@modelprofile.com/authswitch 6.4.0 → 7.0.0

package/ts/classes.codexmanaged.ts

@@ -0,0 +1,402 @@
+import * as plugins from './plugins.js';
+import { commitinfo } from './00_commitinfo_data.js';
+import type { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
+
+export interface IAuthSwitchManagedCodexOptions {
+  /** Private runtime root; only the disposable control socket lives here. */
+  runtimeDirectory: string;
+  /** Caller-owned, durable native Codex state home, reserved to one account and scope by SmartData. */
+  codexHomeDirectory: string;
+  workspaceDirectory: string;
+  executable?: string;
+  /** The daemon is the sole owner of this binding and its capability. */
+  broker: AuthSwitchAuthorityBroker;
+  bindingId: string;
+  capability: string;
+  onNotification?: (notification: plugins.crossharness.ICodexAppServerNotification) => void;
+  onServerRequest?: (request: plugins.crossharness.ICodexAppServerRequest,
+    reply: { respond: (result: unknown) => boolean; reject: (code: number, message: string) => boolean }) => void;
+  onUnavailable?: () => void;
+  onPreparedRun: (socketPath: string) => Promise<void>;
+  onChildSpawned: (pid: number, startedAt: string) => Promise<void>;
+}
+
+export interface IAuthSwitchCodexInteractiveCommand {
+  executable: string;
+  args: string[];
+  cwd: string;
+  env: NodeJS.ProcessEnv;
+}
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+const isAlive = (child: plugins.childProcess.ChildProcess): boolean => child.exitCode === null && child.signalCode === null;
+const wait = (ms: number): Promise<void> => new Promise(resolve => setTimeout(resolve, ms));
+
+export type TManagedCodexProcessObservation =
+  | { state: 'absent' }
+  | { state: 'observed'; pid: number; startedAt: string }
+  | { state: 'multiple_claimants' };
+
+const linuxArgv = async (pid: number): Promise<Buffer[] | null> => {
+  let raw: Buffer;
+  try {
+    raw = await plugins.fs.promises.readFile(`/proc/${pid}/cmdline`);
+  } catch (error) {
+    if (isRecord(error) && error.code === 'ENOENT') return null;
+    throw new Error('Managed Codex process argument inspection failed.');
+  }
+  if (raw.length === 0) return [];
+  const argv: Buffer[] = [];
+  let start = 0;
+  for (let index = 0; index < raw.length; index++) {
+    if (raw[index] !== 0) continue;
+    argv.push(raw.subarray(start, index));
+    start = index + 1;
+  }
+  if (start < raw.length) argv.push(raw.subarray(start));
+  return argv;
+};
+
+const claimsManagedCodexSocket = (argv: readonly Buffer[], socketPath: string): boolean => {
+  const command = Buffer.from('app-server');
+  const option = Buffer.from('--listen');
+  const value = Buffer.from(`unix://${socketPath}`);
+  for (let index = 0; index + 2 < argv.length; index++) {
+    if (argv[index].equals(command) && argv[index + 1].equals(option) && argv[index + 2].equals(value)) return true;
+  }
+  return false;
+};
+
+/** Same-user Linux process inspection for a bounded socket set, using exact /proc argv boundaries. */
+export const observeManagedCodexProcesses = async (
+  socketPaths: readonly string[],
+): Promise<Map<string, TManagedCodexProcessObservation>> => {
+  const unique = [...new Set(socketPaths)];
+  if (unique.some(value => typeof value !== 'string' || value.length === 0)) {
+    throw new Error('Managed Codex process selector is invalid.');
+  }
+  if (unique.length === 0) return new Map();
+  if (process.platform !== 'linux') {
+    throw new Error('Exact managed Codex process inspection is available only on Linux.');
+  }
+  const uid = process.getuid?.();
+  if (uid === undefined) throw new Error('Managed Codex process owner inspection is unavailable.');
+  const output = await new Promise<string>((resolve, reject) => {
+    plugins.childProcess.execFile('ps', ['-ww', '-u', String(uid), '-o', 'pid=,lstart='],
+      { timeout: 5_000, maxBuffer: 8 * 1024 * 1024, env: { ...process.env, LC_ALL: 'C' } },
+      (error, stdout) => error ? reject(new Error('Managed Codex process inspection failed.')) : resolve(stdout));
+  });
