@modelprofile.com/authswitch 2.2.0 → 3.0.0

package/dist_ts/interfaces.harness.d.ts

@@ -19,6 +19,63 @@ export interface IHarnessLoginHandle {
     cancel(): Promise<void>;
     close(): Promise<void>;
 }
+/** One running instance of a harness binary, owned by the current user. */
+export interface IHarnessProcess {
+    pid: number;
+    /** Executable name as the platform reports it, without a path. */
+    command: string;
+    /** Bounded command line, for identifying which instance this is. Never parsed for identity. */
+    commandLine: string;
+    /** Start time, which distinguishes a reused pid from the process we enumerated. */
+    startedAt: string | null;
+    /** An ancestor of the running authswitch command: stopping it would kill this command. */
+    isAncestor: boolean;
+}
+export interface IHarnessStopOutcome {
+    /** Instances that exited within the bounded wait. */
+    stopped: IHarnessProcess[];
+    /** Instances that were still running when the wait elapsed. */
+    survivors: IHarnessProcess[];
+    /** Instances that were re-verified and then killed, only ever with an explicit force request. */
+    forced: IHarnessProcess[];
+}
+/**
+ * Enumerating and stopping a harness's own running instances.
+ *
+ * Only pids this control enumerated for the current user are ever signalled, and a stop is graceful
+ * unless the caller explicitly forces it. Adapters whose process lifecycle belongs to another
+ * manager (Codex' app-server daemon) expose no control at all.
+ */
+export interface IHarnessProcessControl {
+    readonly binary: string;
+    /** Why enumerated instances cannot be signalled on this platform; null when they can. */
+    readonly stopUnavailableReason: string | null;
+    list(): IHarnessProcess[];
+    stop(processesArg: readonly IHarnessProcess[], optionsArg?: {
+        force?: boolean;
+        timeoutMs?: number;
+    }): Promise<IHarnessStopOutcome>;
+}
+/**
+ * A live credential that no longer holds the account the last switch activated.
+ *
+ * Authswitch records the hash of what it wrote, in its own store. A different hash with the same
+ * account is that account's own token refresh; a different account is what a running instance
+ * writing its in-memory login back looks like.
+ */
+export interface IHarnessCredentialDrift {
+    slotId?: string;
+    /** The account the recorded switch activated. */
+    expectedAccountId: string;
+    /** Its saved label, or null when that account is no longer saved. */
+    expectedLabel: string | null;
+    /** The account the credential file holds now, or null when the slot has no active login. */
+    currentAccountId: string | null;
+    currentLabel: string | null;
+    /** Whether the current account has a saved copy of its own. */
+    currentIsSaved: boolean;
+    switchedAt: string;
+}
 /** Account IDs are opaque and scoped to one harness. Credentials never cross this interface. */
 export interface IHarnessAccount {
     id: string;
@@ -34,6 +91,8 @@ export interface IHarnessState {
     accounts: IHarnessAccount[];
     /** Explains why an active login cannot be saved, when applicable. */
     saveUnavailableReason: string | null;
+    /** Slots whose credential file no longer holds the account the last switch wrote. */
+    credentialDrift?: IHarnessCredentialDrift[];
 }
 export interface IHarnessAccountStatus {
     /** Provider-reported facts, already labelled with their units and provenance. */
@@ -108,6 +167,8 @@ export interface IAuthHarness {
     readonly loginHint: string;
     readonly diagnosticsLabel: string;
     readState(): THarnessResult<IHarnessState>;
+    /** Running instances of this harness, when the adapter owns their lifecycle. */
+    readonly processes?: IHarnessProcessControl;
     readAccountStatus(accountIdArg: string): Promise<IHarnessAccountStatus>;
     readonly loginProviders?: IHarnessLoginProvider[];
     beginLogin?(options: IHarnessLoginOptions): Promise<IHarnessLoginHandle>;

package/dist_ts/interfaces.list.d.ts

@@ -1,4 +1,4 @@
-import type { IHarnessAccount, IHarnessAccountStatus } from './interfaces.harness.js';
+import type { IHarnessAccount, IHarnessAccountStatus, IHarnessCredentialDrift } from './interfaces.harness.js';
