@modelprofile.com/authswitch 4.0.0 → 5.0.0

package/ts/classes.claudecodeharness.ts

@@ -1,13 +1,13 @@
 import * as plugins from './plugins.js';
 import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
-import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw } from './classes.credentialstore.js';
+import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw, type IStoredCredential } from './classes.credentialstore.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
 import { ClaudeAccountStatus } from './classes.claudestatus.js';
 import { ClaudeCodeLocks } from './classes.claudecodelocks.js';
 import { ClaudeTokenRefresh, type IClaudeTokens } from './classes.claudetokenrefresh.js';
 import { CLAUDE_LOGIN_REJECTED, ClaudeLoginRejectedError, ClaudeRateLimitError } from './claudehttp.js';
 import { writeSecretFileAtomically } from './helpers.js';
-import type { IHarnessAccountStatus, IHarnessProcessControl, IHarnessStatusOptions } from './interfaces.harness.js';
+import type { IHarnessAccountStatus, IHarnessProcessControl, IHarnessState, IHarnessStatusOptions } from './interfaces.harness.js';
 
 export interface IClaudeCodeHarnessOptions {
   configDir?: string;
@@ -26,6 +26,25 @@ export interface IClaudeCodeHarnessOptions {
   now?: () => number;
 }
 
+/**
+ * How long a read waits for the store and for Claude Code's locks before leaving the saved copy as it found it.
+ *
+ * Reading accounts must stay as quick as it is while a switch, a refresh or a Claude Code session holds a lock. The
+ * saved copy has nothing to finish: whatever the operation holding the lock writes is what the next read mirrors.
+ */
+const MIRROR_WAIT_MS = 1_000;
+
+/**
+ * A saved login the sign-in service refuses, in terms the user can act on.
+ *
+ * Claude Code rotates the refresh token of the login it is running on (hints.md), and a saved copy keeps the token
+ * it was stashed with. Once such a login has been replaced outside authswitch -- a `claude /login`, a new device
+ * login -- nothing writes the rotation back, and the service was observed refusing the older token the saved copy
+ * still holds (2026-09-18, two saved logins). No retry, no other account and no switch changes that answer; logging
+ * in again and saving that login does, so the message says so.
+ */
+const SAVED_LOGIN_REJECTED = `${CLAUDE_LOGIN_REJECTED} Claude Code rotates a login's refresh token as it uses it, and the service can refuse the older one a saved copy still holds once that login has been replaced outside authswitch; authswitch claude stash --keep saves the new one.`;
+
 const accountCaches = ['additionalModelOptionsCache', 'additionalModelOptionsAnsweredAt', 'additionalModelCostsCache', 'modelAccessCache', 'orgModelDefaultCache', 'lastSeenOrgDefaultUpdatedAt', 'clientDataCache', 'clientDataCacheSlots', 'autoCompactWindowsCache', 'cachedUsageUtilization'];
 
 /**
@@ -36,7 +55,8 @@ const accountCaches = ['additionalModelOptionsCache', 'additionalModelOptionsAns
  * and write therefore runs under Claude Code's own locks instead of asking for it to be stopped.
  *
  * Nothing else refreshes a saved login, so its access token expires a few hours after it was saved. Reading such a
- * login's status refreshes it first, the way Claude Code would; the active login's tokens belong to Claude Code.
+ * login's status refreshes it first, the way Claude Code would; the active login's tokens belong to Claude Code, and
+ * reading the accounts mirrors that login into its own saved copy, so the stash keeps what Claude Code last wrote.
  */
 export class ClaudeCodeHarness extends FileHarness {
   public readonly id = 'claude';
@@ -55,14 +75,6 @@ export class ClaudeCodeHarness extends FileHarness {
   private readonly settingsFiles: string[];
   private readonly locks: ClaudeCodeLocks;
   private readonly tokens: ClaudeTokenRefresh;
-  /**
-   * The refresh token the service rejected, per account: a hash, never the token itself.
-   *
-   * A rejected grant stays rejected until a new Claude Code login replaces the saved record, so replaying it would
-   * only add traffic to an auth endpoint -- once every tick of a watch, for as long as it runs. The entry is
-   * superseded as soon as the record holds a different refresh token.
-   */
-  private readonly rejectedGrants = new Map<string, string>();
 
   constructor(options: IClaudeCodeHarnessOptions = {}) {
     super();
@@ -151,6 +163,52 @@ export class ClaudeCodeHarness extends FileHarness {
   /** The hash that identifies a saved login's refresh token, so a rejected grant is remembered without keeping it. */
   private grantKey(oauthArg: Record<string, unknown>): string { return credentialHash(credentialText(oauthArg.refreshToken) ?? ''); }
 
