EACpB,WAA+B,EAC/B,aAAqC;AACrC,+FAA+F;AAC/F,cAAmC;IAEnC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAElD,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,kFAAkF;IAClF,oEAAoE;IACpE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAExF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,gBAAgB,EAAE,IAAI;YACtB,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,cAAc;YAChC,UAAU,EAAE,SAAS;YACrB,MAAM;YACN,MAAM;YACN,SAAS;YACT,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,KAAK;SACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,gBAAgB,EAAE,sBAAsB,CAAC,KAAK,CAAC;QAC/C,WAAW;QACX,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,SAAS;QACrB,gBAAgB,EAAE,cAAc;QAChC,UAAU,EAAE,SAAS;QACrB,MAAM;QACN,MAAM;QACN,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;KACxC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,IAAmB;IACjD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAC1E,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;YAErD,4DAA4D;YAC5D,wEAAwE;YACxE,oEAAoE;YACpE,mEAAmE;YACnE,yBAAyB;YACzB,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;gBACrD,IAAI,cAAc,IAAI,uBAAuB,EAAE,CAAC;oBAC9C,cAAc,GAAG,IAAI,CAAC;oBACtB,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,yCAAyC;gBAC1E,CAAC;gBACD,qDAAqD;YACvD,CAAC;YAED,0EAA0E;YAC1E,yEAAyE;YACzE,iDAAiD;YACjD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,mBAAmB,CAAC,CAAC;YACnF,MAAM,aAAa,GAA2B,OAAO;gBACnD,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBACrC,CAAC,CAAC,EAAE,CAAC;YAEP,wCAAwC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAEjE,4EAA4E;YAC5E,0EAA0E;YAC1E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;iBAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CACvB,CAAC;YAEF,0EAA0E;YAC1E,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,SAAS,GAAG,GAAoB,EAAE;gBACtC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACpC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;oBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAc,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC9E,OAAO,QAAQ,CACb,OAAO,EACP,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACjE,aAAa,EACb,cAAc,CACf,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,wEAAwE;YACxE,0EAA0E;YAC1E,oEAAoE;YACpE,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,eAAe,GAAG,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,CAAC,KAAK,IAA8B,EAAE;gBACnD,MAAM,IAAI,GAAoB,EAAE,CAAC;gBACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;oBAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC;oBACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAA0B,EAAE;wBAClD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;wBAC1E,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;oBACvE,CAAC,CAAC,CACH,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;gBAC1B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;YAEL,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;gBACxD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEpD,2EAA2E;YAC3E,2EAA2E;YAC3E,oDAAoD;YACpD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAqB,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,CAAC,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE,CAAC;YAEtF,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAiB,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAkB,CAAC;gBACvF,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAmB,CAAC;aAC1F,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,4CAA4B,EAAC,KAAK,IAAI,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAxID,0CAwIC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E,yDAAsE;AACtE,oFAImD;AACnD,sEAAuE;AACvE,8DAAiE;AACjE,gFAAgF;AAChF,oDAA8E;AAC9E,4EAAuE;AAEvE,yDAAyD;AACzD,MAAM,SAAS,GAAW,eAAe,CAAC;IACxC,qBAAqB,EAArB,6BAAqB;IACrB,cAAc,EAAd,qCAAc;IACd,cAAc,EAAd,qCAAc;IACd,oBAAoB,EAApB,2CAAoB;IACpB,iBAAiB,EAAjB,iCAAiB;IACjB,qBAAqB,EAArB,uCAAqB;IACrB,mBAAmB,EAAE,sDAA2B;IAChD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAkB,GAAE;IAC1C,eAAe,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAmB,GAAE;IAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAA,6CAAoB,GAAE;CACnD,CAAC,CAAC;AAEH,kBAAe,SAAS,CAAC"}

package/dist/web-server/routes/cliproxy-auth-routes.d.ts

@@ -20,5 +20,15 @@ export declare function getStartAuthNicknameError(provider: CLIProxyProvider, ni
     error: string;
     code: 'INVALID_NICKNAME' | 'NICKNAME_EXISTS';
 } | null;
+export declare function getReauthAccountTarget(accountId: string | undefined, existingAccounts: Array<{
+    id: string;
+    nickname?: string;
+}>): {
+    account?: {
+        id: string;
+        nickname?: string;
+    };
+    error?: string;
+};
 export default router;
 //# sourceMappingURL=cliproxy-auth-routes.d.ts.map

package/dist/web-server/routes/cliproxy-auth-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliproxy-auth-routes.d.ts","sourceRoot":"","sources":["../../../src/web-server/routes/cliproxy-auth-routes.ts"],"names":[],"mappings":"AA8CA,OAAO,EAOL,cAAc,EAIf,MAAM,gCAAgC,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAgB7D,QAAA,MAAM,MAAM,4CAAW,CAAC;AAkLxB,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,UAAU,EAAE,cAAc,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiBzC;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,cAAc,CAAA;CAAE,GACxC,MAAM,GAAG,IAAI,CAuBf;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAK7E;AASD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,gBAAgB,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1D,sBAAsB,CAAC,EAAE,MAAM,GAC9B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAAA;CAAE,GAAG,IAAI,CAqBxE;AAslCD,eAAe,MAAM,CAAC"}
