@khalilgharbaoui/opencode-claude-code-plugin 0.49.0 → 0.51.0

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/claude-code-language-model.ts
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/ids.ts
 import { randomInt } from "crypto";
@@ -572,6 +572,139 @@ function titleizeAccount(account) {
   return normalizeAccountName(account).split("-").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 
+// src/account-groups.ts
+var DEFAULT_ACCOUNT_GROUP = "default";
+function normalizeGroupName(value) {
+  return value.trim().toLowerCase();
+}
+var warnedUnknownAccounts = /* @__PURE__ */ new Set();
+var warnedShape = false;
+function resolveAccountGroups(value, knownAccounts) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    if (!warnedShape) {
+      warnedShape = true;
+      log.warn(
+        "accountGroups must be an object mapping an account name to a group name; ignoring it",
+        { type: Array.isArray(value) ? "array" : typeof value }
+      );
+    }
+    return null;
+  }
+  const known = knownAccounts ? new Set(knownAccounts.map((account) => normalizeAccountName(String(account)))) : void 0;
+  const out = {};
+  for (const [rawAccount, rawGroup] of Object.entries(value)) {
+    const account = normalizeAccountName(rawAccount);
+    if (!account) continue;
+    if (typeof rawGroup !== "string") {
+      if (!warnedShape) {
+        warnedShape = true;
+        log.warn(
+          "accountGroups must be an object mapping an account name to a group name; ignoring it",
+          { account, type: typeof rawGroup }
+        );
+      }
+      continue;
+    }
+    const group = normalizeGroupName(rawGroup);
+    if (!group) continue;
+    if (known && !known.has(account)) {
+      if (!warnedUnknownAccounts.has(account)) {
+        warnedUnknownAccounts.add(account);
+        log.warn("accountGroups names an account that is not configured; ignoring it", {
+          account,
+          group
+        });
+      }
+      continue;
+    }
+    out[account] = group;
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
+function accountGroup(account, groups) {
+  const name = normalizeAccountName(account || DEFAULT_ACCOUNT);
+  return groups?.[name] ?? DEFAULT_ACCOUNT_GROUP;
+}
+function accountsShareGroup(a, b, groups) {
+  if (!groups) return true;
+  return accountGroup(a, groups) === accountGroup(b, groups);
+}
+function accountsInGroupOf(account, accounts, groups) {
+  const out = [];
+  for (const raw of accounts ?? []) {
+    const name = normalizeAccountName(String(raw));
+    if (!name || out.includes(name)) continue;
+    if (!accountsShareGroup(account, name, groups)) continue;
+    out.push(name);
+  }
+  return out;
+}
+function describeAccountGroups(groups) {
+  if (!groups) return [];
+  return Object.entries(groups).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([account, group]) => `${account}=${group}`);
+}
+function accountProviderMap(accounts) {
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of accounts ?? []) {
+    const account = normalizeAccountName(String(raw));
+    if (!account) continue;
+    out.set(`${BASE_PROVIDER_ID}-${account}`, account);
+  }
+  return out;
+}
+var CONTEXT_PREFIX = "context=";
+function sessionKeyContextBlob(sessionKey2) {
+  const parts = sessionKey2.split("::");
+  if (parts.length < 5) return void 0;
+  if (parts[2] === "compaction") return void 0;
+  const withoutEffort = parts[parts.length - 1].startsWith("effort=") ? parts.slice(0, -1) : parts;
+  if (withoutEffort.length < 5) return void 0;
+  const tail = withoutEffort.slice(4).join("::");
+  return tail.startsWith(CONTEXT_PREFIX) ? tail.slice(CONTEXT_PREFIX.length) : void 0;
+}
+function sessionKeyProvider(sessionKey2) {
+  const blob = sessionKeyContextBlob(sessionKey2);
+  if (blob === void 0) return void 0;
+  try {
+    const parsed = JSON.parse(blob);
+    const first = Array.isArray(parsed) ? parsed[0] : void 0;
+    return typeof first === "string" ? first : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sessionKeyAccount(sessionKey2, providers) {
+  const provider = sessionKeyProvider(sessionKey2);
+  return provider === void 0 ? void 0 : providers.get(provider);
+}
+function blankAccountProvider(sessionKey2, providers) {
+  if (providers.size === 0) return sessionKey2;
+  const blob = sessionKeyContextBlob(sessionKey2);
+  if (blob === void 0) return sessionKey2;
+  let parsed;
+  try {
+    parsed = JSON.parse(blob);
+  } catch {
+    return sessionKey2;
+  }
+  if (!Array.isArray(parsed)) return sessionKey2;
+  const provider = parsed[0];
+  if (typeof provider !== "string" || !providers.has(provider)) return sessionKey2;
+  const blanked = [...parsed];
+  blanked[0] = "*";
+  const prefix = sessionKey2.slice(0, sessionKey2.length - blob.length);
+  return `${prefix}${JSON.stringify(blanked)}`;
+}
+var ACCOUNT_GROUP_MARKER = "\u258C **account group:**";
+function formatAccountGroupNote(input) {
+  const source = normalizeAccountName(input.sourceAccount || DEFAULT_ACCOUNT);
+  const target = normalizeAccountName(input.targetAccount || DEFAULT_ACCOUNT);
+  return `
+${ACCOUNT_GROUP_MARKER} this conversation was running on the Claude account "${source}" (group "${input.sourceGroup}") and is now on "${target}" (group "${input.targetGroup}"), so none of it was carried over: accountGroups keeps a conversation inside one group. This account is starting fresh and sees only your latest message. The conversation is still on "${source}"; switch back to it to continue where you stopped.
+`;
+}
+
 // src/types.ts
 var READ_ONLY_PERMISSION_MODE = "read-only";
 var DEFAULT_PROXY_TOOL_NAMES = [
@@ -1489,12 +1622,13 @@ function isAccountFailoverQuestionActive(input) {
   if (input.candidates.length === 0) return false;
   return input.opencodeHasQuestion;
 }
-function failoverCandidates(accounts, source) {
+function failoverCandidates(accounts, source, groups) {
   const from = normalizeAccountName(source || DEFAULT_ACCOUNT);
   const out = [];
   for (const raw of accounts ?? []) {
     const name = normalizeAccountName(String(raw));
     if (!name || name === from || out.includes(name)) continue;
+    if (!accountsShareGroup(from, name, groups)) continue;
     out.push(name);
   }
   return out;
@@ -3514,33 +3648,97 @@ function clearCompression(sessionKey2) {
 }
 
 // src/mcp-bridge.ts
-import * as fs4 from "fs";
-import * as path5 from "path";
-import * as os2 from "os";
+import * as fs5 from "fs";
+import * as path6 from "path";
+import * as os3 from "os";
 import * as crypto2 from "crypto";
 import {
   parse as parseJsonc,
   printParseErrorCode
 } from "jsonc-parser";
+
+// src/mcp-auth.ts
+import * as fs4 from "fs";
+import * as os2 from "os";
+import * as path5 from "path";
+var EXPIRY_SKEW_SECONDS = 30;
+function opencodeStateDir() {
+  const dataHome = process.env.XDG_DATA_HOME || path5.join(os2.homedir(), ".local", "share");
+  return path5.join(dataHome, "opencode");
+}
+function readMcpAuthStore(stateDir) {
+  const file = path5.join(stateDir, "mcp-auth.json");
+  try {
+    const stat = fs4.lstatSync(file);
+    if (!stat.isFile()) {
+      log.debug("ignoring opencode MCP auth store that is not a regular file", { path: file });
+      return {};
+    }
+    if (typeof stat.uid === "number" && typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+      log.debug("ignoring opencode MCP auth store owned by another user", { path: file });
+      return {};
+    }
+    const parsed = JSON.parse(fs4.readFileSync(file, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      log.debug("opencode MCP auth store has an unexpected shape", { path: file });
+      return {};
+    }
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function selectBearerToken(store, serverName, serverUrl, now = Date.now()) {
+  const entry = Object.prototype.hasOwnProperty.call(store, serverName) ? store[serverName] : void 0;
+  if (!entry || typeof entry !== "object") return { token: null, refusal: "no-entry" };
+  if (!entry.serverUrl || entry.serverUrl !== serverUrl) {
+    return { token: null, refusal: "url-mismatch" };
+  }
+  const accessToken = entry.tokens?.accessToken;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    return { token: null, refusal: "no-token" };
+  }
+  const expiresAt = entry.tokens?.expiresAt;
+  if (typeof expiresAt === "number" && expiresAt - now / 1e3 < EXPIRY_SKEW_SECONDS) {
+    return { token: null, refusal: "expired" };
+  }
+  return { token: accessToken, expiresAt: typeof expiresAt === "number" ? expiresAt : void 0 };
+}
+function buildFreshnessKey(expiresAt) {
+  return expiresAt === void 0 ? "no-expiry" : String(expiresAt);
+}
+function hasAuthorizationHeader(headers) {
+  return Object.keys(headers).some((key) => key.toLowerCase() === "authorization");
+}
+function injectBearerHeaders(server2, accessToken) {
+  const existing = server2.headers && typeof server2.headers === "object" && !Array.isArray(server2.headers) ? server2.headers : {};
+  if (hasAuthorizationHeader(existing)) return { ...server2 };
+  return {
+    ...server2,
+    headers: { ...existing, Authorization: `Bearer ${accessToken}` }
+  };
+}
+
+// src/mcp-bridge.ts
 var FILE_NAMES = ["opencode.jsonc", "opencode.json", "config.json"];
 var PROJECT_FILE_NAMES = ["opencode.json", "opencode.jsonc"];
 function fileExists(p) {
   try {
-    return fs4.statSync(p).isFile();
+    return fs5.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function dirExists(p) {
   try {
-    return fs4.statSync(p).isDirectory();
+    return fs5.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function readAndParse(file) {
   try {
-    const raw = fs4.readFileSync(file, "utf8");
+    const raw = fs5.readFileSync(file, "utf8");
     const errors = [];
     const parsed = parseJsonc(raw, errors, { allowTrailingComma: true });
     if (errors.length > 0) {
@@ -3576,14 +3774,14 @@ function deepMerge(target, source) {
 }
 function walkUp(opts) {
   const out = [];
-  let current = path5.resolve(opts.start);
+  let current = path6.resolve(opts.start);
   while (true) {
     for (const target of opts.targets) {
-      const candidate = path5.join(current, target);
+      const candidate = path6.join(current, target);
       if (opts.predicate(candidate)) out.push(candidate);
     }
-    if (opts.stop && current === path5.resolve(opts.stop)) break;