+  /**
+   * The harness's accounts, with the saved copy of the active login brought up to date first.
+   *
+   * Claude Code rotates the refresh token of the login it is running on, and until now only a switch or a save wrote
+   * that back into the stash. A login replaced outside authswitch between two switches therefore left a saved copy
+   * holding the token from before the rotation, which the service was observed refusing -- a saved copy that only
+   * turns out to be unusable when that account's status is next read. Every read of the native login now mirrors it
+   * into its own saved record, so the stash keeps the credential Claude Code last wrote for an account that has one.
+   */
+  public async readState(): Promise<IHarnessState> {
+    await this.mirrorActiveLogin();
+    return super.readState();
+  }
+
+  /**
+   * Writes the active login into its own saved record when the two differ.
+   *
+   * This is the only write a read makes, and it is advisory: a store another operation holds, a lock Claude Code
+   * holds and files that keep changing under it all leave the saved copy as it is, because the next read mirrors
+   * whatever they wrote. The native files are only ever read, and a login without a saved record of its own is
+   * never saved implicitly -- that is what `stash` is for.
+   */
+  private async mirrorActiveLogin(): Promise<void> {
+    try {
+      if (this.staleSavedCopy(this.snapshot()) === null) return;
+      await this.store.locked(() => this.locks.hold(() => {
+        // Under both locks the decision is taken again, from a snapshot proven not to have been read across a write.
+        const stale = this.staleSavedCopy(this.stableSnapshot());
+        if (stale !== null) this.store.replaceCredential(stale.id, stale.credential);
+        return [];
+      }, { timeoutMs: MIRROR_WAIT_MS }), { signal: AbortSignal.timeout(MIRROR_WAIT_MS) });
+    } catch { /* A saved copy that could not be brought up to date is no reason to fail a read of the accounts. */ }
+  }
+
+  /** The active login's saved record when it no longer holds what Claude Code wrote, with the credential to write. */
+  private staleSavedCopy(snapshotArg: IFileHarnessSnapshot): { id: string; credential: Record<string, unknown> } | null {
+    // Claude Code runs one login, and an installation this adapter cannot read reports none at all.
+    const [active] = snapshotArg.accounts;
+    if (!active) return null;
+    const id = this.store.id(active.slotId, active.identity);
+    let saved: IStoredCredential;
+    try { saved = this.store.read(id); } catch { return null; }
+    return credentialHash(JSON.stringify(saved.credential)) === credentialHash(JSON.stringify(active.credential))
+      ? null : { id, credential: active.credential };
+  }
+
   /**
    * What the native files say about this account: its active login, and why they could not be read at all.
    *
@@ -182,12 +240,14 @@ export class ClaudeCodeHarness extends FileHarness {
     if (view.unavailable !== null) {
       return this.status.unavailable(oauth, `Login refresh: this saved login's access token has expired and cannot be renewed for this installation. ${view.unavailable}`);
     }
-    if (this.rejectedGrants.get(id) === this.grantKey(oauth)) return this.status.unavailable(oauth, `Login refresh: ${CLAUDE_LOGIN_REJECTED}`);
+    if (this.store.read(id).rejectedGrant === this.grantKey(oauth)) return this.status.unavailable(oauth, `Login refresh: ${SAVED_LOGIN_REJECTED}`);
     let refreshed: IFileAccount;
     try { refreshed = await this.refreshSaved(id, optionsArg.signal); }
     catch (error) {
       if (optionsArg.signal?.aborted) throw error;
-      return this.status.unavailable(oauth, `Login refresh: ${error instanceof Error ? error.message : 'the saved login could not be refreshed.'}`,
+      const problem = error instanceof ClaudeLoginRejectedError ? SAVED_LOGIN_REJECTED
+        : error instanceof Error ? error.message : 'the saved login could not be refreshed.';
+      return this.status.unavailable(oauth, `Login refresh: ${problem}`,
         error instanceof ClaudeRateLimitError ? { retryAt: error.retryAt } : undefined);
     }
     return read(refreshed);
@@ -214,7 +274,7 @@ export class ClaudeCodeHarness extends FileHarness {
       try { tokens = await this.tokens.refresh(oauth); }
       catch (error) {
         // Only this token was rejected; a login saved again replaces it and is tried like any other.
-        if (error instanceof ClaudeLoginRejectedError) this.rejectedGrants.set(id, this.grantKey(oauth));
+        if (error instanceof ClaudeLoginRejectedError) this.recordRejectedGrant(id, oauth);
         throw error;
       }
       const latest = this.savedCredential(id);
@@ -224,4 +284,17 @@ export class ClaudeCodeHarness extends FileHarness {
       return this.savedCredential(id);
     }, { signal });
   }
+
+  /**
+   * Remembers a rejected grant in the saved record, so the next process does not send it again either -- a watch
+   * would otherwise replay a dead login every tick, and every new CLI run once more. It is written only while the
+   * record still holds the token that was sent, and a record that could not be written changes nothing but that:
+   * the refusal the caller reports is the answer, and the grant is simply tried once more.
+   */
+  private recordRejectedGrant(id: string, oauthArg: Record<string, unknown>): void {
+    try {
+      const latest = credentialRecord(this.savedCredential(id).credential.claudeAiOauth);
+      if (latest.refreshToken === oauthArg.refreshToken) this.store.rememberRejectedGrant(id, this.grantKey(oauthArg));
+    } catch { /* Recording is advisory; the rejection is reported either way. */ }
+  }
 }