 /** Credential-free, versioned output of list --json. Missing status fields stay omitted. */
 export interface IAccountList {
     schemaVersion: 2;
@@ -14,6 +14,72 @@ export interface IHarnessAccountList {
     accounts: (IHarnessAccount & {
         status: IHarnessAccountStatus;
     })[];
+    /** Slots whose credential file no longer holds the account the last switch wrote. */
+    credentialDrift: IHarnessCredentialDrift[];
     /** A state lookup failure is distinct from an empty account list. */
     problems: string[];
 }
+/** Credential-free, versioned output of limits --json. One entry per account and limit type. */
+export interface IAccountLimits {
+    schemaVersion: 1;
+    generatedAt: string;
+    complete: boolean;
+    limits: IAccountLimitRow[];
+    /** Why a row has no numbers. Never a substitute for a value. */
+    notes: string[];
+}
+export interface IAccountLimitRow {
+    harnessId: string;
+    /** Harness label, qualified by the credential slot when the harness owns several. */
+    provider: string;
+    /** The account's public label, which is its email wherever the provider reports one. */
+    account: string | null;
+    accountId: string | null;
+    slotId?: string;
+    isActive: boolean;
+    /** The provider's own window name, or null when no limit data is available. */
+    limitType: string | null;
+    scope: 'account' | 'feature' | null;
+    windowSeconds: number | null;
+    /** Never inferred: null means the provider reported no percentage, not zero usage. */
+    usedPercent: number | null;
+    resetAt: string | null;
+    /** Human countdown for the same `resetAt`, relative to `generatedAt`. */
+    resetsIn: string;
+    unavailableReason: string | null;
+}
+/** Credential-free, versioned output of active --json. One entry per active credential slot. */
+export interface IActiveAccounts {
+    schemaVersion: 1;
+    generatedAt: string;
+    complete: boolean;
+    active: IActiveAccountRow[];
+    notes: string[];
+}
+export interface IActiveAccountRow {
+    harnessId: string;
+    provider: string;
+    account: string | null;
+    accountId: string | null;
+    slotId?: string;
+    /** When authswitch last saved this login; null when it was never stashed. */
+    savedAt: string | null;
+    /** Human elapsed time for the same `savedAt`, relative to `generatedAt`. */
+    savedAgo: string;
+    /** Where the shown account comes from. Whether it is also saved is the `savedAt` field's answer. */
+    source: 'credential file' | 'stash only' | 'none';
+    unavailableReason: string | null;
+    /** Set when the credential file no longer holds the account the last switch wrote. */
+    drift: IActiveAccountDrift | null;
+}
+/** A credential file that changed underneath a switch, with both accounts named where known. */
+export interface IActiveAccountDrift {
+    expectedAccountId: string;
+    expectedAccount: string | null;
+    currentAccountId: string | null;
+    currentAccount: string | null;
+    currentIsSaved: boolean;
+    switchedAt: string;
+    /** The sentence the table footnotes, for consumers that display one string. */
+    reason: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/authswitch",
-  "version": "2.2.0",
+  "version": "3.0.0",
   "private": false,
   "description": "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status",
   "main": "dist_ts/index.js",
@@ -25,7 +25,7 @@
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^6.0.0",
+    "@git.zone/tstest": "^6.1.1",
     "@types/node": "26.5.0"
   },
   "dependencies": {

package/readme.md

@@ -16,11 +16,7 @@ Remote control makes that worse. A ChatGPT client pairs with the local Codex app
 
 ## Install
 
-This package is published to the private Verdaccio registry, not to npmjs, so the scope has to be mapped first:
-
-```bash
-pnpm config set @modelprofile.com:registry https://verdaccio.lossless.digital
-```
+The package is published to npmjs:
 
 ```bash
 pnpm install -g @modelprofile.com/authswitch
@@ -57,9 +53,13 @@ authswitch --tui                  # full-screen account management
 authswitch codex --tui            # start the dashboard on Codex
 authswitch list                   # all known accounts across registered harnesses, with live status