-    const parent = path5.dirname(current);
+    if (opts.stop && current === path6.resolve(opts.stop)) break;
+    const parent = path6.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -3591,28 +3789,28 @@ function walkUp(opts) {
 }
 function detectWorktree(cwd) {
   const override = process.env.OPENCODE_WORKTREE;
-  if (override) return path5.resolve(override);
-  let current = path5.resolve(cwd);
+  if (override) return path6.resolve(override);
+  let current = path6.resolve(cwd);
   while (true) {
-    const gitPath = path5.join(current, ".git");
+    const gitPath = path6.join(current, ".git");
     try {
-      if (fs4.existsSync(gitPath)) return current;
+      if (fs5.existsSync(gitPath)) return current;
     } catch {
     }
-    const parent = path5.dirname(current);
+    const parent = path6.dirname(current);
     if (parent === current) return void 0;
     current = parent;
   }
 }
 function globalConfigDir() {
-  const xdg = process.env.XDG_CONFIG_HOME ?? path5.join(os2.homedir(), ".config");
-  return path5.join(xdg, "opencode");
+  const xdg = process.env.XDG_CONFIG_HOME ?? path6.join(os3.homedir(), ".config");
+  return path6.join(xdg, "opencode");
 }
 function loadGlobalConfig(hostApi = "v1") {
   const dir = globalConfigDir();
   let merged = {};
   for (const name of FILE_NAMES.slice().reverse()) {
-    const file = path5.join(dir, name);
+    const file = path6.join(dir, name);
     if (!fileExists(file)) continue;
     const parsed = readAndParse(file);
     if (parsed) merged = mergeConfigLayer(merged, parsed, hostApi);
@@ -3622,7 +3820,7 @@ function loadGlobalConfig(hostApi = "v1") {
 function loadProjectFilesInDir(dir, hostApi = "v1") {
   let merged = {};
   for (const name of PROJECT_FILE_NAMES) {
-    const file = path5.join(dir, name);
+    const file = path6.join(dir, name);
     if (!fileExists(file)) continue;
     const parsed = readAndParse(file);
     if (parsed) merged = mergeConfigLayer(merged, parsed, hostApi);
@@ -3633,7 +3831,7 @@ function dotOpencodeDirs(cwd, worktree) {
   const dirs = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (p) => {
-    const abs = path5.resolve(p);
+    const abs = path6.resolve(p);
     if (!seen.has(abs) && dirExists(abs)) {
       seen.add(abs);
       dirs.push(abs);
@@ -3647,9 +3845,9 @@ function dotOpencodeDirs(cwd, worktree) {
   })) {
     push(dir);
   }
-  const home = os2.homedir();
+  const home = os3.homedir();
   if (home) {
-    const homeDot = path5.join(home, ".opencode");
+    const homeDot = path6.join(home, ".opencode");
     if (dirExists(homeDot)) push(homeDot);
   }
   const envDir = process.env.OPENCODE_CONFIG_DIR;
@@ -3667,7 +3865,33 @@ function substituteEnvPlaceholders(source) {
   }
   return out;
 }
-function translateServer(name, spec) {
+var warnedExpiredBearer = /* @__PURE__ */ new Set();
+function withBearerToken(name, spec, url, auth) {
+  if (!auth) return spec;
+  const lookup = selectBearerToken(auth.store, name, url);
+  if (lookup.token === null) {
+    if (lookup.refusal === "expired" && !warnedExpiredBearer.has(name)) {
+      warnedExpiredBearer.add(name);
+      log.warn(
+        "opencode's stored OAuth token for this MCP server has expired, so the bridged server carries no credential; re-authenticate it in opencode",
+        { server: name }
+      );
+    } else {
+      log.debug("no opencode OAuth token for bridged MCP server", {
+        server: name,
+        reason: lookup.refusal
+      });
+    }
+    return spec;
+  }
+  log.info("bridged MCP server carries opencode's stored OAuth token", { server: name });
+  return injectBearerHeaders(spec, lookup.token);
+}
+function bearerAuthContext(options) {
+  if (!options?.oauthTokens) return void 0;
+  return { store: readMcpAuthStore(options.stateDir ?? opencodeStateDir()) };
+}
+function translateServer(name, spec, auth) {
   if (spec.enabled === false) return null;
   const type = spec.type;
   if (type === "local") {
@@ -3693,7 +3917,7 @@ function translateServer(name, spec) {
       log.warn("skipping remote MCP server with no url", { name });
       return null;
     }
-    const out = {
+    let out = {
       type: "http",
       url: spec.url
     };
@@ -3702,7 +3926,7 @@ function translateServer(name, spec) {
         spec.headers
       );
     }
-    return out;
+    return withBearerToken(name, out, spec.url, auth);
   }
   log.warn("skipping MCP server with unknown type", {
     name,
@@ -3753,18 +3977,19 @@ function mergeMcp(target, source) {
   return out;
 }
 var MCP_PENDING_STATUS = "pending";
-function bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, hostApi = "v1") {
+function bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, hostApi = "v1", auth) {
   const {
     servers: merged,
     enabledServerNames: allEnabledServerNames,
     hash
-  } = mergeOpencodeMcp(cwd, runtimeStatus, hostApi);
+  } = mergeOpencodeMcp(cwd, runtimeStatus, hostApi, auth);
+  const authContext = bearerAuthContext(auth);
   const servers = {};
   const bridgedServerNames = [];
   for (const [name, spec] of Object.entries(merged)) {
     if (!spec || typeof spec !== "object") continue;
     if (excludeServers?.has(name)) continue;
-    const translated = translateServer(name, spec);
+    const translated = translateServer(name, spec, authContext);
     if (translated) {
       servers[name] = translated;
       bridgedServerNames.push(name);
@@ -3796,7 +4021,7 @@ function opencodeConfigLayers(cwd, hostApi = "v1") {
   const projectDirs = [];
   const seenProjectDirs = /* @__PURE__ */ new Set();
   for (const f of projectFiles) {
-    const d = path5.dirname(f);
+    const d = path6.dirname(f);
     if (!seenProjectDirs.has(d)) {
       seenProjectDirs.add(d);
       projectDirs.push(d);
@@ -3822,7 +4047,7 @@ function loadMergedOpencodeConfig(cwd, hostApi = "v1") {
   for (const layer of opencodeConfigLayers(cwd, hostApi)) merged = mergeConfigLayer(merged, layer, hostApi);
   return merged;
 }
-function mergeOpencodeMcp(cwd, runtimeStatus, hostApi = "v1") {
+function mergeOpencodeMcp(cwd, runtimeStatus, hostApi = "v1", auth) {
   let merged = {};
   for (const layer of opencodeConfigLayers(cwd, hostApi)) {
     const servers = extractMcpBlock(layer);
@@ -3846,7 +4071,19 @@ function mergeOpencodeMcp(cwd, runtimeStatus, hostApi = "v1") {
     enabledServerNames.push(name);
   }
   const mergedBody = JSON.stringify({ mcpServers: merged }, null, 2);
-  const hash = crypto2.createHash("sha256").update(mergedBody).digest("hex").slice(0, 12);
+  const hasher = crypto2.createHash("sha256").update(mergedBody);
+  const authContext = bearerAuthContext(auth);
+  if (authContext) {
+    for (const [name, spec] of Object.entries(merged)) {
+      if (!spec || typeof spec !== "object") continue;
+      const server2 = spec;
+      if (server2.type !== "remote" || typeof server2.url !== "string") continue;
+      const lookup = selectBearerToken(authContext.store, name, server2.url);
+      if (lookup.token === null) continue;
+      hasher.update(`\0bearer:${name}:${buildFreshnessKey(lookup.expiresAt)}`);
+    }
+  }
+  const hash = hasher.digest("hex").slice(0, 12);
   return { servers: merged, enabledServerNames, hash };
 }
 function finishBridge(input) {
@@ -3863,13 +4100,13 @@ function finishBridge(input) {
   }
   const body = JSON.stringify({ mcpServers: servers }, null, 2);
   const bodyDigest = crypto2.createHash("sha256").update(body).digest("hex").slice(0, 12);
-  const outPath = path5.join(
+  const outPath = path6.join(
     pluginTmpDir(),
     `mcp-${bodyDigest}.json`
   );
   try {
     if (!fileExists(outPath)) {
-      fs4.writeFileSync(outPath, body, { encoding: "utf8", mode: 384 });
+      fs5.writeFileSync(outPath, body, { encoding: "utf8", mode: 384 });
     }
   } catch (e) {
     log.warn("failed to write bridged MCP config", {
@@ -4441,7 +4678,7 @@ function forkSiblingSignature(sessionKey2) {
   blanked[3] = "*";
   return blanked.join("::");
 }
-function modelSiblingSignature(sessionKey2) {
+function modelSiblingSignature(sessionKey2, accountProviders) {
   const parts = sessionKey2.split("::");
   if (parts.length < 5) return null;
   if (parts[2] === "compaction") return null;
@@ -4449,7 +4686,8 @@ function modelSiblingSignature(sessionKey2) {
   if (withoutEffort.length < 5) return null;
   const blanked = [...withoutEffort];
   blanked[1] = "*";
-  return blanked.join("::");
+  const signature = blanked.join("::");
+  return accountProviders && accountProviders.size > 0 ? blankAccountProvider(signature, accountProviders) : signature;
 }
 function moveForkFingerprint(fromKey, toKey) {
   const record = fingerprints.get(fromKey);
@@ -4536,17 +4774,17 @@ function tailIsReplyOnly(history, from) {
 }
 
 // src/session-resume-store.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 var MAX_RESUME_RECORDS = 256;
 var RESUME_RECORD_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var records = null;
 var pathOverride = null;
 function resumeStorePath() {
   if (pathOverride) return pathOverride;
-  const stateRoot = process.env.XDG_STATE_HOME || join5(homedir4(), ".local", "state");
-  return join5(stateRoot, "opencode-claude-code-plugin", "claude-sessions.json");
+  const stateRoot = process.env.XDG_STATE_HOME || join6(homedir5(), ".local", "state");
+  return join6(stateRoot, "opencode-claude-code-plugin", "claude-sessions.json");
 }
 function isDigest(value) {
   const entry = value;
@@ -4554,13 +4792,13 @@ function isDigest(value) {
 }
 function isRecord2(value) {
   const record = value;
-  return !!record && typeof record.claudeSessionId === "string" && typeof record.cliPath === "string" && typeof record.updatedAt === "number" && Array.isArray(record.chain) && record.chain.every(isDigest) && (record.shape === void 0 || Array.isArray(record.shape) && record.shape.every(isDigest));
+  return !!record && typeof record.claudeSessionId === "string" && typeof record.cliPath === "string" && typeof record.updatedAt === "number" && Array.isArray(record.chain) && record.chain.every(isDigest) && (record.shape === void 0 || Array.isArray(record.shape) && record.shape.every(isDigest)) && (record.configDir === void 0 || typeof record.configDir === "string") && (record.account === void 0 || typeof record.account === "string");
 }
 function load() {
   if (records) return records;
   records = /* @__PURE__ */ new Map();