package/ts/classes.claudecodelocks.ts

@@ -65,11 +65,12 @@ export class ClaudeCodeLocks {
    * A held lock never makes authswitch sit on the others: like Claude Code, it releases what it holds, waits and
    * starts again, so a live session is never blocked by a switch that is still waiting. A lock that could not be
    * released afterwards is reported as an outcome line, because the write it guarded has completed and the lock
-   * expires on its own.
+   * expires on its own. `timeoutMs` shortens the wait for a caller that must not make a user wait for it -- a read
+   * bringing a saved copy up to date has nothing to finish and can leave it to the next read.
    */
-  public async hold(actionArg: () => string[]): Promise<string[]> {
+  public async hold(actionArg: () => string[], optionsArg: { timeoutMs?: number } = {}): Promise<string[]> {
     const lockfile = await plugins.loadProperLockfile();
-    const deadline = Date.now() + this.timeoutMs;
+    const deadline = Date.now() + (optionsArg.timeoutMs ?? this.timeoutMs);
     const held: IHeldLock[] = [];
     const unreleased: string[] = [];
     const releaseAll = async (): Promise<void> => {

package/ts/classes.claudestatus.ts

@@ -2,6 +2,7 @@ import { credentialHash, credentialRecord, credentialText } from './classes.cred
 import { claudeRequest, ClaudeLoginRejectedError, ClaudeRateLimitError, ClaudeRequestError } from './claudehttp.js';
 import { latestRetryAt } from './ratelimit.js';
 import { plainText } from './formatting.js';
+import { usageWindowPeriod } from './accounts.js';
 import type { IHarnessAccountStatus, IHarnessStatusFact, IHarnessStatusOptions, IHarnessUsageWindow, TUsageSeverity } from './interfaces.harness.js';
 
 interface IClaudeUsageWindows {
@@ -22,31 +23,31 @@ const serverName = (value: unknown): string => {
   return name;
 };
 