 authswitch list --json            # complete account/status document for scripts
+authswitch limits                 # every account and limit type: used % and reset countdown
+authswitch active                 # which account each provider is using right now
 authswitch codex stash            # save the active credential under its account email
 authswitch codex list             # Codex accounts, including an unsaved active login, with live status
 authswitch codex use [email]      # activate one; prompts when no email is given
+authswitch claude use [email] --stop        # stop running Claude Code instances first
+authswitch claude use [email] --keep-running  # switch without stopping anything
 authswitch codex preuse <email>   # send the default prompt without activating the account
 authswitch codex current          # print the account currently in use
 authswitch codex drop <email>     # forget a stash
@@ -81,16 +81,53 @@ the management TUI and human/JSON lists. With an AGL installation that supports
 authswitch coordination, the CLI delegates credential changes to AGL. AGL owns
 stopping and restarting its OpenCode runtime. Idle changes need no additional
 restart confirmation; active work requires consent to wait for it to finish.
-Unmanaged native processes must still be exited manually: a terminal session
-cannot safely be reconstructed from its PID. `stash --keep` is the exception --
-it only reads the native credential files and writes to authswitch's own store,
-so it works while OpenCode or Claude Code is running, and it is refused only if
-those files keep changing while they are read. The operations that replace a
-native login -- `stash` without `--keep`, `use`, and backend activation --
-still require the harness stopped, because a running one holds the outgoing
-token in memory and would write it back over the incoming login at its next
-refresh. Status lookups remain read-only and work while harnesses are running.
-`preuse` remains a Codex capability.
+Every operation, including `use` and `stash`, now works while OpenCode or Claude
+Code is running: the credential file is written atomically, the outgoing login is
+re-saved from disk first, and a write that races a native rewrite is detected and
+refused rather than half-applied. Status lookups remain read-only. `preuse`
+remains a Codex capability.
+
+#### Running instances during a switch
+
+A harness that keeps running through a switch still costs something: it holds the
+previous login in memory and can write it back at its next OAuth token refresh.
+So before `use` and before `stash` without `--keep`, authswitch lists that
+harness's own running instances -- pid, start time and command line -- and offers
+to stop them:
+
+```
+2 Claude Code process(es) are running:
+  pid 4821  started 2026-09-16 14:02 UTC  claude --session-id 9f2c
+  pid 5533  started 2026-09-16 14:02 UTC  claude agents
+? Stop these 2 Claude Code process(es) first? (y/N)
+```
+
+Answering yes sends `SIGTERM` to exactly those pids and waits up to ten seconds;
+an instance that survives is reported by pid and the switch continues. Three flags
+decide the same thing without a prompt:
+
+| Flag | Effect |
+| --- | --- |
+| `--stop` | stop the listed instances gracefully, then switch |
+| `--force-stop` | the same, then `SIGKILL` the ones that ignored `SIGTERM` |
+| `--keep-running` | switch without stopping anything |
+
+Without a terminal and without a flag, nothing is ever signalled: the instances are
+listed, the switch proceeds, and the command says which flag would have changed that.
+`SIGKILL` is only ever sent for `--force-stop`. Only pids authswitch enumerated for
+the current user in that operation are signalled -- never a name or pattern match,
+never another user's process -- and a pid is re-verified against a fresh listing
+before a forced kill, so a recycled pid cannot inherit it. The session that is
+running the command is listed but never stopped: stopping it would kill the switch.
+On Windows the instances are listed but not stopped, because its process list does
+not identify their owner. `stash --keep` needs none of this: it writes no native
+file and is guarded by proving the native sources unchanged around the read.