+{"version":3,"file":"cliproxy-auth-routes.d.ts","sourceRoot":"","sources":["../../../src/web-server/routes/cliproxy-auth-routes.ts"],"names":[],"mappings":"AA8CA,OAAO,EAOL,cAAc,EAIf,MAAM,gCAAgC,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAgB7D,QAAA,MAAM,MAAM,4CAAW,CAAC;AAkLxB,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,UAAU,EAAE,cAAc,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiBzC;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,cAAc,CAAA;CAAE,GACxC,MAAM,GAAG,IAAI,CAuBf;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAK7E;AASD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,gBAAgB,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1D,sBAAsB,CAAC,EAAE,MAAM,GAC9B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAAA;CAAE,GAAG,IAAI,CAqBxE;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GACzD;IAAE,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAajE;AA+mCD,eAAe,MAAM,CAAC"}

package/dist/web-server/routes/cliproxy-auth-routes.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getStartAuthNicknameError = exports.getStartAuthFailureMessage = exports.getStartUrlUnsupportedReason = exports.getKiroStartIDCValidationError = void 0;
+exports.getReauthAccountTarget = exports.getStartAuthNicknameError = exports.getStartAuthFailureMessage = exports.getStartUrlUnsupportedReason = exports.getKiroStartIDCValidationError = void 0;
 const express_1 = require("express");
 const auth_handler_1 = require("../../cliproxy/auth/auth-handler");
 const project_selection_handler_1 = require("../../cliproxy/auth/project-selection-handler");
@@ -210,6 +210,19 @@ function getStartAuthNicknameError(provider, nickname, existingAccounts, allowEx
     return null;
 }
 exports.getStartAuthNicknameError = getStartAuthNicknameError;
+function getReauthAccountTarget(accountId, existingAccounts) {
+    if (!accountId) {
+        return {};
+    }
+    const account = existingAccounts.find((candidate) => candidate.id === accountId);
+    if (!account) {
+        return {
+            error: `Account '${accountId}' not found for this provider`,
+        };
+    }
+    return { account };
+}
+exports.getReauthAccountTarget = getReauthAccountTarget;
 /**
  * GET /api/cliproxy/auth - Get auth status for built-in CLIProxy profiles
  * Also fetches CLIProxyAPI stats to update lastUsedAt for active providers
@@ -464,6 +477,7 @@ router.post('/:provider/start', async (req, res) => {
     const { provider } = req.params;
     const requestBody = req.body && typeof req.body === 'object' ? req.body : {};
     const nicknameRaw = typeof requestBody.nickname === 'string' ? requestBody.nickname : undefined;
+    const accountId = typeof requestBody.accountId === 'string' ? requestBody.accountId.trim() : undefined;
     const noIncognitoBody = typeof requestBody.noIncognito === 'boolean' ? requestBody.noIncognito : undefined;
     const kiroMethodRaw = requestBody.kiroMethod;
     const kiroIDCStartUrl = typeof requestBody.kiroIDCStartUrl === 'string'
@@ -492,6 +506,15 @@ router.post('/:provider/start', async (req, res) => {
         res.status(400).json({ error: `Invalid provider: ${provider}` });
         return;
     }
+    const localProvider = provider;
+    const existingAccounts = (0, account_manager_1.getProviderAccounts)(localProvider);
+    const reauthTarget = getReauthAccountTarget(accountId, existingAccounts);
+    if (reauthTarget.error) {
+        res.status(404).json({ error: reauthTarget.error });
+        return;
+    }
+    const targetAccountId = reauthTarget.account?.id;
+    const effectiveNickname = nickname || reauthTarget.account?.nickname;
     if (provider === 'kiro' && invalidKiroMethod) {
         res.status(400).json({
             error: 'Invalid kiroMethod. Supported: aws, aws-authcode, google, github, idc',
@@ -536,7 +559,6 @@ router.post('/:provider/start', async (req, res) => {
             return;
         }
         try {
-            const localProvider = provider;
             const knownTokenFiles = (0, token_manager_1.listProviderTokenSnapshots)(localProvider);
             const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, '/v0/management/gitlab-auth-url'), {
                 method: 'POST',
@@ -557,14 +579,14 @@ router.post('/:provider/start', async (req, res) => {
                 });
                 return;
             }
-            const tokenSnapshot = (0, token_manager_1.findNewTokenSnapshot)((0, token_manager_1.listProviderTokenSnapshots)(localProvider), knownTokenFiles);
+            const tokenSnapshot = (0, token_manager_1.findNewTokenSnapshot)((0, token_manager_1.listProviderTokenSnapshots)(localProvider), knownTokenFiles, targetAccountId);