-/** Keyed windows, read only from a usage body that carries no limits[] rows. */
+/** Keyed windows, read only from a usage body that carries no limits[] rows: what each meter is about, and how long its window is. */
 const KEYED_WINDOWS = [
-  ['five_hour', 'Claude five-hour', 18000, 'account'], ['seven_day', 'Claude weekly', 604800, 'account'],
-  ['seven_day_oauth_apps', 'OAuth apps weekly', 604800, 'feature'], ['seven_day_opus', 'Opus weekly', 604800, 'feature'], ['seven_day_sonnet', 'Sonnet weekly', 604800, 'feature'],
+  ['five_hour', 'Claude', 18000, 'account'], ['seven_day', 'Claude', 604800, 'account'],
+  ['seven_day_oauth_apps', 'OAuth apps', 604800, 'feature'], ['seven_day_opus', 'Opus', 604800, 'feature'], ['seven_day_sonnet', 'Sonnet', 604800, 'feature'],
 ] as const;
 
 const keyedWindows = (usage: Record<string, unknown>): IHarnessUsageWindow[] => {
   const windows: IHarnessUsageWindow[] = [];
-  for (const [key, label, durationSeconds, scope] of KEYED_WINDOWS) {
+  for (const [key, subject, durationSeconds, scope] of KEYED_WINDOWS) {
     if (usage[key] == null) continue;
     const window = credentialRecord(usage[key]);
     if (window.utilization == null) continue;
     if (typeof window.utilization !== 'number' || !Number.isFinite(window.utilization) || window.utilization < 0) throw new Error('Unsupported Claude usage utilization.');
-    windows.push({ label, durationSeconds, scope, usedPercent: window.utilization, resetAt: resetTimestamp(window.resets_at) });
+    windows.push({ label: `${subject} ${usageWindowPeriod(durationSeconds)}`, durationSeconds, scope, usedPercent: window.utilization, resetAt: resetTimestamp(window.resets_at) });
   }
   return windows;
 };
 
 /**
- * The limits[] row groups the window model represents: each group's duration, the period word its
- * labels use, and the kind of the group's unscoped account meter, which keeps the plain label.
+ * The limits[] row groups the window model represents: each group's duration, which names its windows,
+ * and the kind of the group's unscoped account meter, which keeps the plain label.
  */
-const LIMIT_GROUPS: ReadonlyMap<string, { durationSeconds: number; period: string; accountKind: string }> = new Map([
-  ['session', { durationSeconds: 18000, period: 'five-hour', accountKind: 'session' }],
-  ['weekly', { durationSeconds: 604800, period: 'weekly', accountKind: 'weekly_all' }],
+const LIMIT_GROUPS: ReadonlyMap<string, { durationSeconds: number; accountKind: string }> = new Map([
+  ['session', { durationSeconds: 18000, accountKind: 'session' }],
+  ['weekly', { durationSeconds: 604800, accountKind: 'weekly_all' }],
 ]);
 
 const isUsageSeverity = (value: unknown): value is TUsageSeverity => value === 'normal' || value === 'warning' || value === 'critical';
@@ -82,8 +83,9 @@ const limitWindows = (rows: readonly unknown[]): IClaudeUsageWindows => {
       continue;
     }
     const severity = row.severity;
+    const period = usageWindowPeriod(meter.durationSeconds);
     windows.push({
-      label: subject === undefined ? `Claude ${meter.period}${kind === meter.accountKind ? '' : ` (${kindName})`}` : `${subject} ${meter.period}`,
+      label: subject === undefined ? `Claude ${period}${kind === meter.accountKind ? '' : ` (${kindName})`}` : `${subject} ${period}`,
       durationSeconds: meter.durationSeconds, scope: subject === undefined ? 'account' : 'feature', usedPercent, resetAt,
       ...(isUsageSeverity(severity) ? { severity } : {}),
       ...(row.is_active === true ? { headline: true as const } : {}),