+
+After a switch that left instances running, the command says so explicitly, because
+one of them refreshing its token can put the previous account back. A backend
+activation through `AuthSwitchService` gets that same caveat in its outcome, but no
+listing and no offer: a host has no terminal to consent with, and a supervisor that
+completed the mutation itself owns its own runtime's lifecycle.
 
 `authswitch codex login` and `authswitch opencode login openai` use the shared
 OpenAI device login flow. They display a verification link and code, then save
@@ -310,18 +347,113 @@ marked unverified. Renewal/cancellation dates are shown only when an adapter can
 provide live billing data. Codex uses the desktop app's account-check endpoint for
 automatic renewal, explicit renewal/cancellation dates and subscription expiry.
 
+### Condensed views
+
+`authswitch limits` answers "how much is left, and when does it come back" in one
+table. It is one row per account **and** limit type, sorted by provider and then by
+account email, with a two-unit countdown (`2h 13m`, `3d 4h`, `45m`, `<1m`, `due`):
+
+```
+Account limits
+┌──────────────────────┬─────────────────────────┬───────────────────────┬────────┬───────────────┐
+│ Provider             │ Account                 │ Limit type            │ Used % │     Resets in │
+├──────────────────────┼─────────────────────────┼───────────────────────┼────────┼───────────────┤
+│ Claude Code          │ phil@example.com        │ Claude weekly         │    88% │         4d 3h │
+│ Claude Code          │ phil@example.com        │ Claude five-hour      │    63% │         1h 2m │
+│ Claude Code          │ phil@example.com        │ Opus weekly           │   100% │         4d 3h │
+│ Codex                │ alice@example.com       │ Codex secondary       │    12% │         3d 4h │
+│ Codex                │ alice@example.com       │ Codex primary         │    37% │        2h 13m │
+│ Codex                │ alice@example.com       │ Code review secondary │   100% │        3h 59m │
+│ Codex                │ bob@example.com         │ n/a                   │    n/a │           n/a │
+│ OpenCode / anthropic │ anthropic API key 20e75 │ n/a                   │    n/a │           n/a │
+│                      │ 1c3b707                 │                       │        │               │
+│ OpenCode / openai    │ alice@example.com       │ Codex primary         │     0% │ not scheduled │
+└──────────────────────┴─────────────────────────┴───────────────────────┴────────┴───────────────┘
+
+n/a — Codex · bob@example.com: Subscription and limits: Login expired or was rejected.
+n/a — OpenCode / anthropic · anthropic API key 20e751c3b707: This provider login does not expose a supported subscription or quota API.
+```
+
+A number is never invented. An account whose provider exposes no quota API, whose
+lookup failed, or whose login cannot be read shows `n/a` in **Used %** and
+**Resets in**, and the footnote under the table says why — one line per distinct
+reason. A provider is never dropped from the table for lacking data, and one failed
+account never blanks another's numbers. `not scheduled` means the provider reported
+usage without a reset deadline; it is not the same as `n/a`.
+
+Limit types are the provider's own window names, ordered general-before-feature and
+weekly-first within an account. The provider column names the harness, qualified by
+the credential slot when a harness owns several (`OpenCode / openai`).
+
+`authswitch active` answers "what am I logged in as" for every harness at once:
+
+```
+Active accounts
+┌──────────────────────┬────────────────────────────────┬────────────┬─────────────────┐
+│ Provider             │ Account                        │      Saved │ Source          │
+├──────────────────────┼────────────────────────────────┼────────────┼─────────────────┤
+│ Claude Code          │ phil@example.com               │    45m ago │ credential file │
+│ Codex                │ alice@example.com              │ 2h 13m ago │ credential file │
+│ Flex                 │ none                           │        n/a │ none            │
+│ OpenCode / anthropic │ anthropic API key 20e751c3b707 │    30d ago │ credential file │
+│ OpenCode / openai    │ alice@example.com              │  not saved │ credential file │
+└──────────────────────┴────────────────────────────────┴────────────┴─────────────────┘
+
+note — OpenCode / openai · alice@example.com: This active login is not saved yet; authswitch cannot restore it after a switch.