+  const processes: Array<{ pid: number; startedAt: string; argv: Buffer[] }> = [];
+  for (const line of output.split('\n')) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length !== 6) continue;
+    const pid = Number(parts[0]);
+    const date = Date.parse(parts.slice(1, 6).join(' '));
+    if (Number.isSafeInteger(pid) && pid > 0 && Number.isFinite(date)) {
+      const argv = await linuxArgv(pid);
+      if (argv) processes.push({ pid, startedAt: new Date(date).toISOString(), argv });
+    }
+  }
+  const result = new Map<string, TManagedCodexProcessObservation>();
+  for (const socketPath of unique) {
+    const matches = processes.filter(process => claimsManagedCodexSocket(process.argv, socketPath));
+    result.set(socketPath, matches.length === 0
+      ? { state: 'absent' }
+      : matches.length === 1
+        ? { state: 'observed', pid: matches[0].pid, startedAt: matches[0].startedAt }
+        : { state: 'multiple_claimants' });
+  }
+  return result;
+};
+
+/** Same-user process inspection: a unique private --listen socket is the pre-PID crash identity. */
+export const findManagedCodexProcess = async (socketPath: string): Promise<{ pid: number; startedAt: string } | null> => {
+  const observed = (await observeManagedCodexProcesses([socketPath])).get(socketPath);
+  if (!observed || observed.state === 'absent') return null;
+  if (observed.state === 'multiple_claimants') {
+    throw new Error('Multiple managed Codex processes claim one private socket.');
+  }
+  return { pid: observed.pid, startedAt: observed.startedAt };
+};
+
+/** Daemon-owned Codex app-server. Only access tokens, never refresh grants, enter Codex. */
+export class AuthSwitchManagedCodex {
+  private child?: plugins.childProcess.ChildProcess;
+  private childExited?: Promise<void>;
+  private client?: plugins.crossharness.CodexAppServerClient;
+  private runDirectory?: string;
+  private homeDirectory?: string;
+  private socketPath?: string;
+  private workspaceId?: string;
+  private grantedGeneration?: number;
+  private startPromise?: Promise<void>;
+  private closePromise?: Promise<void>;
+  private closed = false;
+  private ready = false;
+
+  constructor(private readonly options: IAuthSwitchManagedCodexOptions) {
+    if (!plugins.path.isAbsolute(options.runtimeDirectory) || !plugins.path.isAbsolute(options.workspaceDirectory)
+      || !plugins.path.isAbsolute(options.codexHomeDirectory)) {
+      throw new Error('Managed Codex requires absolute runtime, home and workspace directories.');
+    }
+  }
+
+  public get isReady(): boolean { return this.ready && this.client?.state === 'connected' && !this.closed; }
+
+  private environment(): NodeJS.ProcessEnv {
+    const picked: NodeJS.ProcessEnv = {};
+    for (const key of ['PATH', 'HOME', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'TERM', 'TMPDIR', 'XDG_RUNTIME_DIR']) {
+      if (process.env[key] !== undefined) picked[key] = process.env[key];
+    }
+    picked.CODEX_HOME = this.homeDirectory;
+    return picked;
+  }
+
+  private async requireVersion(): Promise<void> {
+    const executable = this.options.executable ?? 'codex';
+    const output = await new Promise<string>((resolve, reject) => {
+      plugins.childProcess.execFile(executable, ['--version'], { timeout: 5_000, maxBuffer: 4096,
+        windowsHide: true, env: this.environment() }, (error, stdout) => {
+        if (error) reject(new Error('Managed Codex version probe failed.'));
+        else resolve(stdout.trim());
+      });
+    });
+    if (output !== 'codex-cli 0.155.1') throw new Error('Managed Codex requires verified codex-cli 0.155.1.');
+  }
+
+  public start(): Promise<void> {
+    if (this.closed || this.startPromise) throw new Error('Managed Codex can start only once.');
+    this.startPromise = this.performStart();
+    return this.startPromise;
+  }
+
+  private async performStart(): Promise<void> {
+    try {
+      const root = this.options.runtimeDirectory;
+      await plugins.fs.promises.mkdir(root, { recursive: true, mode: 0o700 });
+      const rootStat = await plugins.fs.promises.lstat(root);