   try {
-    const parsed = JSON.parse(readFileSync2(resumeStorePath(), "utf8"));
+    const parsed = JSON.parse(readFileSync3(resumeStorePath(), "utf8"));
     const entries = parsed && typeof parsed === "object" ? parsed.sessions : null;
     if (entries && typeof entries === "object") {
       const cutoff = Date.now() - RESUME_RECORD_MAX_AGE_MS;
@@ -4575,7 +4813,7 @@ function save(update) {
   const file = resumeStorePath();
   const merged = /* @__PURE__ */ new Map();
   try {
-    const onDisk = JSON.parse(readFileSync2(file, "utf8"))?.sessions;
+    const onDisk = JSON.parse(readFileSync3(file, "utf8"))?.sessions;
     if (onDisk && typeof onDisk === "object") {
       for (const [key, record] of Object.entries(onDisk)) {
         if (isRecord2(record)) merged.set(key, record);
@@ -4588,7 +4826,7 @@ function save(update) {
   const kept = [...merged.entries()].filter(([, record]) => record.updatedAt >= cutoff).sort((a, b) => a[1].updatedAt - b[1].updatedAt).slice(-MAX_RESUME_RECORDS);
   records = new Map(kept);
   try {
-    mkdirSync3(join5(file, ".."), { recursive: true, mode: 448 });
+    mkdirSync3(join6(file, ".."), { recursive: true, mode: 448 });
     const tmp = `${file}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify({ version: 1, sessions: Object.fromEntries(kept) }), {
       mode: 384
@@ -4600,17 +4838,27 @@ function save(update) {
     });
   }
 }
-function recordResumePoint(sessionKey2, claudeSessionId, prompt, cliPath) {
+function recordResumePoint(sessionKey2, claudeSessionId, prompt, cliPath, where) {
   const chain = conversationDigests(prompt);
   if (chain.length === 0) return;
   const shape2 = conversationDigests(prompt, { assistantContent: false });
+  const configDir = where?.configDir;
+  const account = where?.account;
   const current = load().get(sessionKey2);
-  if (current && current.claudeSessionId === claudeSessionId && current.cliPath === cliPath && current.shape !== void 0 && current.chain.length === chain.length && current.chain.every((entry, i) => entry.digest === chain[i].digest)) {
+  if (current && current.claudeSessionId === claudeSessionId && current.cliPath === cliPath && current.shape !== void 0 && current.configDir === configDir && current.account === account && current.chain.length === chain.length && current.chain.every((entry, i) => entry.digest === chain[i].digest)) {
     return;
   }
   save((merged) => {
     merged.delete(sessionKey2);
-    merged.set(sessionKey2, { claudeSessionId, cliPath, chain, shape: shape2, updatedAt: Date.now() });
+    merged.set(sessionKey2, {
+      claudeSessionId,
+      cliPath,
+      chain,
+      shape: shape2,
+      ...configDir === void 0 ? {} : { configDir },
+      ...account === void 0 ? {} : { account },
+      updatedAt: Date.now()
+    });
   });
 }
 function forgetResumePoint(sessionKey2) {
@@ -4652,18 +4900,31 @@ function findResumePoint(opts) {
   return { claudeSessionId: record.claudeSessionId, matched: record.chain.length };
 }
 function findSiblingResumePoint(opts) {
-  const signature = modelSiblingSignature(opts.sessionKey);
+  const providers = opts.accountProviders;
+  const signature = modelSiblingSignature(opts.sessionKey, providers);
   if (!signature) {
     opts.onRefused?.("no-sibling-possible");
     return void 0;
   }
+  const ownAccount = providers ? sessionKeyAccount(opts.sessionKey, providers) : void 0;
   let best;
   let bestUpdatedAt = -1;
   let refusal;
   for (const [key, record] of load()) {
     if (key === opts.sessionKey) continue;
-    if (modelSiblingSignature(key) !== signature) continue;
-    if (record.cliPath !== opts.cliPath) {
+    if (modelSiblingSignature(key, providers) !== signature) continue;
+    const siblingAccount = providers ? sessionKeyAccount(key, providers) : void 0;
+    const crossAccount = ownAccount !== void 0 && siblingAccount !== void 0 && siblingAccount !== ownAccount;
+    if (crossAccount) {
+      if (opts.allowAccount && !opts.allowAccount(siblingAccount)) {
+        refusal = "sibling-another-account-group";
+        continue;
+      }
+      if (!record.configDir) {
+        refusal = "sibling-account-dir-unknown";
+        continue;
+      }
+    } else if (record.cliPath !== opts.cliPath) {
       refusal = "sibling-another-claude-binary";
       continue;
     }
@@ -4677,7 +4938,7 @@ function findSiblingResumePoint(opts) {
       refusal = "sibling-still-writing";
       continue;
     }
-    if (!existsSync2(opts.transcriptPath(record.claudeSessionId))) {
+    if (!existsSync2(opts.transcriptPath(record.claudeSessionId, record.configDir))) {
       refusal = "sibling-transcript-gone";
       continue;
     }
@@ -4686,7 +4947,8 @@ function findSiblingResumePoint(opts) {
       best = {
         claudeSessionId: record.claudeSessionId,
         siblingKey: key,
-        matched: record.chain.length
+        matched: record.chain.length,
+        ...crossAccount ? { siblingAccount, siblingConfigDir: record.configDir } : {}
       };
     }
   }
@@ -4697,6 +4959,35 @@ function findSiblingResumePoint(opts) {
   }
   return best;
 }
+function findForeignAccountSibling(opts) {
+  const providers = opts.accountProviders;
+  if (providers.size === 0) return void 0;
+  const signature = modelSiblingSignature(opts.sessionKey, providers);
+  if (!signature) return void 0;
+  const ownAccount = sessionKeyAccount(opts.sessionKey, providers);
+  if (ownAccount === void 0) return void 0;
+  const consider = (key) => {
+    if (key === opts.sessionKey) return void 0;
+    if (modelSiblingSignature(key, providers) !== signature) return void 0;
+    const account = sessionKeyAccount(key, providers);
+    if (account === void 0 || account === ownAccount) return void 0;
+    return { siblingKey: key, account };
+  };
+  for (const key of opts.extraKeys ?? []) {
+    const hit = consider(key);
+    if (hit) return hit;
+  }
+  let found;
+  let foundUpdatedAt = -1;
+  for (const [key, record] of load()) {
+    const hit = consider(key);
+    if (hit && record.updatedAt >= foundUpdatedAt) {
+      found = hit;
+      foundUpdatedAt = record.updatedAt;
+    }
+  }
+  return found;
+}
 
 // src/permission-presets.ts
 var READ_ONLY_DISALLOWED_CLI_TOOLS = [
@@ -5369,6 +5660,9 @@ async function deleteActiveProcessAndWait(key, options = {}) {
 function getClaudeSessionId(key) {
   return claudeSessions.get(key);
 }
+function listClaudeSessionKeys() {
+  return claudeSessions.keys();
+}
 var MAX_CLAUDE_SESSION_ENTRIES = 64;
 function claudeSessionIsBusy(key) {
   if (activeProcesses.has(key)) return true;
@@ -6037,7 +6331,7 @@ async function handleBtwCommand(client, input, options = {}) {
 // src/diagnostic-bundle.ts
 import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
 import { openSync, readSync, closeSync, fstatSync, realpathSync } from "fs";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 
 // src/log-messages.ts
 var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
@@ -6048,6 +6342,8 @@ var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
   "MCP server asked for operator input and was declined: a headless Claude Code session cannot prompt, so its elicitation can only be refused. Run that server's flow in Claude Code directly, or configure it not to elicit.",
   "MCP tool not routed through the proxy: another proxy tool already holds that name, and it keeps it",
   "account failover declined; ending the turn",
+  "accountGroups must be an object mapping an account name to a group name; ignoring it",
+  "accountGroups names an account that is not configured; ignoring it",
   "agent effort override refused: unknown level",
   "agent model override refused: unknown model",
   "agent prompt cache ttl refused: unknown value",
@@ -6133,6 +6429,7 @@ var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
   "no proxyTools entry was recognised; nothing will be proxied this turn",
   "no stdout after envelope write; respawning claude process to resume conversation",
   "opencode 2 event subscription ended; deleted sessions keep their claude process until idle eviction",
+  "opencode's stored OAuth token for this MCP server has expired, so the bridged server carries no credential; re-authenticate it in opencode",
   "pending proxy call arrived after stream close; rejecting",
   'permissionMode "plan" is enforced: claude cannot edit files or run commands, and --dangerously-skip-permissions is deliberately not passed so it stays that way. Headless Claude Code is not offered an ExitPlanMode tool, so nothing releases plan mode mid-session; approving a plan in chat does not unlock writes. Leaving plan mode means changing the config and restarting opencode.',
   `permissionPreset "read-only": this claude CLI has no --permission-prompts (2.1.263+), so permission requests are denied by the plugin's own can_use_tool handler instead of by the CLI. Same outcome, one layer fewer.`,
@@ -6157,6 +6454,7 @@ var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
   "replaying stdout the child emitted between turns",
   "replaying the conversation as text: no claude session was available to continue",
   "replaying this conversation as text on the other account",
+  "replaying this conversation rather than carrying it across accounts",
   "result fallback timer fired \u2014 closing stream without result event",
   "resuming the claude session from before the restart instead of replaying it",
   "shared Claude capability already exists; leaving untouched",
@@ -6164,6 +6462,7 @@ var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
   "skipping local MCP server with no command",
   "skipping remote MCP server with no url",
   "stale scratch directory sweep failed",
+  "starting fresh on this account: it is in another account group",
   "task_batch resolving with child results missing",
   "the interactive transport has not been measured on this Claude Code version; it reads the TUI's screen and transcript, which a new release can change. If a turn hangs or a dialog is not handled, run /claude-code-doctor bundle and report it",
   "the interactive turn did not take a forwarded user message",
@@ -6299,7 +6598,13 @@ var BUNDLE_DATA_ALLOWLIST = {
   // doctor table already prints the same class of value (providers, accounts,
   // proxyTools, MCP servers), so a bundle is no more revealing than the report
   // it is attached to.