+```
+
+**Source** is where the shown login comes from: `credential file` is the harness's
+own live credential, `stash only` means nothing is active and only saved copies
+exist, `none` means neither. **Saved** is how long ago `authswitch` last saved that
+login, or `not saved` — which is also the warning that a switch could not bring it
+back. A harness with no active login keeps its row and explains itself in a note.
+
+**Source** also answers whether the file still holds what the last switch wrote.
+When authswitch switches a login it records that account and the hash of the
+credential it wrote, in its own store, never in the harness file. If a later read
+finds a different account in that slot, the row's source reads
+`credential file (changed)` and a note explains it:
+
+```
+note — Claude Code · bob@example.test: The credential file changed since the last
+switch (likely a running instance refreshed the previous login). It now holds
+bob@example.test, which is saved. Run authswitch claude use alice@example.test again.
+```
+
+`authswitch <harness> current` prints the same sentence. The same account with a
+rotated token is that account refreshing itself and is not reported; re-running the
+switch re-arms the check against the file's current contents.
+
+Both commands accept a harness qualifier (`authswitch claude limits`) and `--json`.
+Both are read-only: they never activate, save or clear a login, they need no harness
+stopped, and every provider lookup is bounded by the same 10-second timeout and
+isolated per account as `authswitch list`.
+
 ### JSON output
 
 `authswitch list --json`, `authswitch codex list --json`, and the `ls` alias write
 one JSON document to stdout, with no color, tables or progress messages. `--json`
-may appear before or after the command and requires `list` or `ls`. It cannot be
-combined with a mutation or interactive mode. Unknown list arguments exit with 2.
+may appear before or after the command and requires `list`, `ls`, `limits` or
+`active`. It cannot be combined with a mutation or interactive mode. Unknown
+arguments to these commands exit with 2.
+
+`limits --json` emits `IAccountLimits` and `active --json` emits `IActiveAccounts`:
+the same rows as the tables, plus the machine-readable fields the tables condense —
+`accountId`, `slotId`, `scope`, `windowSeconds`, the ISO `resetAt` beside the human
+`resetsIn`, the ISO `savedAt` beside the human `savedAgo`, the per-row
+`unavailableReason` that the footnotes summarise, and `drift`, which carries the
+expected and current account ids, their labels, whether the current one is saved,
+the ISO `switchedAt` of the switch that was undone, and the same sentence as `reason`. Both carry `schemaVersion: 1`, the
+shared `generatedAt` snapshot every countdown is relative to, and `complete`, which
+is false when any account or harness could not be read.
 
 The exported `IAccountList` contract contains:
 
 - `schemaVersion: 2`, `generatedAt` (ISO UTC), and `complete`.
-- `harnesses[]`: `id`, `label`, `loginHint`, `saveUnavailableReason`, `accounts`, and
-  harness-level `problems` (distinguishing failed discovery from an empty list).
+- `harnesses[]`: `id`, `label`, `loginHint`, `saveUnavailableReason`, `accounts`,
+  `credentialDrift` (slots whose file no longer holds the account the last switch
+  wrote), and harness-level `problems` (distinguishing failed discovery from an
+  empty list).
 - Each account's opaque `id`, `label`, `isActive`, verified `isStashed`, `savedAt`,
   `details`, and `status` containing all labelled `facts`, `problems`, and optional
   typed `summary` fields. Missing fields remain omitted, not replaced by zero.