+      if (!rootStat.isDirectory() || rootStat.isSymbolicLink() || rootStat.uid !== process.getuid?.()) {
+        throw new Error('Managed Codex runtime directory is not private.');
+      }
+      await plugins.fs.promises.chmod(root, 0o700);
+      this.runDirectory = await plugins.fs.promises.mkdtemp(plugins.path.join(root, 'codex-'));
+      await plugins.fs.promises.chmod(this.runDirectory, 0o700);
+      this.homeDirectory = this.options.codexHomeDirectory;
+      this.socketPath = plugins.path.join(this.runDirectory, 'app.sock');
+      if (Buffer.byteLength(this.socketPath, 'utf8') > 100) throw new Error('Managed Codex socket path is too long.');
+      const homeStat = await plugins.fs.promises.lstat(this.homeDirectory);
+      if (!homeStat.isDirectory() || homeStat.isSymbolicLink() || homeStat.uid !== process.getuid?.()
+        || (homeStat.mode & 0o077) !== 0 || await plugins.fs.promises.realpath(this.homeDirectory) !== this.homeDirectory) {
+        throw new Error('Managed Codex home is not a private owned directory.');
+      }
+      try { await plugins.fs.promises.lstat(plugins.path.join(this.homeDirectory, 'auth.json'));
+        throw new Error('Managed Codex home contains a native credential file.');
+      } catch (error) {
+        if (!isRecord(error) || error.code !== 'ENOENT') throw error;
+      }
+      await this.requireVersion();
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      const initial = await this.options.broker.resolveAccess(this.options.bindingId,
+        this.options.capability, 60_000);
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      this.workspaceId = initial.accountId;
+      this.grantedGeneration = initial.grantGeneration;
+      await this.options.onPreparedRun(this.socketPath);
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      const child = plugins.childProcess.spawn(this.options.executable ?? 'codex', [
+        'app-server', '--listen', `unix://${this.socketPath}`, '--strict-config',
+        '-c', 'cli_auth_credentials_store="ephemeral"',
+      ], { cwd: this.options.workspaceDirectory, env: this.environment(), shell: false,
+        detached: process.platform !== 'win32', stdio: 'ignore', windowsHide: true });
+      this.child = child;
+      this.childExited = new Promise(resolve => {
+        child.once('error', () => resolve());
+        child.once('exit', () => resolve());
+      });
+      if (!child.pid) throw new Error('Managed Codex app-server process has no PID.');
+      let observed: Awaited<ReturnType<typeof findManagedCodexProcess>> = null;
+      for (let attempt = 0; attempt < 20 && !observed; attempt++) {
+        observed = await findManagedCodexProcess(this.socketPath);
+        if (!observed) await wait(25);
+      }
+      if (!observed || observed.pid !== child.pid) throw new Error('Managed Codex app-server process identity could not be verified.');
+      await this.options.onChildSpawned(observed.pid, observed.startedAt);
+      const deadline = Date.now() + 10_000;
+      while (true) {
+        if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+        if (!isAlive(child)) throw new Error('Managed Codex app-server exited before accepting connections.');
+        try {
+          if ((await plugins.fs.promises.lstat(this.socketPath)).isSocket()) break;
+        } catch (error) {
+          if (!isRecord(error) || error.code !== 'ENOENT') throw error;
+        }
+        if (Date.now() >= deadline) throw new Error('Managed Codex app-server socket startup timed out.');
+        await wait(25);
+      }
+      const client = new plugins.crossharness.CodexAppServerClient({
+        transport: { type: 'unix', socketPath: this.socketPath },
+        clientInfo: { name: 'authswitch', title: 'Authswitch', version: commitinfo.version },
+        experimentalApi: true, handshakeTimeoutMs: 5_000, initializeTimeoutMs: 5_000,
+        onNotification: notification => this.options.onNotification?.(notification),
+        onServerRequest: request => { void this.handleServerRequest(request); },
+        onClose: () => {
+          const wasReady = this.ready;