+  // An account name and a group name are both operator-chosen labels of the
+  // same class as `accounts`, which the doctor table already prints a column
+  // of; `from` is already here as the account a conversation came from.
+  account: "name",
   accounts: "name",
+  accountGroups: "name",
+  group: "name",
   agent: "name",
   bundled: "name",
   excluded: "name",
@@ -6398,7 +6703,7 @@ function createIdHasher(salt = randomBytes2(16).toString("hex")) {
   return (raw) => createHash4("sha256").update(salt).update("\0").update(raw).digest("hex").slice(0, 8);
 }
 function createRedactionContext(options = {}) {
-  const home = options.home ?? homedir5();
+  const home = options.home ?? homedir6();
   const homes = /* @__PURE__ */ new Set();
   if (home) homes.add(home);
   if (home) {
@@ -6583,8 +6888,8 @@ function redactLogLine(raw, context) {
   if (!parsed.data || Object.keys(parsed.data).length === 0) return head;
   return `${head} ${JSON.stringify(sanitizeLogData(parsed.data, context))}`;
 }
-function readLogTail(path14, maxBytes = BUNDLE_TAIL_BYTES) {
-  const fd = openSync(path14, "r");
+function readLogTail(path15, maxBytes = BUNDLE_TAIL_BYTES) {
+  const fd = openSync(path15, "r");
   try {
     const size = fstatSync(fd).size;
     const length = Math.min(size, maxBytes);
@@ -6789,14 +7094,14 @@ async function fetchPlanUsage(cliPath, options = {}) {
 }
 
 // src/stale-build.ts
-import * as fs6 from "fs";
-import * as path7 from "path";
+import * as fs7 from "fs";
+import * as path8 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/startup-diagnostics.ts
 import { execFile as execFile3 } from "child_process";
-import * as fs5 from "fs";
-import * as path6 from "path";
+import * as fs6 from "fs";
+import * as path7 from "path";
 import { promisify as promisify2 } from "util";
 import { fileURLToPath } from "url";
 
@@ -6831,8 +7136,8 @@ var cachedPluginVersion;
 function pluginVersion() {
   if (cachedPluginVersion) return cachedPluginVersion;
   try {
-    const here = path6.dirname(fileURLToPath(import.meta.url));
-    const raw = fs5.readFileSync(path6.join(here, "..", "package.json"), "utf8");
+    const here = path7.dirname(fileURLToPath(import.meta.url));
+    const raw = fs6.readFileSync(path7.join(here, "..", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     cachedPluginVersion = typeof version === "string" ? version : "unknown";
   } catch {
@@ -6856,7 +7161,7 @@ var opencodeVersionProbe;
 function detectOpencodeVersion(execPath = process.execPath) {
   if (opencodeVersionProbe) return opencodeVersionProbe;
   opencodeVersionProbe = (async () => {
-    if (!path6.basename(execPath).toLowerCase().includes("opencode")) {
+    if (!path7.basename(execPath).toLowerCase().includes("opencode")) {
       log.debug("skipping opencode version probe: execPath is not opencode", { execPath });
       return void 0;
     }
@@ -6925,6 +7230,15 @@ function collectStartupDiagnostics(providers, opencodeVersion) {
     cwd,
     providers: Object.keys(providers),
     accounts,
+    // One guard per install, so the first provider that declares one answers
+    // for all of them; it is validated against the accounts the expansion
+    // produced, which is the same list every provider carries.
+    accountGroups: describeAccountGroups(
+      resolveAccountGroups(
+        firstOption(providers, "accountGroups"),
+        stringList(firstOption(providers, "failoverAccounts"))
+      )
+    ),
     proxyTools: stringList(firstOption(providers, "proxyTools")),
     mcpServers,
     permissionPresets: Object.entries(providers).map(
@@ -7085,10 +7399,10 @@ function defaultEntryPath() {
 }
 function readOnDiskBuild(entryPath) {
   try {
-    const raw = fs6.readFileSync(path7.join(path7.dirname(entryPath), "..", "package.json"), "utf8");
+    const raw = fs7.readFileSync(path8.join(path8.dirname(entryPath), "..", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     if (typeof version !== "string" || version.length === 0) return void 0;
-    const stat = fs6.statSync(entryPath);
+    const stat = fs7.statSync(entryPath);
     return { version, mtimeMs: stat.mtimeMs, size: stat.size };
   } catch {
     return void 0;
@@ -7099,7 +7413,7 @@ function recordLoadedBuild() {
   let mtimeMs;
   let size;
   try {
-    const stat = fs6.statSync(entryPath);
+    const stat = fs7.statSync(entryPath);
     mtimeMs = stat.mtimeMs;
     size = stat.size;
   } catch {
@@ -7197,6 +7511,9 @@ function formatDoctorReport(report) {
   lines.push(`| cwd | \`${report.cwd.resolved}\` (${report.cwd.source}) |`);
   lines.push(`| providers | ${list(report.providers)} |`);
   lines.push(`| accounts | ${list(report.accounts)} |`);
+  lines.push(
+    `| accountGroups | ${report.accountGroups.length > 0 ? list(report.accountGroups) : "none (every account is one group)"} |`
+  );
   lines.push(`| proxyTools | ${list(report.proxyTools)} |`);
   lines.push(`| MCP servers (on disk) | ${list(report.mcpServers)} |`);
   lines.push(`| permissionPreset | ${describePermissionPresets(report.permissionPresets)} |`);
@@ -7450,6 +7767,7 @@ async function gatherDoctorReport(options) {
     cwd: base.cwd,
     providers: base.providers,
     accounts: base.accounts,
+    accountGroups: base.accountGroups,
     proxyTools: base.proxyTools,
     mcpServers: base.mcpServers,
     permissionPresets: base.permissionPresets,
@@ -7537,7 +7855,7 @@ Could not build the report: ${message}`;
 
 // src/agent-models.ts
 import { readFile, readdir } from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 
 // src/models.ts
 var PROVIDER_ID = "claude-code";
@@ -8103,13 +8421,13 @@ async function readAgentMarkdownRecords(directories) {
       const name = entry.slice(0, -3);
       if (records2[name]) continue;
       try {
-        const text = await readFile(path8.join(directory, entry), "utf8");
+        const text = await readFile(path9.join(directory, entry), "utf8");
         records2[name] = parseAgentFrontmatter(text);
         const prompt = agentMarkdownBody(text);
         if (prompt) records2[name].prompt = prompt;
       } catch (err) {
         log.debug("failed to read agent markdown", {
-          file: path8.join(directory, entry),
+          file: path9.join(directory, entry),
           error: String(err)
         });
       }
@@ -8121,12 +8439,12 @@ function agentDirectories(home, projectDirectory) {
   const directories = [];
   if (projectDirectory) {
     for (const name of AGENT_DIR_NAMES) {
-      directories.push(path8.join(projectDirectory, ".opencode", name));
+      directories.push(path9.join(projectDirectory, ".opencode", name));
     }
   }
   if (home) {
     for (const name of AGENT_DIR_NAMES) {
-      directories.push(path8.join(home, ".config", "opencode", name));
+      directories.push(path9.join(home, ".config", "opencode", name));
     }
   }
   return directories;
@@ -8294,6 +8612,7 @@ var PLUGIN_NOTE_MARKERS = [
   SILENT_TURN_MARKER,
   FAILOVER_MARKER,
   ACCOUNT_BLOCK_MARKER,
+  ACCOUNT_GROUP_MARKER,
   USAGE_LIMIT_MARKER,
   MODEL_FALLBACK_MARKER,
   UNATTENDED_REPLAY_MARKER,
@@ -8442,6 +8761,17 @@ function clipWithMarker(text, max) {
   return `${text.slice(0, max)}
 \u2026[truncated ${text.length - max} chars]`;
 }
+var MAX_REPLAY_MESSAGE_CHARS = 2e3;
+var MAX_REPLAY_LAST_REPLY_CHARS = 12e3;
+var MAX_REPLAY_HEAD_CHARS = 1e3;
+function clipMiddle(text, max) {
+  if (text.length <= max) return text;
+  const head = Math.min(Math.floor(max / 4), MAX_REPLAY_HEAD_CHARS);
+  const tail = max - head;
+  return `${text.slice(0, head)}
+\u2026[${text.length - max} chars omitted]\u2026
+${text.slice(-tail)}`;
+}
 function renderToolInput(input) {
   let raw;
   try {
@@ -8510,13 +8840,20 @@ function compactConversationHistory(prompt, opts = {}) {
     return null;
   }
   const historyParts = [];
+  let lastAssistant = -1;
+  for (let i = conversationMessages.length - 2; i >= 0; i--) {
+    if (conversationMessages[i].role === "assistant") {
+      lastAssistant = i;
+      break;
+    }
+  }
   for (let i = 0; i < conversationMessages.length - 1; i++) {
     const msg = conversationMessages[i];
     const role = msg.role === "user" ? "User" : msg.role === "assistant" ? "Assistant" : "Tool";
     const { text } = renderMessageContentForCompaction(msg);
     if (text.trim()) {
-      const truncated = text.length > 2e3 ? text.slice(0, 2e3) + "..." : text;
-      historyParts.push(`${role}: ${truncated}`);
+      const max = i === lastAssistant ? MAX_REPLAY_LAST_REPLY_CHARS : MAX_REPLAY_MESSAGE_CHARS;
+      historyParts.push(`${role}: ${clipMiddle(text, max)}`);
     }
   }
   if (historyParts.length === 0) {
@@ -8726,14 +9063,14 @@ function getTrailingUserMessages(prompt, opts = {}) {
 
 // src/skill-bridge.ts
 import * as crypto3 from "crypto";
-import * as fs7 from "fs";
-import * as os3 from "os";
-import * as path9 from "path";
+import * as fs8 from "fs";
+import * as os4 from "os";
+import * as path10 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function bundledSkillsDir() {
   try {
     const here = fileURLToPath3(import.meta.url);
-    const dir = path9.resolve(path9.dirname(here), "..", "skills");
+    const dir = path10.resolve(path10.dirname(here), "..", "skills");
     return dirExists2(dir) ? dir : null;
   } catch {
     return null;
@@ -8741,16 +9078,16 @@ function bundledSkillsDir() {
 }
 function dirExists2(p) {
   try {
-    return fs7.statSync(p).isDirectory();
+    return fs8.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function realPath(p) {
   try {
-    return fs7.realpathSync(p);
+    return fs8.realpathSync(p);
   } catch {
-    return path9.resolve(p);
