@modelprofile.com/authswitch 6.5.0 → 8.0.0

package/ts/classes.claudestatus.ts

@@ -108,7 +108,7 @@ const claudeUsageWindows = (usage: Record<string, unknown>): IClaudeUsageWindows
 type TClaudeProfile =
   | { kind: 'found'; plan: string | undefined; facts: IHarnessStatusFact[] }
   | { kind: 'mismatch' }
-  | { kind: 'unavailable'; problem: string };
+  | { kind: 'unavailable'; problem: string; credentialRejected: boolean };
 
 /**
  * One Claude OAuth login as a status lookup needs it: the token to ask with, and what the store that keeps it knows
@@ -125,6 +125,14 @@ export interface IClaudeLogin {
   plan?: string;
 }
 
+/** Structured proof from the same profile and usage requests used for harness status. */
+export interface IClaudeStatusRead {
+  status: IHarnessAccountStatus;
+  profile: 'verified' | 'unverified' | 'mismatch' | 'unavailable' | 'unsupported_scope';
+  usage: 'available' | 'unavailable' | 'unsupported_scope';
+  credentialRejected: boolean;
+}
+
 /**
  * How long a session reuses an account's profile. The watch polls every few minutes, and the profile (plan,
  * organization, billing type) changes far more rarely, so it is read at most hourly there.
@@ -167,7 +175,8 @@ export class ClaudeAccountStatus {
     let body: Record<string, unknown>;
     try { body = await this.get('profile', loginArg.accessToken, signal); }
     catch (error) {
-      if (error instanceof ClaudeLoginRejectedError) return { kind: 'unavailable', problem: `Profile: ${error.message}` };
+      if (error instanceof ClaudeLoginRejectedError) return { kind: 'unavailable',
+        problem: `Profile: ${error.message}`, credentialRejected: true };
       throw error;
     }
     try {
@@ -181,7 +190,8 @@ export class ClaudeAccountStatus {
         if (credentialText(value)) facts.push({ section: 'Account', label: String(label), value: String(value) });
       }
       return { kind: 'found', plan: credentialText(organization.organization_type)?.replace(/^claude_/, ''), facts };
-    } catch { return { kind: 'unavailable', problem: 'Claude profile response is unsupported; no profile values were inferred.' }; }
+    } catch { return { kind: 'unavailable',
+      problem: 'Claude profile response is unsupported; no profile values were inferred.', credentialRejected: false }; }
   }
 
   /** The plan the login was saved with, the only one known while the service cannot be asked. */
@@ -195,25 +205,43 @@ export class ClaudeAccountStatus {
   }
 
   public async read(loginArg: IClaudeLogin, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
+    return (await this.readDetailed(loginArg, optionsArg)).status;
+  }
+
+  /** One request pair; callers requiring immutable identity use the proof rather than display text. */
+  public async readDetailed(loginArg: IClaudeLogin,
+    optionsArg: IHarnessStatusOptions = {}): Promise<IClaudeStatusRead> {
     const result: IHarnessAccountStatus = { facts: [], problems: [], ...this.storedSummary(loginArg) };
     // Only a store that keeps the login's scopes can tell beforehand that the service will not answer about the account.
     if (loginArg.scopes.length && !loginArg.scopes.includes('user:profile')) {
       result.facts.push({ section: 'Availability', label: 'Live account status', value: 'This login lacks the user:profile scope. Log in through Claude Code to obtain subscriber status.' });
-      return result;
+      return { status: result, profile: 'unsupported_scope', usage: 'unsupported_scope', credentialRejected: false };
     }
     const token = credentialText(loginArg.accessToken);
-    if (!token) return { facts: [], problems: ['No usable Claude Code access token is available.'] };
+    if (!token) return { status: { facts: [], problems: ['No usable Claude Code access token is available.'] },
+      profile: 'unavailable', usage: 'unavailable', credentialRejected: false };
     const [profile, usage] = await Promise.allSettled([this.profile(loginArg, optionsArg), this.get('usage', token, optionsArg.signal)]);
     const failure = (reason: unknown): string => reason instanceof ClaudeRequestError ? reason.message : 'Lookup failed.';
+    let profileOutcome: IClaudeStatusRead['profile'] = 'unavailable';
+    let usageOutcome: IClaudeStatusRead['usage'] = 'unavailable';
+    let credentialRejected = usage.status === 'rejected' && usage.reason instanceof ClaudeLoginRejectedError;
     if (profile.status === 'fulfilled') {
       const found = profile.value;
-      if (found.kind === 'mismatch') return { facts: [], problems: [MISMATCH] };
-      if (found.kind === 'unavailable') result.problems.push(found.problem);
+      if (found.kind === 'mismatch') return { status: { facts: [], problems: [MISMATCH] },
+        profile: 'mismatch', usage: 'unavailable', credentialRejected: false };
+      if (found.kind === 'unavailable') {
+        result.problems.push(found.problem);
+        credentialRejected ||= found.credentialRejected;
+      }
       else {
+        profileOutcome = loginArg.identity ? 'verified' : 'unverified';
         if (found.plan) result.summary = { ...result.summary, subscription: { plan: found.plan, source: 'live' } };
         result.facts.push(...found.facts.map(fact => ({ ...fact })));
       }
-    } else result.problems.push(`Profile: ${failure(profile.reason)}`);
+    } else {
+      result.problems.push(`Profile: ${failure(profile.reason)}`);
+      credentialRejected ||= profile.reason instanceof ClaudeLoginRejectedError;
+    }
     if (usage.status === 'fulfilled') {
       try {
         const { windows, unsupported } = claudeUsageWindows(usage.value);
@@ -232,12 +260,13 @@ export class ClaudeAccountStatus {
           if (limit !== undefined && limit > 0 && used !== undefined) result.facts.push({ section: 'Extra usage', label: 'Monthly budget used', value: `${Math.round(used / limit * 10000) / 100}%` });
         }
         if (unsupported.length) result.facts.push({ section: 'Availability', label: 'Unsupported limits', value: `The service returned limits without a supported reset window, which are not shown: ${unsupported.join(', ')}.` });
+        usageOutcome = 'available';
       } catch { result.problems.push('Claude usage response is unsupported; missing values were not inferred.'); }
     } else result.problems.push(`Usage: ${failure(usage.reason)}`);
     const limited = [profile, usage].flatMap(item => item.status === 'rejected' && item.reason instanceof ClaudeRateLimitError ? [item.reason] : []);
     if (limited.length) result.rateLimit = { retryAt: latestRetryAt(limited.map(error => error.retryAt)) };
     // The missing renewal dates are the harness's `renewalUnavailableReason`, stated once by the views that show them.
     result.facts.push({ section: 'Availability', label: 'Earned resets', value: 'authswitch does not read earned reset credits for Claude Code logins.' });
-    return result;
+    return { status: result, profile: profileOutcome, usage: usageOutcome, credentialRejected };
   }
 }