+          this.ready = false;
+          if (wasReady && !this.closed) this.options.onUnavailable?.();
+        },
+      });
+      this.client = client;
+      await client.connect();
+      if (client.serverVersion !== '0.155.1') throw new Error('Managed Codex app-server version changed.');
+      const login: unknown = await client.request('account/login/start', {
+        type: 'chatgptAuthTokens', accessToken: initial.accessToken, chatgptAccountId: initial.accountId,
+      }, 5_000);
+      if (!isRecord(login) || login.type !== 'chatgptAuthTokens') {
+        throw new Error('Managed Codex external-token login was not acknowledged.');
+      }
+      if (this.closed) throw new Error('Managed Codex startup was cancelled.');
+      this.ready = true;
+    } catch (error) {
+      try { await this.close(); } catch (cleanupError) {
+        throw new AggregateError([error, cleanupError], 'Managed Codex startup and cleanup failed.');
+      }
+      throw error;
+    }
+  }
+
+  private async handleServerRequest(request: plugins.crossharness.ICodexAppServerRequest): Promise<void> {
+    const client = this.client;
+    if (!client || this.closed || !this.ready) return;
+    if (request.method !== 'account/chatgptAuthTokens/refresh') {
+      if (!this.options.onServerRequest) {
+        client.rejectRequest(request.id, -32601, 'Managed Codex request requires an owner handler.');
+        return;
+      }
+      try {
+        this.options.onServerRequest(request, {
+          respond: result => client.respond(request.id, result),
+          reject: (code, message) => client.rejectRequest(request.id, code, message),
+        });
+      } catch {
+        client.rejectRequest(request.id, -32603, 'Managed Codex owner request failed.');
+      }
+      return;
+    }
+    const prior = this.grantedGeneration;
+    const workspaceId = this.workspaceId;
+    const params = request.params;
+    if (params.reason !== 'unauthorized' || !workspaceId || prior === undefined
+      || (params.previousAccountId !== undefined && params.previousAccountId !== null
+        && params.previousAccountId !== workspaceId)) {
+      client.rejectRequest(request.id, -32602, 'Managed Codex account identity is invalid.');
+      return;
+    }
+    try {
+      const refreshed = await this.options.broker.resolveAccess(this.options.bindingId,
+        this.options.capability, 60_000, prior);
+      if (this.closed || request.signal.aborted) return;
+      if (refreshed.accountId !== workspaceId || refreshed.grantGeneration <= prior) {
+        client.rejectRequest(request.id, -32603, 'Managed Codex account refresh did not advance.');
+        return;
+      }
+      this.grantedGeneration = refreshed.grantGeneration;
+      client.respond(request.id, { accessToken: refreshed.accessToken,
+        chatgptAccountId: refreshed.accountId, chatgptPlanType: null });
+    } catch {
+      if (!request.signal.aborted) client.rejectRequest(request.id, -32603, 'Managed Codex account needs reauthentication.');
+    }
+  }
+
+  /** The interactive CLI attaches to the owned app-server; the daemon remains its auth control peer. */
+  public interactiveCommand(): IAuthSwitchCodexInteractiveCommand {
+    if (!this.isReady || !this.socketPath) throw new Error('Managed Codex is unavailable.');
+    return { executable: this.options.executable ?? 'codex', args: ['--remote', `unix://${this.socketPath}`],
+      cwd: this.options.workspaceDirectory, env: this.environment() };
+  }
+
+  /** Native app-server thread/turn API for noninteractive consumers; notifications go to onNotification. */
+  public async startThread(options: { approvalPolicy: 'never' | 'on-request'; model?: string;
+    signal?: AbortSignal }): Promise<string> {
+    if (!this.isReady || !this.client || !options || !['never', 'on-request'].includes(options.approvalPolicy)
+      || (options.model !== undefined && (typeof options.model !== 'string' || options.model.length > 128))) {
+      throw new Error('Managed Codex thread request is unavailable or invalid.');
+    }