+    return path10.resolve(p);
   }
 }
 function envEnabled(name) {
@@ -8771,10 +9108,10 @@ function declaredSkillName(source) {
   return SAFE_SKILL_NAME.test(name) ? name : null;
 }
 function readSkill(root, entry) {
-  const dir = path9.join(root, entry);
+  const dir = path10.join(root, entry);
   let source;
   try {
-    source = fs7.readFileSync(path9.join(dir, "SKILL.md"), "utf8");
+    source = fs8.readFileSync(path10.join(dir, "SKILL.md"), "utf8");
   } catch {
     return null;
   }
@@ -8792,47 +9129,47 @@ function skillRoots(cwd) {
   const roots = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (p) => {
-    const abs = path9.resolve(p);
+    const abs = path10.resolve(p);
     if (seen.has(abs)) return;
     seen.add(abs);
     if (dirExists2(abs)) roots.push(abs);
   };
-  const home = os3.homedir();
-  const homeDir = home ? path9.resolve(home) : null;
-  let current = path9.resolve(cwd);
+  const home = os4.homedir();
+  const homeDir = home ? path10.resolve(home) : null;
+  let current = path10.resolve(cwd);
   while (true) {
-    push(path9.join(current, ".opencode", "skills"));
+    push(path10.join(current, ".opencode", "skills"));
     if (current !== homeDir) {
-      push(path9.join(current, ".claude", "skills"));
-      push(path9.join(current, ".agents", "skills"));
+      push(path10.join(current, ".claude", "skills"));
+      push(path10.join(current, ".agents", "skills"));
     }
-    const parent = path9.dirname(current);
+    const parent = path10.dirname(current);
     if (parent === current) break;
     current = parent;
   }
-  if (homeDir) push(path9.join(homeDir, ".opencode", "skills"));
+  if (homeDir) push(path10.join(homeDir, ".opencode", "skills"));
   const envDir = process.env.OPENCODE_CONFIG_DIR;
   if (envDir) {
-    push(path9.join(envDir, "skills"));
-    push(path9.join(envDir, "skill"));
+    push(path10.join(envDir, "skills"));
+    push(path10.join(envDir, "skill"));
   }
-  const xdg = process.env.XDG_CONFIG_HOME ?? (homeDir ? path9.join(homeDir, ".config") : null);
+  const xdg = process.env.XDG_CONFIG_HOME ?? (homeDir ? path10.join(homeDir, ".config") : null);
   if (xdg) {
-    push(path9.join(xdg, "opencode", "skills"));
-    push(path9.join(xdg, "opencode", "skill"));
+    push(path10.join(xdg, "opencode", "skills"));
+    push(path10.join(xdg, "opencode", "skill"));
   }
   if (homeDir && !envEnabled("OPENCODE_DISABLE_EXTERNAL_SKILLS")) {
     if (!envEnabled("OPENCODE_DISABLE_CLAUDE_CODE_SKILLS")) {
-      push(path9.join(homeDir, ".claude", "skills"));
+      push(path10.join(homeDir, ".claude", "skills"));
     }
-    push(path9.join(homeDir, ".agents", "skills"));
+    push(path10.join(homeDir, ".agents", "skills"));
   }
   return roots;
 }
 function collectSkills(root, claimed, found) {
   let entries;
   try {
-    entries = fs7.readdirSync(root, { withFileTypes: true });
+    entries = fs8.readdirSync(root, { withFileTypes: true });
   } catch {
     return;
   }
@@ -8872,23 +9209,23 @@ function discoverBundledSkills() {
 }
 function claudeConfigDir(configDir) {
   const explicit = configDir ?? process.env.CLAUDE_CONFIG_DIR;
-  if (explicit) return path9.resolve(expandHome(explicit));
-  const home = os3.homedir();
-  return home ? path9.resolve(home, ".claude") : null;
+  if (explicit) return path10.resolve(expandHome(explicit));
+  const home = os4.homedir();
+  return home ? path10.resolve(home, ".claude") : null;
 }
 function installedPluginSkillRoots(configDir, cwd) {
   if (!configDir) return [];
   let parsed;
   try {
     parsed = JSON.parse(
-      fs7.readFileSync(path9.join(configDir, "plugins", "installed_plugins.json"), "utf8")
+      fs8.readFileSync(path10.join(configDir, "plugins", "installed_plugins.json"), "utf8")
     );
   } catch {
     return [];
   }
   const plugins = parsed?.plugins;
   if (!plugins || typeof plugins !== "object") return [];
-  const workspace = path9.resolve(cwd);
+  const workspace = path10.resolve(cwd);
   const roots = [];
   for (const installs of Object.values(plugins)) {
     if (!Array.isArray(installs)) continue;
@@ -8896,28 +9233,28 @@ function installedPluginSkillRoots(configDir, cwd) {
       const entry = install;
       if (typeof entry?.installPath !== "string" || !entry.installPath) continue;
       if (entry.scope !== "user" && !coversWorkspace(entry.projectPath, workspace)) continue;
-      roots.push(path9.join(entry.installPath, "skills"));
+      roots.push(path10.join(entry.installPath, "skills"));
     }
   }
   return roots;
 }
 function coversWorkspace(projectPath, workspace) {
   if (typeof projectPath !== "string" || !projectPath) return false;
-  const root = path9.resolve(projectPath);
+  const root = path10.resolve(projectPath);
   if (root === workspace) return true;
-  const rel = path9.relative(root, workspace);
-  return rel !== "" && !rel.startsWith("..") && !path9.isAbsolute(rel);
+  const rel = path10.relative(root, workspace);
+  return rel !== "" && !rel.startsWith("..") && !path10.isAbsolute(rel);
 }
 function discoverNativeClaudeSkills(opts) {
   const found = [];
   const scanned = /* @__PURE__ */ new Set();
   const scan = (root, scope) => {
-    const abs = path9.resolve(root);
+    const abs = path10.resolve(root);
     if (scanned.has(abs)) return;
     scanned.add(abs);
     let entries;
     try {
-      entries = fs7.readdirSync(abs, { withFileTypes: true });
+      entries = fs8.readdirSync(abs, { withFileTypes: true });
     } catch {
       return;
     }
@@ -8929,13 +9266,13 @@ function discoverNativeClaudeSkills(opts) {
     }
   };
   const configDir = claudeConfigDir(opts.configDir);
-  if (configDir) scan(path9.join(configDir, "skills"), "user");
-  const home = os3.homedir();
-  const homeDir = home ? path9.resolve(home) : null;
-  let current = path9.resolve(opts.cwd);
+  if (configDir) scan(path10.join(configDir, "skills"), "user");
+  const home = os4.homedir();
+  const homeDir = home ? path10.resolve(home) : null;
+  let current = path10.resolve(opts.cwd);
   while (true) {
-    if (current !== homeDir) scan(path9.join(current, ".claude", "skills"), "project");
-    const parent = path9.dirname(current);
+    if (current !== homeDir) scan(path10.join(current, ".claude", "skills"), "project");
+    const parent = path10.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -8969,10 +9306,10 @@ function dropNativelyLoadedSkills(skills, native) {
 }
 function readBundledSkillInfos() {
   return discoverBundledSkills().flatMap((skill) => {
-    const file = path9.join(skill.dir, "SKILL.md");
+    const file = path10.join(skill.dir, "SKILL.md");
     let text;
     try {
-      text = fs7.readFileSync(file, "utf8");
+      text = fs8.readFileSync(file, "utf8");
     } catch {
       return [];
     }
@@ -8996,15 +9333,15 @@ function readBundledSkillInfos() {
 }
 function linkSkill(source, target) {
   try {
-    fs7.symlinkSync(source, target, process.platform === "win32" ? "junction" : "dir");
+    fs8.symlinkSync(source, target, process.platform === "win32" ? "junction" : "dir");
     return;
   } catch {
-    fs7.cpSync(source, target, { recursive: true, dereference: true });
+    fs8.cpSync(source, target, { recursive: true, dereference: true });
   }
 }
 function fileExists2(p) {
   try {
-    return fs7.statSync(p).isFile();
+    return fs8.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -9013,14 +9350,14 @@ function buildSkillPluginDir(skills) {
   if (skills.length === 0) return null;
   const fingerprint = skills.map((s) => `${s.name}\0${s.dir}`).join("\n");
   const hash = crypto3.createHash("sha256").update(fingerprint).digest("hex").slice(0, 12);
-  const root = path9.join(pluginTmpDir(), `skills-${hash}`);
-  const manifest = path9.join(root, ".claude-plugin", "plugin.json");
+  const root = path10.join(pluginTmpDir(), `skills-${hash}`);
+  const manifest = path10.join(root, ".claude-plugin", "plugin.json");
   if (fileExists2(manifest)) return root;
   try {
-    fs7.rmSync(root, { recursive: true, force: true });
-    fs7.mkdirSync(path9.join(root, ".claude-plugin"), { recursive: true });
-    fs7.mkdirSync(path9.join(root, "skills"), { recursive: true });
-    fs7.writeFileSync(
+    fs8.rmSync(root, { recursive: true, force: true });
+    fs8.mkdirSync(path10.join(root, ".claude-plugin"), { recursive: true });
+    fs8.mkdirSync(path10.join(root, "skills"), { recursive: true });
+    fs8.writeFileSync(
       manifest,
       JSON.stringify(
         {
@@ -9033,7 +9370,7 @@ function buildSkillPluginDir(skills) {
       { encoding: "utf8", mode: 384 }
     );
     for (const skill of skills) {
-      linkSkill(skill.dir, path9.join(root, "skills", skill.name));
+      linkSkill(skill.dir, path10.join(root, "skills", skill.name));
     }
   } catch (err) {
     log.warn("failed to stage opencode skill plugin dir", {
@@ -9049,7 +9386,7 @@ function registerBundledSkillPath(config) {
   if (!dir) return false;
   config.skills ??= {};
   const paths = config.skills.paths ??= [];
-  if (paths.some((p) => path9.resolve(p) === dir)) return false;
+  if (paths.some((p) => path10.resolve(p) === dir)) return false;
   paths.push(dir);
   return true;
 }
@@ -9099,36 +9436,36 @@ import { EventEmitter as EventEmitter4 } from "events";
 import { randomUUID as randomUUID5 } from "crypto";
 import { existsSync as existsSync4, writeFileSync as writeFileSync5 } from "fs";
 import { unlink as unlink2 } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/claude-session-bun.ts
-import * as os4 from "os";
-import * as fs8 from "fs";
-import * as path10 from "path";
+import * as os5 from "os";
+import * as fs9 from "fs";