package/ts/classes.cli.ts

@@ -9,7 +9,7 @@ import { readAccountList } from './classes.accountlist.js';
 import { AccountListRenderer } from './classes.listrenderer.js';
 import { accountLimits, activeAccounts, CondensedRenderer } from './classes.limits.js';
 import { consoleTable } from './consoletable.js';
-import { accountName, credentialDriftNote, duration, orderedUsageWindows, readAccountBadges, until, usagePercentText } from './accounts.js';
+import { accountName, credentialDriftNote, orderedUsageWindows, readAccountBadges, until, usagePercentText } from './accounts.js';
 import { describeHarnessProcesses, describeStopOutcome } from './classes.harnessprocesses.js';
 import { defaultPreusePrompt, PreuseError, validatePreuseOptions } from './preuse.js';
 import { parseCommandArgs, parseDurationOption, parseIntegerOption, UsageError } from './cliargs.js';
@@ -383,7 +383,8 @@ ${bold('Environment')}
           const now = Date.now();
           process.stdout.write('Reset schedule reported after the prompt:\n');
           await consoleTable(this.out, windows, [
-            { key: 'window', title: 'Window', value: row => `${plainText(row.label)} (${duration(row.durationSeconds)})` },
+            // The label already names the window by its length, so the column never repeats it.
+            { key: 'window', title: 'Window', value: row => plainText(row.label) },
             { key: 'usage', title: 'Used', value: row => usagePercentText(row.usedPercent) },
             { key: 'reset', title: 'Reset in', value: row => until(row.resetAt, now) },
           ]);

package/ts/classes.codexstatus.ts

@@ -1,6 +1,7 @@
 import type { ICodexIdentity } from './interfaces.js';
 import type { IHarnessAccountStatus, IHarnessStatusOptions, IHarnessStatusSummary } from './interfaces.harness.js';
 import { commitinfo } from './00_commitinfo_data.js';
+import { usageWindowPeriod } from './accounts.js';
 import { latestRetryAt, retryAtFrom } from './ratelimit.js';
 
 // Verified Chromium-compatible billing request profile, independent of any locally installed browser.
@@ -38,9 +39,13 @@ class StatusRateLimitError extends StatusRequestError {
 }
 
 /**
- * Read-only ChatGPT status contract verified against Codex 0.154.0.
+ * Read-only ChatGPT status contract verified against Codex 0.155.0.
  * These source-defined backend routes are isolated here. No token refresh,
  * credential writes, app-server lifecycle changes or reset consumption occur.
+ *
+ * The service decides how many usage windows an account has: it sends the ones it keeps for that
+ * account, leaving the other slot `null`, so a login whose general quota is a single weekly window is
+ * reported with that one window and no five-hour limit is invented to fill the gap.
  */
 export class CodexAccountStatus {
   constructor(private readonly fetcher: typeof fetch = globalThis.fetch, private readonly now: () => number = Date.now) {}
@@ -184,16 +189,23 @@ export class CodexAccountStatus {
       // The service's own reading of the same windows, so a view that shows the windows need not repeat it.
       facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} usage allowed`, value: boolean(limit.allowed) ? 'yes' : 'no' });
       facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} limit reached`, value: boolean(limit.limit_reached) ? 'yes' : 'no' });
-      for (const [key, name] of [['primary_window', 'primary'], ['secondary_window', 'secondary']]) {
-        if (limit[key] == null) continue;
-        const window = record(limit[key]);
-        const used = numeric(window.used_percent);
-        const durationSeconds = numeric(window.limit_window_seconds);
-        const minutes = durationSeconds / 60;
-        const duration = minutes % 1440 === 0 ? `${minutes / 1440}d` : minutes % 60 === 0 ? `${minutes / 60}h` : `${minutes}m`;
-        const resetAt = timestamp(window.reset_at);
-        usageWindows.push({ label: `${nameArg} ${name}`, scope: scopeArg, durationSeconds, usedPercent: used, resetAt });
-        facts.push({ section: 'Usage', summaryKey: 'usageWindows', label: `${nameArg} ${name} (${duration})`, value: `${used}% used, ${Math.max(0, 100 - used)}% remaining; resets ${resetAt}` });
+      // Both slots are read before either is named: only a second window of the same length makes the
+      // vendor's slot worth showing, and that is decided from the pair.
+      const windows = (['primary_window', 'secondary_window'] as const).flatMap((slotArg) => {
+        if (limit[slotArg] == null) return [];
+        const window = record(limit[slotArg]);
+        return [{
+          slot: slotArg === 'primary_window' ? 'primary' : 'secondary',
+          usedPercent: numeric(window.used_percent), durationSeconds: numeric(window.limit_window_seconds), resetAt: timestamp(window.reset_at),
+        }];
+      });
+      for (const window of windows) {
+        // Named by its length, as Codex names its own windows: a slot carries no length, and which
+        // window the service puts in it varies by plan and by which limit is currently binding.
+        const shared = windows.some(other => other !== window && other.durationSeconds === window.durationSeconds);
+        const label = `${nameArg} ${usageWindowPeriod(window.durationSeconds)}${shared ? ` (${window.slot})` : ''}`;
+        usageWindows.push({ label, scope: scopeArg, durationSeconds: window.durationSeconds, usedPercent: window.usedPercent, resetAt: window.resetAt });
+        facts.push({ section: 'Usage', summaryKey: 'usageWindows', label, value: `${window.usedPercent}% used, ${Math.max(0, 100 - window.usedPercent)}% remaining; resets ${window.resetAt}` });
       }
     };
     appendLimit('Codex', bodyArg.rate_limit, 'account');