+    const started: unknown = await this.client.request('thread/start', {
+      cwd: this.options.workspaceDirectory, approvalPolicy: options.approvalPolicy,
+      ...(options.model ? { model: options.model } : {}),
+    }, 30_000, options.signal);
+    if (!isRecord(started) || !isRecord(started.thread) || typeof started.thread.id !== 'string') {
+      throw new Error('Managed Codex returned an invalid thread.');
+    }
+    return started.thread.id;
+  }
+
+  public async resumeThread(threadId: string, options: { approvalPolicy: 'never' | 'on-request';
+    model?: string; signal?: AbortSignal }): Promise<void> {
+    if (!this.isReady || !this.client || typeof threadId !== 'string' || !threadId || threadId.length > 256
+      || !options || !['never', 'on-request'].includes(options.approvalPolicy)
+      || (options.model !== undefined && (typeof options.model !== 'string' || options.model.length > 128))) {
+      throw new Error('Managed Codex resume request is unavailable or invalid.');
+    }
+    const resumed: unknown = await this.client.request('thread/resume', { threadId,
+      cwd: this.options.workspaceDirectory, approvalPolicy: options.approvalPolicy,
+      ...(options.model ? { model: options.model } : {}),
+    }, 30_000, options.signal);
+    if (!isRecord(resumed) || !isRecord(resumed.thread) || resumed.thread.id !== threadId) {
+      throw new Error('Managed Codex could not resume the requested thread from its assigned home.');
+    }
+  }
+
+  public async startTextTurn(text: string, options: { approvalPolicy: 'never' | 'on-request';
+    model?: string; threadId?: string; signal?: AbortSignal }): Promise<{ threadId: string; turnId: string }> {
+    if (!this.isReady || !this.client || typeof text !== 'string' || !text.trim() || text.length > 1_000_000
+      || !options || !['never', 'on-request'].includes(options.approvalPolicy)
+      || (options.model !== undefined && (typeof options.model !== 'string' || options.model.length > 128))
+      || (options.threadId !== undefined && (typeof options.threadId !== 'string' || options.threadId.length > 256))) {
+      throw new Error('Managed Codex turn request is unavailable or invalid.');
+    }
+    let threadId = options.threadId;
+    if (threadId) {
+      await this.resumeThread(threadId, options);
+    } else {
+      threadId = await this.startThread(options);
+    }
+    const turn: unknown = await this.client.request('turn/start', { threadId,
+      input: [{ type: 'text', text, text_elements: [] }],
+      approvalPolicy: options.approvalPolicy,
+      ...(options.model ? { model: options.model } : {}),
+    }, 30_000, options.signal);
+    if (!isRecord(turn) || !isRecord(turn.turn) || typeof turn.turn.id !== 'string') {
+      throw new Error('Managed Codex returned an invalid turn.');
+    }
+    return { threadId, turnId: turn.turn.id };
+  }
+
+  public close(): Promise<void> {
+    if (this.closePromise) return this.closePromise;
+    const wasReady = this.ready;
+    this.closed = true;
+    this.ready = false;
+    this.closePromise = this.performClose();
+    if (wasReady) this.options.onUnavailable?.();
+    return this.closePromise;
+  }
+
+  private async performClose(): Promise<void> {
+    this.client?.close('Managed Codex stopped.');
+    const child = this.child;
+    if (child && isAlive(child) && child.pid) {
+      try { process.kill(process.platform === 'win32' ? child.pid : -child.pid, 'SIGTERM'); }
+      catch (error) { if (!isRecord(error) || error.code !== 'ESRCH') throw error; }
+      await Promise.race([this.childExited, wait(3_000)]);
+      if (isAlive(child)) {
+        try { process.kill(process.platform === 'win32' ? child.pid : -child.pid, 'SIGKILL'); }
+        catch (error) { if (!isRecord(error) || error.code !== 'ESRCH') throw error; }
+        await Promise.race([this.childExited, wait(3_000)]);
+      }
+      if (isAlive(child)) throw new Error('Managed Codex process did not stop.');
+    }
+    if (this.runDirectory) await plugins.fs.promises.rm(this.runDirectory, { recursive: true, force: true });
+  }
+}