+import * as path11 from "path";
 import { execFileSync } from "child_process";
 import { randomUUID as randomUUID4 } from "crypto";
 import { StringDecoder } from "string_decoder";
 function resolveClaude(cmd = "claude") {
-  if (path10.isAbsolute(cmd) && fs8.existsSync(cmd)) return cmd;
+  if (path11.isAbsolute(cmd) && fs9.existsSync(cmd)) return cmd;
   const viaBun = Bun.which(cmd);
   if (viaBun) return viaBun;
-  const isWin = os4.platform() === "win32";
+  const isWin = os5.platform() === "win32";
   try {
     const out = execFileSync(isWin ? "where" : "which", [cmd], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
-    const first = out.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).find((p) => fs8.existsSync(p));
+    const first = out.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).find((p) => fs9.existsSync(p));
     if (first) return first;
   } catch {
   }
   throw new Error(`Could not resolve command on PATH: ${cmd}`);
 }
 function encodeCwd(cwd) {
-  const resolved = path10.resolve(cwd);
+  const resolved = path11.resolve(cwd);
   let real = resolved;
   try {
-    real = fs8.realpathSync.native(resolved);
+    real = fs9.realpathSync.native(resolved);
   } catch {
   }
   return real.replace(/[^a-zA-Z0-9]/g, "-");
@@ -9136,7 +9473,7 @@ function encodeCwd(cwd) {
 var bunPtySpawner = (argv, opts) => {
   const [command, ...args] = argv;
   const resolved = resolveClaude(command ?? "claude");
-  if (os4.platform() === "win32" && isBatchFile(resolved)) {
+  if (os5.platform() === "win32" && isBatchFile(resolved)) {
     throw new Error(
       `The interactive transport cannot run a Windows batch shim (${resolved}). Point \`cliPath\` at claude.exe, or use the default headless transport.`
     );
@@ -9244,10 +9581,10 @@ function classifyScreen(text) {
   return null;
 }
 function interactiveTranscriptPath(opts) {
-  return path10.join(
+  return path11.join(
     resolveConfigDir(opts.configDir),
     "projects",
-    encodeCwd(path10.resolve(opts.cwd)),
+    encodeCwd(path11.resolve(opts.cwd)),
     `${opts.sessionId}.jsonl`
   );
 }
@@ -9425,7 +9762,7 @@ var TranscriptCursor = class {
     const filePath = this.resolvePath();
     let stat;
     try {
-      stat = fs8.statSync(filePath);
+      stat = fs9.statSync(filePath);
     } catch {
       return;
     }
@@ -9441,13 +9778,13 @@ var TranscriptCursor = class {
     if (stat.size <= this.offset) return;
     let fd = null;
     try {
-      fd = fs8.openSync(filePath, "r");
+      fd = fs9.openSync(filePath, "r");
       const buffer = Buffer.allocUnsafe(
         Math.min(TRANSCRIPT_CHUNK_BYTES, stat.size - this.offset)
       );
       while (this.offset < stat.size) {
         const want = Math.min(buffer.length, stat.size - this.offset);
-        const read = fs8.readSync(fd, buffer, 0, want, this.offset);
+        const read = fs9.readSync(fd, buffer, 0, want, this.offset);
         this.stats.reads++;
         if (read <= 0) break;
         this.offset += read;
@@ -9458,7 +9795,7 @@ var TranscriptCursor = class {
     } finally {
       if (fd !== null) {
         try {
-          fs8.closeSync(fd);
+          fs9.closeSync(fd);
         } catch {
         }
       }
@@ -9488,12 +9825,12 @@ function isOwnPromptRecord(rec, normalized) {
 }
 function resolveConfigDir(configDir) {
   const value = configDir ?? process.env.CLAUDE_CONFIG_DIR;
-  if (!value) return path10.join(os4.homedir(), ".claude");
-  if (value === "~") return os4.homedir();
+  if (!value) return path11.join(os5.homedir(), ".claude");
+  if (value === "~") return os5.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\")) {
-    return path10.join(os4.homedir(), value.slice(2));
+    return path11.join(os5.homedir(), value.slice(2));
   }
-  return path10.resolve(value);
+  return path11.resolve(value);
 }
 function fatalScreenMessage(kind, configDir, cwd) {
   if (kind === "trust") {
@@ -9557,7 +9894,7 @@ var ClaudeSession = class {
   abandonTurn = false;
   o;
   constructor(opts = {}) {
-    this.cwd = path10.resolve(opts.cwd ?? process.cwd());
+    this.cwd = path11.resolve(opts.cwd ?? process.cwd());
     this.configDir = resolveConfigDir(opts.configDir);
     this.explicitConfigDir = opts.configDir ? this.configDir : void 0;
     this.signal = opts.signal;
@@ -9569,7 +9906,7 @@ var ClaudeSession = class {
     this.onExit = opts.onExit;
     this.spawnPty = opts.spawnPty ?? bunPtySpawner;
     this.sessionId = opts.resumeSessionId ?? randomUUID4();
-    this.jsonlPath = path10.join(
+    this.jsonlPath = path11.join(
       this.configDir,
       "projects",
       encodeCwd(this.cwd),
@@ -10280,7 +10617,7 @@ ${text2}`
 }
 function stageImage(data, extension) {
   try {
-    const file = join10(pluginTmpDir(), `attachment-${randomUUID5()}.${extension}`);
+    const file = join11(pluginTmpDir(), `attachment-${randomUUID5()}.${extension}`);
     writeFileSync5(file, data, { mode: 384, flag: "wx" });
     return file;
   } catch (err) {
@@ -10765,7 +11102,7 @@ function spawnInteractiveProcess(opts) {
 import { randomUUID as randomUUID6 } from "crypto";
 import { constants as fsConstants } from "fs";
 import { chmod as chmod2, copyFile as copyFile2, lstat as lstat2, mkdir as mkdir2 } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 var transcriptPath = interactiveTranscriptPath;
 function configDirForAccount(account) {
   const normalized = normalizeAccountName(account || DEFAULT_ACCOUNT);
@@ -10793,7 +11130,7 @@ async function carryTranscriptToAccount(input) {
   const carriedId = renamed ? (input.newSessionId ?? randomUUID6)() : sessionId;
   const target = renamed ? transcriptPath({ configDir: targetConfigDir, cwd, sessionId: carriedId }) : targetOwn;
   try {
-    await mkdir2(path11.dirname(target), { recursive: true, mode: 448 });
+    await mkdir2(path12.dirname(target), { recursive: true, mode: 448 });
     await copyFile2(live.file, target, fsConstants.COPYFILE_EXCL);
     await chmod2(target, 384);
   } catch (err) {
@@ -10813,7 +11150,7 @@ function dedupe2(dirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of dirs) {
-    const resolved = path11.resolve(dir);
+    const resolved = path12.resolve(dir);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
     out.push(resolved);
@@ -10822,13 +11159,13 @@ function dedupe2(dirs) {
 }
 
 // src/prompts.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir8 } from "os";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir9 } from "os";
 import { randomUUID as randomUUID7 } from "crypto";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute3, join as join11 } from "path";
-function readPromptFileIfPresent(path14) {
+import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute3, join as join12 } from "path";
+function readPromptFileIfPresent(path15) {
   try {
-    const content = readFileSync6(path14, "utf8").trim();
+    const content = readFileSync7(path15, "utf8").trim();
     return content || void 0;
   } catch {
     return void 0;
@@ -10837,7 +11174,7 @@ function readPromptFileIfPresent(path14) {
 function nearestWorkspaceAgentsPrompt(cwd) {
   let dir = cwd;
   while (true) {
-    const content = readPromptFileIfPresent(join11(dir, "AGENTS.md"));
+    const content = readPromptFileIfPresent(join12(dir, "AGENTS.md"));
     if (content) return content;
     const parent = dirname6(dir);
     if (parent === dir) return void 0;
@@ -10933,9 +11270,9 @@ function extractSystemMessages(prompt) {
 }
 var CLAUDE_NATIVE_INSTRUCTION_FILES = /* @__PURE__ */ new Set(["CLAUDE.md", "CLAUDE.local.md"]);
 function userAuthoredInstructions(forwarded, opts = {}) {
-  const readFile2 = opts.readFile ?? ((path14) => {
+  const readFile2 = opts.readFile ?? ((path15) => {
     try {
-      return readFileSync6(path14, "utf8");
+      return readFileSync7(path15, "utf8");
     } catch {
       return null;
     }
@@ -10947,16 +11284,16 @@ function userAuthoredInstructions(forwarded, opts = {}) {
   }
   const seen = /* @__PURE__ */ new Set();
   for (const match of forwarded.matchAll(/^Instructions from: (.+)$/gm)) {
-    const path14 = match[1].trim();
-    if (seen.has(path14) || !isAbsolute3(path14)) continue;
-    if (CLAUDE_NATIVE_INSTRUCTION_FILES.has(basename2(path14))) continue;
-    seen.add(path14);
-    const file = readFile2(path14);
+    const path15 = match[1].trim();
+    if (seen.has(path15) || !isAbsolute3(path15)) continue;
+    if (CLAUDE_NATIVE_INSTRUCTION_FILES.has(basename2(path15))) continue;
+    seen.add(path15);
+    const file = readFile2(path15);
     if (!file?.trim()) continue;
     const start = match.index + match[0].length + 1;
     const content = forwarded.startsWith(file, start) ? file : forwarded.startsWith(file.trimEnd(), start) ? file.trimEnd() : null;
     if (content === null) continue;
-    out.push({ text: `Instructions from: ${path14}
+    out.push({ text: `Instructions from: ${path15}
 ${content}`, content });
   }
   return out;
@@ -10976,8 +11313,8 @@ ${options.compressionSummary.trim()}`
   for (const s of extraSystemContent) {
     if (s.trim()) parts.push(s.trim());
   }
-  const configRoot = process.env.XDG_CONFIG_HOME ?? join11(homedir8(), ".config");
-  const globalAgents = readPromptFileIfPresent(join11(configRoot, "opencode", "AGENTS.md"));
+  const configRoot = process.env.XDG_CONFIG_HOME ?? join12(homedir9(), ".config");
+  const globalAgents = readPromptFileIfPresent(join12(configRoot, "opencode", "AGENTS.md"));
   const workspaceAgents = nearestWorkspaceAgentsPrompt(cwd);
   const forwarded = extraSystemContent.join("\n\n");
   const pushGlobal = !!globalAgents && !forwarded.includes(globalAgents);