@@ -456,6 +588,8 @@ scripts must qualify them. Account references never resolve across harnesses.
 | What | Where |
 | --- | --- |
 | Stashed credentials | `~/.authswitch/codex/<email>/auth.json` (mode 0600, in a 0700 directory) |
+| Saved OpenCode/Claude logins | `~/.authswitch/<harness>/<id>.json` (mode 0600, in a 0700 directory) |
+| Last switch per credential slot | `~/.authswitch/<harness>/switches.json` (account ids, credential hashes and timestamps; no credentials) |
 | Stash metadata and enrollments | `~/.authswitch/codex/<email>/stash.json` |
 | Codex' active credential | `$CODEX_HOME/auth.json`, default `~/.codex/auth.json` |
 | Codex' remote-control enrollments | the `remote_control_enrollments` table in `$CODEX_HOME/state_<n>.sqlite` |
@@ -470,6 +604,8 @@ Account identity comes from the `id_token` inside the credential — the email c
 
 **Other Codex clients keep running.** Stopping the managed app-server does not stop an editor extension that spawned its own. Close it, or expect it to keep using the credential it already loaded.
 
+**A running OpenCode or Claude Code can undo a switch.** It holds the previous login in memory and rewrites the credential file at its next token refresh. Authswitch lists those instances, offers to stop them, warns when any keep running, and detects the overwrite afterwards — but it cannot prevent it while they run. Restart them after a switch.
+
 **The Codex stash is keyed by email.** Two Codex workspaces with the same email
 cannot both be saved under that key. Their account IDs are distinguished during
 listing and identity checks, and a collision refuses to overwrite either login.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '2.2.0',
+  version: '3.0.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/accounts.ts

@@ -1,4 +1,4 @@
-import type { IAuthHarness, IHarnessAccount, IHarnessAccountStatus, IHarnessState, IHarnessStatusSummary } from './interfaces.harness.js';
+import type { IAuthHarness, IHarnessAccount, IHarnessAccountStatus, IHarnessCredentialDrift, IHarnessState, IHarnessStatusSummary } from './interfaces.harness.js';
 import { plainText } from './formatting.js';
 
 export interface IAccountRow {
@@ -19,6 +19,55 @@ export const until = (timestampArg: string | null, nowArg: number): string => {
   const hours = Math.floor(minutes % 1440 / 60);
   return [days ? `${days}d` : '', hours ? `${hours}h` : '', minutes % 60 ? `${minutes % 60}min` : ''].filter(Boolean).join(' ');
 };
+/**
+ * A two-unit countdown for condensed tables: `2h 13m`, `3d 4h`, `45m`.
+ *
+ * `until` stays the long form used by the list view and the TUI. This one trades the third unit for
+ * a column that never wraps, and it never invents a deadline: an unknown or unparseable timestamp is
+ * reported as such rather than as zero time remaining.
+ */
+const twoUnits = (millisecondsArg: number): string => {
+  const minutes = Math.floor(millisecondsArg / 60000);
+  const days = Math.floor(minutes / 1440);
+  const hours = Math.floor(minutes % 1440 / 60);
+  if (days) return hours ? `${days}d ${hours}h` : `${days}d`;
+  if (hours) return minutes % 60 ? `${hours}h ${minutes % 60}m` : `${hours}h`;
+  return `${minutes}m`;
+};
+export const compactUntil = (timestampArg: string | null, nowArg: number, unavailableArg = 'n/a'): string => {
+  if (timestampArg === null) return 'not scheduled';
+  const remaining = Date.parse(timestampArg) - nowArg;
+  if (!Number.isFinite(remaining)) return unavailableArg;
+  if (remaining <= 0) return 'due';
+  return remaining < 60000 ? '<1m' : twoUnits(remaining);
+};
+/**
+ * The same two-unit form for a past timestamp, for "saved 3d 4h ago".
+ *
+ * The result is always a bare duration or the caller's unavailable marker, never a phrase: callers
+ * suffix it ("... ago"), and a phrase would read as "just now ago". A span under a minute is `<1m`,
+ * exactly as `compactUntil` reports one.
+ */
+export const compactSince = (timestampArg: string | null, nowArg: number, unavailableArg = 'n/a'): string => {
+  if (timestampArg === null) return unavailableArg;
+  const elapsed = nowArg - Date.parse(timestampArg);
+  if (!Number.isFinite(elapsed)) return unavailableArg;
+  return elapsed < 60000 ? '<1m' : twoUnits(elapsed);
+};
+/**
+ * One sentence for a credential file that no longer holds the account the last switch wrote.