package/ts/classes.codexpreuse.ts

@@ -3,6 +3,11 @@ import type { ICodexIdentity } from './interfaces.js';
 import type { IHarnessPreuseOptions, IHarnessPreuseResult } from './interfaces.harness.js';
 import { PreuseError, validatePreuseOptions } from './preuse.js';
 
+export interface ICodexPreuseLifecycle {
+  /** Persist the may-have-started marker before the inference API is invoked. */
+  beforeRequest(model: string): Promise<void>;
+}
+
 /** One tool-free request through the FlexHarness ChatGPT provider, with no credential writes. */
 export class CodexPreuse {
   constructor(private readonly fetcher: typeof fetch = globalThis.fetch) {}
@@ -11,9 +16,6 @@ export class CodexPreuse {
     validatePreuseOptions(optionsArg);
     if (identityArg.kind !== 'chatgpt') throw new PreuseError('Codex preuse requires a ChatGPT subscription login; API-key logins have no subscription reset window.');
     if (!identityArg.accountId) throw new PreuseError('This login has no account ID for preuse.');
-    const signal = optionsArg.signal
-      ? AbortSignal.any([optionsArg.signal, AbortSignal.timeout(180_000)])
-      : AbortSignal.timeout(180_000);
     let credentials: plugins.flexAuth.IOpenAiChatGptAuthCredentials;
     let oauth: plugins.flexAccounts.IOpenAiChatGptOAuthCredential;
     try {
@@ -24,12 +26,37 @@ export class CodexPreuse {
     } catch {
       throw new PreuseError('No complete, matching Codex login is available for preuse. Log in again with Codex and save the account.');
     }
+    return this.runCredential(oauth, credentials, optionsArg);
+  }
+
+  /** Authority-owned access grants contain no refresh token and are never serialized by this helper. */
+  public async runAccess(credentialArg: plugins.flexAccounts.IOpenAiChatGptAccessCredential,
+    optionsArg: IHarnessPreuseOptions, lifecycleArg: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult> {
+    validatePreuseOptions(optionsArg);
+    if (!credentialArg || credentialArg.kind !== 'chatgptAccess' || credentialArg.providerId !== 'openai'
+      || typeof credentialArg.accessToken !== 'string' || !credentialArg.accessToken
+      || typeof credentialArg.accountId !== 'string' || !credentialArg.accountId
+      || typeof credentialArg.isFedrampAccount !== 'boolean') {
+      throw new PreuseError('No complete, matching Codex login is available for preuse. Log in again with Codex and save the account.');
+    }
+    return this.runCredential(credentialArg, {
+      accessToken: credentialArg.accessToken, accountId: credentialArg.accountId,
+      isFedrampAccount: credentialArg.isFedrampAccount,
+    }, optionsArg, lifecycleArg);
+  }
+
+  private async runCredential(readCredentialArg: plugins.flexAccounts.TOpenAiChatGptReadCredential,
+    credentialsArg: plugins.flexAuth.IOpenAiChatGptAuthCredentials, optionsArg: IHarnessPreuseOptions,
+    lifecycleArg?: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult> {
+    const signal = optionsArg.signal
+      ? AbortSignal.any([optionsArg.signal, AbortSignal.timeout(180_000)])
+      : AbortSignal.timeout(180_000);
     let model = optionsArg.model;
     let reasoningEffort: string | undefined;
     if (!model) {
       const adapter = new plugins.flexAccounts.OpenAiProviderAdapter({ fetch: this.fetcher });
       try {
-        const catalog = await adapter.listModels(oauth, { signal, timeoutMs: 10_000 });
+        const catalog = await adapter.listModels(readCredentialArg, { signal, timeoutMs: 10_000 });
         if (!catalog.success) throw new PreuseError(catalog.errorCode === 'CREDENTIAL_REFRESH_REQUIRED'
           ? 'The saved login has expired. Log in again with Codex and save it before preuse.'
           : 'Could not read the account model catalog. No preuse prompt was sent.');
@@ -45,9 +72,10 @@ export class CodexPreuse {
     let requestStarted = false;
     try {
       signal.throwIfAborted();
-      const connection = plugins.flexAuth.createOpenAiChatGptModelConnection(credentials);
+      const connection = plugins.flexAuth.createOpenAiChatGptModelConnection(credentialsArg);
       connection.settings.fetch = this.fetcher;
       const languageModel = plugins.flexOpenAi.createOpenAiModelProvider().getModel({ provider: 'openai', model, connection });
+      await lifecycleArg?.beforeRequest(model);
       requestStarted = true;
       const stream = plugins.flexModels.streamText({
         model: languageModel,

package/ts/classes.fileharness.ts

@@ -6,6 +6,8 @@ import { plainText } from './formatting.js';
 export interface IFileAccount {
   slotId: string;
   identity: string;
+  /** Exact provider-native account identifier when the credential carries one. */
+  providerAccountId: string | null;
   label: string;
   credential: Record<string, unknown>;
 }
@@ -80,14 +82,16 @@ export abstract class FileHarness implements IAuthHarness {
     const snapshot = this.snapshot();
     const saved = this.store.list();
     const accounts: IHarnessState['accounts'] = saved.map(entry => {
-      this.saved(entry);
-      return { id: entry.id, slotId: entry.slotId, label: entry.label, isActive: false, isStashed: true, savedAt: entry.savedAt, details: [`Provider: ${entry.slotId}`] };
+      const account = this.saved(entry);
+      return { id: entry.id, providerAccountId: account.providerAccountId, slotId: entry.slotId, label: entry.label,
+        isActive: false, isStashed: true, savedAt: entry.savedAt, details: [`Provider: ${entry.slotId}`] };
     });
     for (const active of snapshot.accounts) {
       const id = this.store.id(active.slotId, active.identity);
       const existing = accounts.find(account => account.id === id);
       if (existing) { existing.isActive = true; existing.label = active.label; }
-      else accounts.unshift({ id, slotId: active.slotId, label: active.label, isActive: true, isStashed: false, savedAt: null, details: [`Provider: ${active.slotId}`] });
+      else accounts.unshift({ id, providerAccountId: active.providerAccountId, slotId: active.slotId, label: active.label,
+        isActive: true, isStashed: false, savedAt: null, details: [`Provider: ${active.slotId}`] });
     }
     for (const account of accounts) {
       if (accounts.some(other => other.id !== account.id && other.label === account.label)) account.details.push(`Account ID: ${account.id}`);