@@ -10993,10 +11330,10 @@ ${options.compressionSummary.trim()}`
   if (includeMultiStepHint) parts.push(MULTI_STEP_TASK_HINT);
   const content = parts.join("\n\n");
   if (!content) return void 0;
-  const path14 = join11(pluginTmpDir(), `opencode-cc-sys-${randomUUID7()}.md`);
+  const path15 = join12(pluginTmpDir(), `opencode-cc-sys-${randomUUID7()}.md`);
   try {
-    writeFileSync6(path14, content, { encoding: "utf8", mode: 384 });
-    return path14;
+    writeFileSync6(path15, content, { encoding: "utf8", mode: 384 });
+    return path15;
   } catch (err) {
     log.warn("failed to write system prompt file", { error: String(err) });
     return void 0;
@@ -11423,7 +11760,9 @@ function effectiveMcpConfig(config, cwd, proxyConfigPath, runtimeStatus, exclude
   let bridgedHash = null;
   let allEnabledServerNames = [];
   if (config.bridgeOpencodeMcp !== false) {
-    const bridged = bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, config.hostApi);
+    const bridged = bridgeOpencodeMcp(cwd, runtimeStatus, excludeServers, config.hostApi, {
+      oauthTokens: config.bridgeMcpOauthTokens === true
+    });
     if (bridged) {
       if (bridged.path) paths.push(bridged.path);
       bridgedHash = bridged.hash;
@@ -13806,6 +14145,8 @@ var ClaudeCodeLanguageModel = class {
     const sourceAccount = normalizeAccountName(
       this.config.account ?? DEFAULT_ACCOUNT
     );
+    const accountProviders = accountProviderMap(this.config.failoverAccounts);
+    const groups = this.config.accountGroups ?? null;
     const baseCliPath = this.config.baseCliPath ?? this.config.cliPath;
     let failover = compactionMode ? { cliPath: this.config.cliPath, modelId: effectiveModelId, failedOver: false } : await resolveFailoverSpawn({
       account: sourceAccount,
@@ -13967,7 +14308,11 @@ var ClaudeCodeLanguageModel = class {
     }
     const failoverAnswer = compactionMode || mode === "generate" ? null : consumeAccountFailoverAnswer(sk, options.prompt, {
       sourceAccount,
-      candidates: failoverCandidates(this.config.failoverAccounts, sourceAccount)
+      candidates: failoverCandidates(
+        this.config.failoverAccounts,
+        sourceAccount,
+        groups
+      )
     });
     if (failoverAnswer?.kind === "stop") {
       log.warn("account failover declined; ending the turn", {
@@ -14049,8 +14394,13 @@ var ClaudeCodeLanguageModel = class {
         // Every account's own directory, plus this model's configured one:
         // `configDir` is an option, so an account's directory is not always
         // the `~/.claude-<name>` the name alone would build.
+        // Same-group accounts only (h #g226): a transcript sitting in an
+        // account from another group is not a source this may read from, and
+        // with no groups configured this is the full list exactly as before.
         accountConfigDirs: [
-          ...(this.config.failoverAccounts ?? []).map(configDirForAccount),
+          ...accountsInGroupOf(sourceAccount, this.config.failoverAccounts, groups).map(
+            configDirForAccount
+          ),
           resolveConfigDir(this.config.configDir)
         ]
       });
@@ -14084,6 +14434,32 @@ var ClaudeCodeLanguageModel = class {
     if (failoverAnswer?.kind === "switch" && hasPriorConversation && !conversationOnTarget) {
       includeHistoryContext = true;
     }
+    let accountGroupNote = null;
+    if (!compactionMode && groups && accountProviders.size > 0 && includeHistoryContext && failoverAnswer?.kind !== "switch") {
+      const foreign = findForeignAccountSibling({
+        sessionKey: sk,
+        accountProviders,
+        // The live process's own view, so the guard holds with
+        // `resumeAfterRestart: false`, where the store is never written.
+        extraKeys: listClaudeSessionKeys()
+      });
+      if (foreign && !accountsShareGroup(sourceAccount, foreign.account, groups)) {
+        includeHistoryContext = false;
+        accountGroupNote = formatAccountGroupNote({
+          sourceAccount: foreign.account,
+          sourceGroup: accountGroup(foreign.account, groups),
+          targetAccount: sourceAccount,
+          targetGroup: accountGroup(sourceAccount, groups)
+        });
+        log.notice("starting fresh on this account: it is in another account group", {
+          sessionKey: sk,
+          reason: "another-account-group",
+          account: sourceAccount,
+          from: foreign.account,
+          group: accountGroup(sourceAccount, groups)
+        });
+      }
+    }
     let forkFromClaudeSessionId;
     if (this.config.forkSessions === true && includeHistoryContext && !compactionMode && failoverAnswer?.kind !== "switch") {
       const parent = findForkParent({
@@ -14127,7 +14503,7 @@ var ClaudeCodeLanguageModel = class {
     let replayReason = "no-session-for-key";
     if (this.config.resumeAfterRestart !== false && includeHistoryContext && !compactionMode && !forkFromClaudeSessionId && failoverAnswer?.kind !== "switch") {
       const configDir = resolveConfigDir(this.config.configDir);
-      const transcriptPath2 = (id) => join12(configDir, "projects", encodeCwd(cwd), `${id}.jsonl`);
+      const transcriptPath2 = (id, dir) => join13(dir ?? configDir, "projects", encodeCwd(cwd), `${id}.jsonl`);
       const resumePoint = findResumePoint({
         sessionKey: sk,
         prompt: options.prompt,
@@ -14155,25 +14531,70 @@ var ClaudeCodeLanguageModel = class {
           // timers on everything it touches (the same reason the fork lookup
           // above uses it).
           isBusy: claudeSessionIsWriting,
+          // The ACCOUNT is the third thing that may differ (h #g226), and the
+          // guard is where a cross-group sibling is refused by name.
+          accountProviders,
+          allowAccount: (account) => this.config.crossAccountResume !== false && accountsShareGroup(sourceAccount, account, groups),
           onRefused: (reason) => {
             replayReason = reason;
           }
         });
         if (sibling) {
-          deleteActiveProcess(sibling.siblingKey);
-          const carried = transferClaudeSession(sibling.siblingKey, sk);
-          if (carried) {
-            includeHistoryContext = false;
-            log.notice(
-              "continuing this conversation's claude session under the new model or effort instead of replaying it",
-              {
-                sessionKey: sk,
-                siblingKey: sibling.siblingKey,
-                matchedMessages: sibling.matched
-              }
-            );
+          let carriedSessionId;
+          let carryRefused;
+          if (sibling.siblingAccount && sibling.siblingConfigDir) {
+            const carry = await carryTranscriptToAccount({
+              sessionId: sibling.claudeSessionId,
+              cwd,
+              targetConfigDir: resolveConfigDir(this.skillBridgeSpawn(failover).configDir),
+              // The sibling's recorded directory first, then every same-group
+              // account's. The recorded one can be stale by a turn (it is
+              // rewritten only when a turn succeeds), so the conventional
+              // directories are what make a stale record recoverable rather
+              // than a refusal.
+              accountConfigDirs: [
+                sibling.siblingConfigDir,
+                ...accountsInGroupOf(sourceAccount, this.config.failoverAccounts, groups).map(
+                  configDirForAccount
+                ),
+                configDir
+              ]
+            });
+            if (carry.kind === "carried" || carry.kind === "already-there") {
+              carriedSessionId = carry.sessionId;
+            } else {
+              carryRefused = carry.reason;
+            }
+          }
+          if (carryRefused) {
+            replayReason = `sibling-${carryRefused}`;
+            log.notice("replaying this conversation rather than carrying it across accounts", {
+              sessionKey: sk,
+              siblingKey: sibling.siblingKey,
+              reason: carryRefused,
+              account: sourceAccount,
+              from: sibling.siblingAccount
+            });
           } else {
-            replayReason = "sibling-carry-over-failed";
+            deleteActiveProcess(sibling.siblingKey);
+            const carried = transferClaudeSession(sibling.siblingKey, sk);
+            if (carried) {
+              if (carriedSessionId && carriedSessionId !== carried) {
+                setClaudeSessionId(sk, carriedSessionId);
+              }
+              includeHistoryContext = false;
+              log.notice(
+                "continuing this conversation's claude session under the new model or effort instead of replaying it",
+                {
+                  sessionKey: sk,
+                  siblingKey: sibling.siblingKey,
+                  matchedMessages: sibling.matched,
+                  ...sibling.siblingAccount ? { from: sibling.siblingAccount, account: sourceAccount } : {}
+                }
+              );
+            } else {
+              replayReason = "sibling-carry-over-failed";
+            }
           }
         }
       }
@@ -14255,7 +14676,8 @@ var ClaudeCodeLanguageModel = class {
     }
     const failoverAccounts = failoverCandidates(
       this.config.failoverAccounts,
-      sourceAccount
+      sourceAccount,
+      groups
     );
     const failoverAskActive = failoverAccounts.length > 0 && this.config.accountFailover === "ask" && !compactionMode && // A `doGenerate` caller takes the override and reports the plain
     // rate-limit error, never the form. See `TurnMode`.