package/ts/classes.claudetokenrefresh.ts

@@ -1,5 +1,8 @@
-import { credentialText } from './classes.credentialstore.js';
-import { claudeRequest, ClaudeAccountOnHoldError, ClaudeLoginRejectedError, ClaudeRequestError, oauthErrorCode } from './claudehttp.js';
+import { claudeRequest, claudeRotatingRequest, ClaudeAccountOnHoldError, ClaudeLoginRejectedError,
+  ClaudeRequestError, ClaudeRotatingRequestError, oauthErrorCode } from './claudehttp.js';
+
+const credentialText = (value: unknown): string | undefined =>
+  typeof value === 'string' && value.length > 0 ? value : undefined;
 
 /** Claude Code 2.1.273's token endpoint (`TOKEN_URL`, bundle offset @188533776). */
 const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
@@ -36,6 +39,13 @@ export interface IClaudeTokens {
   scopes?: string[];
 }
 
+/** Authority callers persist a pre-send marker, then classify every failed rotating request. */
+export type TClaudeAuthorityRefreshResult =
+  | { success: true; tokens: IClaudeTokens }
+  | { success: false; requestOutcome: 'notSent' | 'outcomeUnknown';
+      reason: 'not_refreshable' | 'provider_rejected' | 'account_on_hold' | 'provider_unavailable' | 'unsupported_response';
+      responseStatus?: number };
+
 /** How Claude Code 2.1.273 builds one refresh request for a stored login. */
 export interface IClaudeGrant {
   /** The login's own OAuth client, or Claude Code's public one. */
@@ -104,10 +114,10 @@ export class ClaudeTokenRefresh {
    * Whether Claude Code would refresh this login before using it: its access token expires within five minutes. A
    * login without a numeric expiry or without a refresh token is used as it is, exactly as Claude Code does.
    */
-  public due(oauthArg: Record<string, unknown>): boolean {
+  public due(oauthArg: Record<string, unknown>, minValidityMs = CLAUDE_REFRESH_MARGIN_MS): boolean {
     const expiresAt = oauthArg.expiresAt;
     return typeof expiresAt === 'number' && Number.isFinite(expiresAt) && credentialText(oauthArg.refreshToken) !== undefined
-      && this.now() + CLAUDE_REFRESH_MARGIN_MS >= expiresAt;
+      && this.now() + Math.max(CLAUDE_REFRESH_MARGIN_MS, minValidityMs) >= expiresAt;
   }
 
   /** One refresh request, as Claude Code sends it: a JSON body, the login's client, and the scopes of this attempt. */
@@ -121,26 +131,56 @@ export class ClaudeTokenRefresh {
     });
   }
 