package/ts/classes.credentialstore.ts

@@ -62,6 +62,14 @@ export interface IStoredCredential {
   savedAt: string;
   /** Harness-owned payload. This object must never cross the public account interface. */
   credential: Record<string, unknown>;
+  /**
+   * A refresh token of this credential that the provider refused, as a hash -- never the token.
+   *
+   * A grant the provider rejected stays rejected, so replaying it only adds traffic to an auth endpoint, once per
+   * status read for as long as the record holds that token. Remembering it in the record instead of in memory is
+   * what makes that true for the next process too. Every write that replaces the credential drops it.
+   */
+  rejectedGrant?: string;
 }
 
 /** The root of authswitch's own state: `AUTHSWITCH_HOME`, or `~/.authswitch`. */
@@ -89,8 +97,10 @@ export class CredentialStore {
     this.lockTimeoutMs = optionsArg.lockTimeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
   }
   public id(slot: string, identity: string): string { return credentialHash(JSON.stringify([slot, identity])); }
+  /** Whether a value names a credential hash: a rejected grant, or an account id. */
+  private isHash(value: unknown): boolean { return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value); }
   private file(id: string): string {
-    if (!/^[a-f0-9]{64}$/.test(id)) throw new Error('Invalid saved account ID.');
+    if (!this.isHash(id)) throw new Error('Invalid saved account ID.');
     return plugins.path.join(this.dir, `${id}.json`);
   }
   public read(id: string): IStoredCredential {
@@ -99,6 +109,9 @@ export class CredentialStore {
       || !credentialText(value.label) || typeof value.savedAt !== 'string' || !Number.isFinite(Date.parse(value.savedAt))
       || this.id(value.slotId as string, value.identity as string) !== id) throw new Error('Saved account metadata is invalid; restore it from a verified backup.');
     credentialRecord(value.credential);
+    // Advisory state: a rejected grant that is not a hash says nothing about the login and is dropped, never made
+    // the record's problem -- the grant is sent once more instead, which is what a record without one means anyway.
+    if (!this.isHash(value.rejectedGrant)) delete value.rejectedGrant;
     return value as unknown as IStoredCredential;
   }
   public list(): IStoredCredential[] {
@@ -115,7 +128,18 @@ export class CredentialStore {
    * it was saved stay as they are. The caller holds the lock and has checked the record it replaces.
    */
   public replaceCredential(id: string, credential: Record<string, unknown>): IStoredCredential {
-    return this.write({ ...this.read(id), credential }, 'The refreshed login could not be verified after saving it.');
+    const record = this.read(id);
+    // A remembered rejection belongs to the credential it was taken from; the new one has not been refused.
+    delete record.rejectedGrant;
+    return this.write({ ...record, credential }, 'The refreshed login could not be verified after saving it.');
+  }
+  /**
+   * Remembers that the provider refused the refresh token this record holds, as `grantHashArg`. The caller holds the
+   * lock and has checked that the record still holds the token it sent.
+   */
+  public rememberRejectedGrant(id: string, grantHashArg: string): IStoredCredential {
+    if (!this.isHash(grantHashArg)) throw new Error('A rejected grant is remembered as a credential hash.');
+    return this.write({ ...this.read(id), rejectedGrant: grantHashArg }, 'The refused sign-in could not be recorded.');
   }
   private write(record: IStoredCredential, failureArg: string): IStoredCredential {
     plugins.fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });

package/ts/classes.fileharness.ts

@@ -1,4 +1,4 @@
-import type { IAuthHarness, IHarnessAccountStatus, IHarnessCredentialDrift, IHarnessOutcome, IHarnessProcessControl, IHarnessState, IHarnessStatusOptions } from './interfaces.harness.js';
+import type { IAuthHarness, IHarnessAccountStatus, IHarnessCredentialDrift, IHarnessOutcome, IHarnessProcessControl, IHarnessState, IHarnessStatusOptions, THarnessResult } from './interfaces.harness.js';
 import { credentialHash, CredentialStore, type IStoredCredential, type ISwitchRecord } from './classes.credentialstore.js';
 import { pauseSynchronously } from './helpers.js';
 import { plainText } from './formatting.js';
@@ -52,7 +52,7 @@ export abstract class FileHarness implements IAuthHarness {
    * credential out of the stash. Both the retry count and the pause between attempts are bounded; an
    * unstable file is reported, never guessed at.
    */
-  private stableSnapshot(): IFileHarnessSnapshot {
+  protected stableSnapshot(): IFileHarnessSnapshot {
     let failure: unknown;
     for (let attempt = 0; attempt < 5; attempt++) {
       if (attempt) pauseSynchronously(20);
@@ -72,7 +72,11 @@ export abstract class FileHarness implements IAuthHarness {
     if (account.identity !== entry.identity) throw new Error('Saved credential does not match its account identity.');
     return account;
   }
-  public readState(): IHarnessState {
+  /**
+   * The harness's accounts. A subclass may have to bring its own state up to date first -- the Claude Code adapter
+   * mirrors the active login into its saved copy -- which is why this is the interface's `THarnessResult`.
+   */
+  public readState(): THarnessResult<IHarnessState> {
     const snapshot = this.snapshot();
     const saved = this.store.list();
     const accounts: IHarnessState['accounts'] = saved.map(entry => {
@@ -243,9 +247,9 @@ export abstract class FileHarness implements IAuthHarness {
   public removeAccount(id: string): Promise<IHarnessOutcome> {
     return this.outcome(() => { const account = this.store.read(id); this.store.remove(id); return `Removed saved login for ${plainText(account.label)}; the active login is preserved.`; }, false);
   }
-  public diagnose(): IHarnessOutcome {
+  public async diagnose(): Promise<IHarnessOutcome> {
     try {
-      const state = this.readState();
+      const state = await this.readState();
       return { lines: [`${this.label}: ${state.accounts.filter(account => account.isActive).length} active login(s), ${state.accounts.filter(account => account.isStashed).length} saved account(s).`, this.loginHint], problems: state.saveUnavailableReason ? [state.saveUnavailableReason] : [] };
     } catch { return { lines: [], problems: ['Credential storage could not be verified. Check file permissions and saved credential records.'] }; }
   }

package/ts/classes.opencodeharness.ts

@@ -53,7 +53,7 @@ export class OpenCodeHarness extends FileHarness {
   public beginLogin(options: IHarnessLoginOptions = { providerId: 'openai', flow: 'device' }) {
     return beginSavedOpenAiLogin(async result => {
       const saved = await this.importCredential('openai', openCodeCredentialFromLogin(result.credential));
-      const account = this.readState().accounts.find(account => account.id === saved.accountId)!;
+      const account = (await this.readState()).accounts.find(account => account.id === saved.accountId)!;
       return { outcome: { lines: [`Saved OpenAI login for ${plainText(account.label)}. Select it to switch OpenCode.`], problems: [] }, account: { id: account.id, label: account.label, slotId: account.slotId } };
     }, options, this.fetcher);
   }