@@ -14847,6 +15269,14 @@ var ClaudeCodeLanguageModel = class {
             });
             state.endTextBlock();
           }
+          if (accountGroupNote) {
+            controller.enqueue({
+              type: "text-delta",
+              id: state.startTextBlock(),
+              delta: accountGroupNote
+            });
+            state.endTextBlock();
+          }
           if (failoverNote) {
             controller.enqueue({
               type: "text-delta",
@@ -14859,7 +15289,10 @@ var ClaudeCodeLanguageModel = class {
           const completeResult = (msg) => {
             if (state.controllerClosed) return;
             if (self.config.resumeAfterRestart !== false && !compactionMode && msg.is_error !== true && typeof msg.session_id === "string") {
-              recordResumePoint(sk, msg.session_id, options.prompt, cliPath);
+              recordResumePoint(sk, msg.session_id, options.prompt, cliPath, {
+                configDir: resolveConfigDir(self.skillBridgeSpawn(failover).configDir),
+                account: failover.target ?? sourceAccount
+              });
             }
             if (deliverPendingCompletions(state)) {
               if (state.drainBuffer.length > 0) drainNow(state);
@@ -15383,8 +15816,8 @@ var ClaudeCodeLanguageModel = class {
 };
 
 // src/account-tier.ts
-import { readFileSync as readFileSync7 } from "fs";
-import path12 from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import path13 from "path";
 var ORGANIZATION_TYPE_LABELS = {
   claude_max: "Max",
   claude_pro: "Pro",
@@ -15413,7 +15846,7 @@ function readAccountTier(account) {
   return label;
 }
 function readTierFromConfigDir(configDir, allowLegacyFallback) {
-  const candidates = [path12.join(configDir, ".claude.json")];
+  const candidates = [path13.join(configDir, ".claude.json")];
   if (allowLegacyFallback) candidates.push(expandHome("~/.claude.json"));
   for (const candidate of candidates) {
     const oauth = readOauthAccount(candidate);
@@ -15426,7 +15859,7 @@ function readTierFromConfigDir(configDir, allowLegacyFallback) {
 function readOauthAccount(file) {
   let raw;
   try {
-    raw = readFileSync7(file, "utf8");
+    raw = readFileSync8(file, "utf8");
   } catch {
     return void 0;
   }
@@ -15455,13 +15888,13 @@ function tierLabel(oauthAccount) {
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   realpathSync as realpathSync4,
   rmSync as rmSync3,
   writeFileSync as writeFileSync7
 } from "fs";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname7, join as join13, resolve as resolve5 } from "path";
+import { homedir as homedir10 } from "os";
+import { dirname as dirname7, join as join14, resolve as resolve5 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var STALE_PACKAGE_NAME = "opencode-claude-code-plugin";
 var SUSPECT_DESCRIPTION_TOKEN = "Claude Code";
@@ -15469,20 +15902,20 @@ var alreadyRan = false;
 function candidateCacheRoots() {
   const xdg = process.env.XDG_CACHE_HOME;
   return [
-    xdg ? join13(xdg, "opencode") : null,
-    join13(homedir9(), ".cache", "opencode"),
-    join13(homedir9(), "Library", "Caches", "opencode")
+    xdg ? join14(xdg, "opencode") : null,
+    join14(homedir10(), ".cache", "opencode"),
+    join14(homedir10(), "Library", "Caches", "opencode")
   ].filter((p) => Boolean(p));
 }
 function userOpencodeJsonPath() {
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join13(homedir9(), ".config");
-  return join13(xdgConfig, "opencode", "opencode.json");
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join14(homedir10(), ".config");
+  return join14(xdgConfig, "opencode", "opencode.json");
 }
 function userIntendsToUseUnscoped() {
   const cfg = userOpencodeJsonPath();
   if (!existsSync5(cfg)) return false;
   try {
-    const json = JSON.parse(readFileSync8(cfg, "utf8"));
+    const json = JSON.parse(readFileSync9(cfg, "utf8"));
     const plugins = json.plugin;
     if (!Array.isArray(plugins)) return false;
     return plugins.some(
@@ -15503,19 +15936,19 @@ function ourLoadedDir() {
 function ourVersion(dir) {
   if (!dir) return null;
   try {
-    const pkg = JSON.parse(readFileSync8(join13(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync9(join14(dir, "package.json"), "utf8"));
     return typeof pkg.version === "string" && pkg.version ? pkg.version : null;
   } catch {
     return null;
   }
 }
 function markerPath() {
-  const stateRoot = process.env.XDG_STATE_HOME ?? join13(homedir9(), ".local", "state");
-  return join13(stateRoot, "opencode-claude-code-plugin", "cleanup-stale.json");
+  const stateRoot = process.env.XDG_STATE_HOME ?? join14(homedir10(), ".local", "state");
+  return join14(stateRoot, "opencode-claude-code-plugin", "cleanup-stale.json");
 }
 function markerVersion() {
   try {
-    const marker = JSON.parse(readFileSync8(markerPath(), "utf8"));
+    const marker = JSON.parse(readFileSync9(markerPath(), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -15560,7 +15993,7 @@ function cleanupStaleUnscopedInstall() {
 }
 function cleanupOne(cacheRoot, ourDir) {
   if (!existsSync5(cacheRoot)) return;
-  const stalePath = join13(cacheRoot, "node_modules", STALE_PACKAGE_NAME);
+  const stalePath = join14(cacheRoot, "node_modules", STALE_PACKAGE_NAME);
   if (!existsSync5(stalePath)) return;
   let realStalePath = stalePath;
   try {
@@ -15568,11 +16001,11 @@ function cleanupOne(cacheRoot, ourDir) {
   } catch {
   }
   if (ourDir && realStalePath === ourDir) return;
-  const pkgJsonPath = join13(stalePath, "package.json");
+  const pkgJsonPath = join14(stalePath, "package.json");
   if (!existsSync5(pkgJsonPath)) return;
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync8(pkgJsonPath, "utf8"));
+    pkg = JSON.parse(readFileSync9(pkgJsonPath, "utf8"));
   } catch {
     return;
   }
@@ -15588,10 +16021,10 @@ function cleanupOne(cacheRoot, ourDir) {
     });
     return;
   }
-  const cachePkgJson = join13(cacheRoot, "package.json");
+  const cachePkgJson = join14(cacheRoot, "package.json");
   if (!existsSync5(cachePkgJson)) return;
   try {
-    const cfg = JSON.parse(readFileSync8(cachePkgJson, "utf8"));
+    const cfg = JSON.parse(readFileSync9(cachePkgJson, "utf8"));
     if (cfg?.dependencies?.[STALE_PACKAGE_NAME]) {
       delete cfg.dependencies[STALE_PACKAGE_NAME];
       writeFileSync7(cachePkgJson, JSON.stringify(cfg, null, 2) + "\n");
@@ -15671,7 +16104,7 @@ function registerOpencodeLogSink(client) {
 }
 
 // src/v2-client.ts
-import path13 from "path";
+import path14 from "path";
 function formatAgentTypeList(agents) {
   const lines = agents.flatMap((agent) => {
     if (agent.hidden === true || agent.mode === "primary") return [];
@@ -15700,7 +16133,7 @@ function toV1Session(info) {
   if (!info || typeof info !== "object") return void 0;
   const session = info;
   const root = session.location?.directory;
-  const directory = typeof root === "string" ? typeof session.subpath === "string" && session.subpath.length > 0 ? path13.resolve(root, session.subpath) : root : void 0;
+  const directory = typeof root === "string" ? typeof session.subpath === "string" && session.subpath.length > 0 ? path14.resolve(root, session.subpath) : root : void 0;
   return { ...info, directory, parentID: session.parentID };
 }
 function toV1Messages(messages) {
@@ -16198,6 +16631,12 @@ function applyPermissionPreset(settings, defaultProxyTools) {
   }
   return resolved;
 }
+function accountGroups(settings) {
+  return resolveAccountGroups(
+    settings.accountGroups,
+    settings.failoverAccounts ?? settings.accounts
+  );
+}
 function createClaudeCode(settings = {}) {
   if (settings.logging) {
     configureLogger({
@@ -16228,6 +16667,11 @@ function createClaudeCode(settings = {}) {
       // unset option must stay unset rather than being written to one mode or
       // the other in only one of the two entry points (h #g194).
       accountFailover: settings.accountFailover,
+      // Resolved once here rather than per turn, so the WARNs an invalid entry
+      // raises are tied to provider creation and a turn reads a value that is
+      // already validated. `failoverAccounts` is what the expansion configured,
+      // which is exactly the set a group may name (h #g226).
+      accountGroups: accountGroups(settings),
       providerID: settings.providerID,
       skipPermissions: preset?.skipPermissions ?? settings.skipPermissions ?? true,
       permissionMode: preset?.permissionMode ?? settings.permissionMode,
@@ -16235,6 +16679,9 @@ function createClaudeCode(settings = {}) {
       mcpConfig: settings.mcpConfig,
       strictMcpConfig: settings.strictMcpConfig,
       bridgeOpencodeMcp: settings.bridgeOpencodeMcp ?? true,
+      // No `?? true` twin: reading opencode's credential store is opt-in, so
+      // the absent value has to stay falsy.
+      bridgeMcpOauthTokens: settings.bridgeMcpOauthTokens,
       controlRequestBehavior: preset?.controlRequestBehavior ?? settings.controlRequestBehavior ?? "allow",
       controlRequestToolBehaviors: preset ? void 0 : settings.controlRequestToolBehaviors,
       controlRequestDenyMessage: settings.controlRequestDenyMessage,