+ *
+ * It names what the file holds now and how to put the intended account back, because the usual
+ * cause -- a harness instance that kept running through the switch and then refreshed its
+ * in-memory login -- leaves no other trace.
+ */
+export const credentialDriftNote = (harnessIdArg: string, driftArg: IHarnessCredentialDrift): string =>
+  'The credential file changed since the last switch (likely a running instance refreshed the previous login). '
+  + (driftArg.currentLabel === null ? 'No login is active in that slot now. '
+    : `It now holds ${plainText(driftArg.currentLabel)}${driftArg.currentIsSaved ? ', which is saved' : ', which is not saved'}. `)
+  + (driftArg.expectedLabel === null ? 'Switch to the intended account again.'
+    : `Run authswitch ${plainText(harnessIdArg)} use ${plainText(driftArg.expectedLabel)} again.`);
+
 export const accountPlan = (rowArg: IAccountRow): string => {
   const subscription = rowArg.status?.summary?.subscription;
   return subscription ? `${plainText(subscription.plan)}${subscription.source === 'stored' ? ' (stored; unverified)' : ' (live)'}` : rowArg.status ? 'Unavailable' : 'Loading';

package/ts/classes.accountlist.ts

@@ -28,10 +28,11 @@ const publicStatus = (statusArg: IHarnessAccountStatus): IHarnessAccountStatus =
 export const readAccountList = async (harnessesArg: IAuthHarness[]): Promise<IAccountList> => {
   const harnesses: IHarnessAccountList[] = [];
   for (const harness of harnessesArg) {
-    const result: IHarnessAccountList = { id: harness.id, label: harness.label, loginHint: harness.loginHint, saveUnavailableReason: null, accounts: [], problems: [] };
+    const result: IHarnessAccountList = { id: harness.id, label: harness.label, loginHint: harness.loginHint, saveUnavailableReason: null, accounts: [], credentialDrift: [], problems: [] };
     try {
       const { state, rows } = await readAccountRows(harness);
       result.saveUnavailableReason = state.saveUnavailableReason;
+      result.credentialDrift = state.credentialDrift ?? [];
       result.accounts = rows.map(({ account, status }) => ({
         id: account.id, label: account.label, isActive: account.isActive, isStashed: account.isStashed,
         savedAt: account.savedAt, details: [...account.details], ...(account.slotId === undefined ? {} : { slotId: account.slotId }),
@@ -49,21 +50,33 @@ export const readAccountList = async (harnessesArg: IAuthHarness[]): Promise<IAc
   };
 };
 
+export const consoleWidth = (): number => process.stdout.columns ?? 100;
+export const consoleHeading = (textArg: string): void => { process.stdout.write(`\n${bold(textArg)}\n`); };
+
+/** One table implementation for every command, including the label-per-line fallback on narrow terminals. */
+export const consoleTable = async <TRow>(
+  outArg: plugins.smartconsole.SmartConsole,
+  rowsArg: TRow[],
+  columnsArg: plugins.smartconsole.IBackendTableColumn<TRow>[],
+): Promise<void> => {
+  if (!rowsArg.length) return;
+  if (consoleWidth() < 40) {
+    for (const row of rowsArg) {
+      process.stdout.write(columnsArg.map(column => `  ${column.title}: ${String(column.value(row) ?? 'Unavailable').replace(/\n/g, '\n    ')}`).join('\n') + '\n\n');
+    }
+    return;
+  }
+  await outArg.table(rowsArg, { columns: columnsArg, overflow: 'wrap', theme: { header: { bold: true, foreground: 'cyan' }, border: { dim: true } } });
+};
+
 /** Shared, provider-independent list presentation. Adapters supply grouping metadata. */
 export class AccountListRenderer {
   constructor(private readonly out: plugins.smartconsole.SmartConsole) {}
-  private get width(): number { return process.stdout.columns ?? 100; }