             if (!tokenSnapshot) {
                 res.status(409).json({
                     error: 'GitLab PAT authentication completed, but CCS could not find the saved token.',
                 });
                 return;
             }
-            const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), nickname, false, tokenSnapshot.file);
+            const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), effectiveNickname, false, targetAccountId || tokenSnapshot.file);
             if (!account) {
                 res.status(409).json({
                     error: 'GitLab PAT authentication succeeded, but account registration failed.',
@@ -594,8 +616,7 @@ router.post('/:provider/start', async (req, res) => {
             return;
         }
     }
-    const existingAccounts = (0, account_manager_1.getProviderAccounts)(provider);
-    const nicknameError = getStartAuthNicknameError(provider, nickname, existingAccounts);
+    const nicknameError = getStartAuthNicknameError(localProvider, effectiveNickname, existingAccounts, targetAccountId);
     if (nicknameError) {
         res.status(400).json(nicknameError);
         return;
@@ -612,7 +633,8 @@ router.post('/:provider/start', async (req, res) => {
         const account = await (0, auth_handler_1.triggerOAuth)(provider, {
             add: true, // Always add mode from UI
             headless: false, // Force interactive mode
-            nickname: nickname || undefined,
+            nickname: effectiveNickname || undefined,
+            expectedAccountId: targetAccountId,
             acceptAgyRisk: provider === 'agy',
             kiroMethod: provider === 'kiro' ? kiroMethod : undefined,
             kiroIDCStartUrl: provider === 'kiro' ? kiroIDCStartUrl : undefined,
@@ -762,6 +784,7 @@ router.post('/:provider/start-url', async (req, res) => {
     const { provider } = req.params;
     const requestBody = req.body && typeof req.body === 'object' ? req.body : {};
     const nicknameRaw = typeof requestBody.nickname === 'string' ? requestBody.nickname : undefined;
+    const accountId = typeof requestBody.accountId === 'string' ? requestBody.accountId.trim() : undefined;
     const kiroMethodRaw = requestBody.kiroMethod;
     const gitlabAuthModeRaw = requestBody.gitlabAuthMode;
     const gitlabBaseUrl = typeof requestBody.gitlabBaseUrl === 'string' ? requestBody.gitlabBaseUrl.trim() : undefined;
@@ -818,8 +841,16 @@ router.post('/:provider/start-url', async (req, res) => {
         res.status(400).json({ error: unsupportedReason });
         return;
     }
-    const existingAccounts = (0, account_manager_1.getProviderAccounts)(provider);
-    const nicknameError = getStartAuthNicknameError(provider, nickname, existingAccounts);
+    const localProvider = provider;
+    const existingAccounts = (0, account_manager_1.getProviderAccounts)(localProvider);
+    const reauthTarget = getReauthAccountTarget(accountId, existingAccounts);
+    if (reauthTarget.error) {
+        res.status(404).json({ error: reauthTarget.error });
+        return;
+    }
+    const targetAccountId = reauthTarget.account?.id;
+    const effectiveNickname = nickname || reauthTarget.account?.nickname;
+    const nicknameError = getStartAuthNicknameError(localProvider, effectiveNickname, existingAccounts, targetAccountId);
     if (nicknameError) {
         res.status(400).json(nicknameError);
         return;
@@ -889,8 +920,9 @@ router.post('/:provider/start-url', async (req, res) => {
         }
         if (oauthState) {
             rememberManualAuthState(oauthState, {
-                nickname: nickname || undefined,
-                knownTokenFiles: (0, token_manager_1.listProviderTokenSnapshots)(provider),
+                nickname: effectiveNickname || undefined,
+                expectedAccountId: targetAccountId,
+                knownTokenFiles: (0, token_manager_1.listProviderTokenSnapshots)(localProvider),
             });
         }
         res.json({
@@ -966,7 +998,7 @@ router.get('/:provider/status', async (req, res) => {
                 });
                 return;
             }
-            const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), pendingAuth.nickname, false, tokenSnapshot.file);
+            const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), pendingAuth.nickname, false, pendingAuth.expectedAccountId || tokenSnapshot.file);
             if (!account) {
                 pendingManualAuthState.delete(state);
                 res.status(409).json({
@@ -1093,7 +1125,7 @@ router.post('/:provider/submit-callback', async (req, res) => {
                 });
                 return;
             }
-            const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), pendingAuth.nickname, false, tokenSnapshot.file);
+            const account = (0, token_manager_1.registerAccountFromToken)(localProvider, (0, token_manager_1.getProviderTokenDir)(localProvider), pendingAuth.nickname, false, pendingAuth.expectedAccountId || tokenSnapshot.file);
             if (!account) {
                 if (parsed.state) {
                     pendingManualAuthState.delete(parsed.state);