package/ts/classes.limits.ts

@@ -52,6 +52,7 @@ const accountKeys = (harnessArg: IHarnessAccountList, accountArg: TListedAccount
   harnessId: harnessArg.id,
   provider: providerName(harnessArg, accountArg),
   account: plainText(accountArg.label),
+  providerAccountId: accountArg.providerAccountId,
   accountId: accountArg.id,
   ...(accountArg.slotId === undefined ? {} : { slotId: plainText(accountArg.slotId) }),
 });
@@ -164,11 +165,13 @@ export const accountLimits = (listArg: IAccountList, harnessesArg: readonly THar
       limitType: null, scope: null, windowSeconds: null, usedPercent: null, resetAt: null, resetsIn: UNAVAILABLE, severity: null, headline: false,
     } as const;
     if (problem !== null) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, billing: null, ...empty, unavailableReason: problem });
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, isActive: false, accountType: null, billing: null, ...empty, unavailableReason: problem });
       continue;
     }
     if (!harness.accounts.length) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, billing: null, ...empty,
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, isActive: false, accountType: null, billing: null, ...empty,
         unavailableReason: harness.saveUnavailableReason === null ? 'No accounts are known for this harness.' : plainText(harness.saveUnavailableReason) });
       continue;
     }
@@ -192,7 +195,7 @@ export const accountLimits = (listArg: IAccountList, harnessesArg: readonly THar
     }
   }
   const limits = byProviderThenAccount(rows);
-  return { schemaVersion: 1, generatedAt: listArg.generatedAt, complete: listArg.complete, limits, notes: [...collectNotes(limits), ...renewalNotes] };
+  return { schemaVersion: 2, generatedAt: listArg.generatedAt, complete: listArg.complete, limits, notes: [...collectNotes(limits), ...renewalNotes] };
 };
 
 /**
@@ -214,14 +217,16 @@ export const activeAccounts = (listArg: IAccountList, harnessesArg: readonly THa
       return index < 0 ? null : activeDrift(traits, drifts.splice(index, 1)[0]);
     };
     if (problem !== null) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, accountType: null, savedAt: null, savedAgo: UNAVAILABLE, source: 'none', unavailableReason: problem, drift: null });
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, accountType: null, savedAt: null, savedAgo: UNAVAILABLE, source: 'none', unavailableReason: problem, drift: null });
       continue;
     }
     const active = harness.accounts.filter(account => account.isActive);
     if (!active.length) {
       const stashed = harness.accounts.filter(account => account.isStashed);
       rows.push({
-        harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, accountType: null,
+        harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, accountType: null,
         savedAt: null, savedAgo: UNAVAILABLE, source: stashed.length ? 'stash only' : 'none',
         unavailableReason: harness.saveUnavailableReason !== null ? plainText(harness.saveUnavailableReason)
           : stashed.length ? `No login is active; ${stashed.length} saved account(s) can be activated with authswitch ${plainText(harness.id)} use.`
@@ -245,7 +250,7 @@ export const activeAccounts = (listArg: IAccountList, harnessesArg: readonly THa
   const active = byProviderThenAccount(rows);
   const driftNotes = active.filter(row => row.drift !== null)
     .map(row => `${row.provider}${row.account === null ? '' : ` · ${row.account}`}: ${row.drift!.reason}`);
-  return { schemaVersion: 1, generatedAt: listArg.generatedAt, complete: listArg.complete, active, notes: [...collectNotes(active), ...driftNotes, ...unattached] };
+  return { schemaVersion: 2, generatedAt: listArg.generatedAt, complete: listArg.complete, active, notes: [...collectNotes(active), ...driftNotes, ...unattached] };
 };
 
 /**

package/ts/classes.opencodeharness.ts

@@ -100,7 +100,7 @@ export class OpenCodeHarness extends FileHarness {
     const fingerprint = credentialHash(secret);
     const identity = info.accountId ? `oauth:${info.accountId}` : `${type}:${fingerprint}`;
     const label = info.email ?? (info.accountId ? `openai:${info.accountId}` : `${slotId} ${type === 'api' ? 'API key' : type} ${fingerprint.slice(0, 12)}`);
-    return { slotId, identity, label, credential };
+    return { slotId, identity, providerAccountId: info.accountId ?? null, label, credential };
   }
   protected snapshot(): IFileHarnessSnapshot {
     if (this.env.OPENCODE_AUTH_CONTENT !== undefined) return { accounts: [], unavailable: 'OPENCODE_AUTH_CONTENT overrides the credential file. Unset it before managing file logins.' };

package/ts/claudehttp.ts

@@ -1,10 +1,17 @@
 import { commitinfo } from './00_commitinfo_data.js';
-import { credentialRecord } from './classes.credentialstore.js';
 import { retryAtFrom } from './ratelimit.js';
 