-  private heading(textArg: string): void { process.stdout.write(`\n${bold(textArg)}\n`); }
+  private get width(): number { return consoleWidth(); }
+  private heading(textArg: string): void { consoleHeading(textArg); }
 
   private async table<TRow>(rowsArg: TRow[], columnsArg: plugins.smartconsole.IBackendTableColumn<TRow>[]): Promise<void> {
-    if (!rowsArg.length) return;
-    if (this.width < 40) {
-      for (const row of rowsArg) {
-        process.stdout.write(columnsArg.map(column => `  ${column.title}: ${String(column.value(row) ?? 'Unavailable').replace(/\n/g, '\n    ')}`).join('\n') + '\n\n');
-      }
-      return;
-    }
-    await this.out.table(rowsArg, { columns: columnsArg, overflow: 'wrap', theme: { header: { bold: true, foreground: 'cyan' }, border: { dim: true } } });
+    await consoleTable(this.out, rowsArg, columnsArg);
   }
 
   public async render(listArg: IAccountList): Promise<void> {

package/ts/classes.claudecodeharness.ts

@@ -1,9 +1,10 @@
 import * as plugins from './plugins.js';
 import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
-import { CredentialStore, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw, requireHarnessStopped } from './classes.credentialstore.js';
+import { CredentialStore, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw } from './classes.credentialstore.js';
+import { HarnessProcesses } from './classes.harnessprocesses.js';
 import { ClaudeAccountStatus } from './classes.claudestatus.js';
 import { writeSecretFileAtomically } from './helpers.js';
-import type { IHarnessAccountStatus } from './interfaces.harness.js';
+import type { IHarnessAccountStatus, IHarnessProcessControl } from './interfaces.harness.js';
 
 export interface IClaudeCodeHarnessOptions {
   configDir?: string;
@@ -12,7 +13,8 @@ export interface IClaudeCodeHarnessOptions {
   env?: NodeJS.ProcessEnv;
   platform?: NodeJS.Platform;
   fetch?: typeof fetch;
-  checkStopped?: () => void;
+  /** Running-instance inspection, injectable for isolated installations and tests. */
+  processes?: IHarnessProcessControl;
   /** Local settings sources to inspect for credential overrides, in increasing precedence. */
   settingsFiles?: string[];
 }
@@ -30,7 +32,7 @@ export class ClaudeCodeHarness extends FileHarness {
   private readonly env: NodeJS.ProcessEnv;
   private readonly platform: NodeJS.Platform;
   private readonly status: ClaudeAccountStatus;
-  private readonly checkStopped: () => void;
+  public readonly processes: IHarnessProcessControl;
   private readonly settingsFiles: string[];
 
   constructor(options: IClaudeCodeHarnessOptions = {}) {
@@ -43,11 +45,10 @@ export class ClaudeCodeHarness extends FileHarness {
     this.store = new CredentialStore(this.id, options.stashRoot);
     this.platform = options.platform ?? process.platform;
     this.status = new ClaudeAccountStatus(options.fetch);
-    this.checkStopped = options.checkStopped ?? (() => requireHarnessStopped('claude'));
+    this.processes = options.processes ?? new HarnessProcesses('claude', { platform: this.platform });
     this.settingsFiles = options.settingsFiles ?? [plugins.path.join(dir, 'settings.json'),
       plugins.path.join(process.cwd(), '.claude/settings.json'), plugins.path.join(process.cwd(), '.claude/settings.local.json')];
   }
-  protected beforeMutation(): void { this.checkStopped(); }
   /** One record holds the credential and its matching metadata, so both files must be proven stable. */
   protected nativeSources(): (string | null)[] { return [readCredentialRaw(this.file), readCredentialRaw(this.configFile)]; }
   protected inspect(credential: Record<string, unknown>, slotId: string): IFileAccount {