 /** A fixed, local diagnostic. Nothing a service sent (a body, a header) and no request header ever becomes one. */
 export class ClaudeRequestError extends Error {}
 
+/** A rotating refresh POST is never assumed unsent after fetch has been invoked. */
+export type TClaudeRotatingRequestOutcome = 'notSent' | 'outcomeUnknown';
+export class ClaudeRotatingRequestError extends ClaudeRequestError {
+  constructor(message: string, public readonly requestOutcome: TClaudeRotatingRequestOutcome) {
+    super(message);
+  }
+}
+
 /** How every Claude lookup reports a login the service does not accept (HTTP 401, or a refresh grant it rejected). */
 export const CLAUDE_LOGIN_REJECTED = 'Login expired or was rejected. Log in again with Claude Code and save it.';
 
@@ -80,7 +87,11 @@ const jsonBody = async (responseArg: Response, subjectArg: string): Promise<Reco
       chunks.push(part.value);
     }
   } finally { reader.releaseLock(); }
-  try { return credentialRecord(JSON.parse(Buffer.concat(chunks).toString('utf8'))); }
+  try {
+    const parsed: unknown = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown> : null;
+  }
   catch { return null; }
 };
 
@@ -112,3 +123,21 @@ export const claudeRequest = async (fetcherArg: typeof fetch, requestArg: IClaud
     throw new ClaudeRequestError(`The ${requestArg.subject} service could not be reached.`);
   }
 };
+
+/** Use only after the authority has durably committed its pre-send attempt marker. */
+export const claudeRotatingRequest = async (fetcherArg: typeof fetch,
+  requestArg: IClaudeRequest & { method: 'POST' }): Promise<IClaudeResponse> => {
+  if (requestArg.signal?.aborted) {
+    throw new ClaudeRotatingRequestError('The Claude sign-in request was cancelled before sending.', 'notSent');
+  }
+  let invoked = false;
+  const observedFetch: typeof fetch = (input, init) => {
+    invoked = true;
+    return fetcherArg(input, init);
+  };
+  try { return await claudeRequest(observedFetch, requestArg); }
+  catch (error) {
+    const message = error instanceof ClaudeRequestError ? error.message : 'The Claude sign-in request failed.';
+    throw new ClaudeRotatingRequestError(message, invoked ? 'outcomeUnknown' : 'notSent');
+  }
+};

package/ts/index.ts

@@ -24,12 +24,19 @@ export * from './classes.watch.js';
 export * from './classes.watchlock.js';
 export * from './watchpolicy.js';
 export * from './classes.authorityclient.js';
+export * from './classes.authoritycli.js';
+export * from './classes.authoritydaemon.js';
 export * from './classes.authorityservice.js';
 
 import { AuthSwitchCli } from './classes.cli.js';
+import { runAuthSwitchAuthorityCli } from './classes.authoritycli.js';
 import { AuthSwitchAuthorityService, resolveAuthSwitchAuthorityPaths, runAuthSwitchAuthorityDaemon } from './classes.authorityservice.js';
 
 export const runCli = async (argvArg: string[] = process.argv.slice(2)): Promise<void> => {
+  if (argvArg[0] === 'account' || (argvArg[0] === 'authority' && argvArg[1] === 'doctor')) {
+    process.exitCode = await runAuthSwitchAuthorityCli(argvArg);
+    return;
+  }
   if (argvArg[0] === 'authority') {
     const paths = resolveAuthSwitchAuthorityPaths();
     if (argvArg[1] === 'daemon' && argvArg.length === 2) {

package/ts/interfaces.harness.ts

@@ -73,7 +73,13 @@ export interface IHarnessCredentialDrift {
 
 /** Account IDs are opaque and scoped to one harness. Credentials never cross this interface. */
 export interface IHarnessAccount {
+  /** Opaque authswitch identifier used for harness operations. */
   id: string;
+  /**
+   * Stable account identifier reported by the provider, scoped by this harness and `slotId`.
+   * Null means the credential carries no exact provider identity. Never infer it from `id` or `label`.
+   */
+  providerAccountId: string | null;
   label: string;
   /** Accounts in different slots can be active together (for example OpenCode providers). */
   slotId?: string;