-  /**
-   * New tokens for the login. A response without a refresh token keeps the one sent, and one without a scope keeps the
-   * stored scopes, as Claude Code merges them. Throws `ClaudeRequestError` with a fixed diagnostic; a grant the service
-   * rejects is `ClaudeLoginRejectedError`, an account the service put on hold is `ClaudeAccountOnHoldError`, and a rate
-   * limit is `ClaudeRateLimitError`.
-   */
-  public async refresh(oauthArg: Record<string, unknown>): Promise<IClaudeTokens> {
+  private attemptForAuthority(refreshTokenArg: string, grantArg: IClaudeGrant, scopesArg: readonly string[]) {
+    return claudeRotatingRequest(this.fetcher, {
+      url: TOKEN_URL, method: 'POST', headers: { 'Content-Type': 'application/json' }, subject: 'Claude sign-in',
+      body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshTokenArg,
+        client_id: grantArg.clientId, scope: grantScope(scopesArg) }),
+      timeoutMs: REFRESH_TIMEOUT_MS, readErrorBody: true, now: this.now,
+    });
+  }
+
+  /** The authority must already have durably marked this grant as possibly sent. */
+  public async refreshForAuthority(oauthArg: Record<string, unknown>): Promise<TClaudeAuthorityRefreshResult> {
     const refreshToken = credentialText(oauthArg.refreshToken);
     const grant = claudeGrant(oauthArg);
     if (!refreshToken || !grant) {
-      throw new ClaudeRequestError('This saved login has no refresh token, and no subscriber scope or plan to refresh with. Log in again with Claude Code and save it.');
+      return { success: false, requestOutcome: 'notSent', reason: 'not_refreshable' };
     }
-    let { status, body } = await this.attempt(refreshToken, grant, grant.scopes);
-    // The service refusing Claude Code's current scope set is the one failure it sends a second request for.
-    if (status === 400 && oauthErrorCode(body) === 'invalid_scope' && grant.fallbackScopes !== null) {
-      ({ status, body } = await this.attempt(refreshToken, grant, grant.fallbackScopes));
+    let response: Awaited<ReturnType<typeof this.attemptForAuthority>>;
+    try {
+      response = await this.attemptForAuthority(refreshToken, grant, grant.scopes);
+      // A definitive invalid_scope response is the one safe condition in which Claude retries the same grant.
+      if (response.status === 400 && oauthErrorCode(response.body) === 'invalid_scope'
+        && grant.fallbackScopes !== null) {
+        response = await this.attemptForAuthority(refreshToken, grant, grant.fallbackScopes);
+      }
+    } catch (error) {
+      return { success: false,
+        requestOutcome: error instanceof ClaudeRotatingRequestError ? error.requestOutcome : 'outcomeUnknown',
+        reason: 'provider_unavailable' };
     }
-    if (accountOnHold(status, body)) throw new ClaudeAccountOnHoldError();
-    if ((status === 400 || status === 401) && oauthErrorCode(body) === 'invalid_grant') throw new ClaudeLoginRejectedError();
-    if (status < 200 || status > 299) throw new ClaudeRequestError(`The Claude sign-in service returned HTTP ${status}.`);
+    if (accountOnHold(response.status, response.body)) {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'account_on_hold',
+        responseStatus: response.status };
+    }
+    if ((response.status === 400 || response.status === 401)
+      && oauthErrorCode(response.body) === 'invalid_grant') {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'provider_rejected',
+        responseStatus: response.status };
+    }
+    if (response.status < 200 || response.status > 299) {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'provider_unavailable',
+        responseStatus: response.status };
+    }
+    try { return { success: true, tokens: this.tokensFromResponse(response.body, refreshToken) }; }
+    catch {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'unsupported_response',
+        responseStatus: response.status };
+    }
+  }
+
+  private tokensFromResponse(body: Record<string, unknown> | null, refreshToken: string): IClaudeTokens {
     const receivedAt = this.now();
     const accessToken = credentialText(body?.access_token);
     const tokenType = body?.token_type;
@@ -158,4 +198,27 @@ export class ClaudeTokenRefresh {
       ...(scope === null || !scope.length ? {} : { scopes: scope }),
     };
   }
+
+  /**
+   * New tokens for the login. A response without a refresh token keeps the one sent, and one without a scope keeps the
+   * stored scopes, as Claude Code merges them. Throws `ClaudeRequestError` with a fixed diagnostic; a grant the service
+   * rejects is `ClaudeLoginRejectedError`, an account the service put on hold is `ClaudeAccountOnHoldError`, and a rate
+   * limit is `ClaudeRateLimitError`.
+   */
+  public async refresh(oauthArg: Record<string, unknown>): Promise<IClaudeTokens> {
+    const refreshToken = credentialText(oauthArg.refreshToken);
+    const grant = claudeGrant(oauthArg);
+    if (!refreshToken || !grant) {
+      throw new ClaudeRequestError('This saved login has no refresh token, and no subscriber scope or plan to refresh with. Log in again with Claude Code and save it.');
+    }
+    let { status, body } = await this.attempt(refreshToken, grant, grant.scopes);
+    // The service refusing Claude Code's current scope set is the one failure it sends a second request for.
+    if (status === 400 && oauthErrorCode(body) === 'invalid_scope' && grant.fallbackScopes !== null) {
+      ({ status, body } = await this.attempt(refreshToken, grant, grant.fallbackScopes));
+    }
+    if (accountOnHold(status, body)) throw new ClaudeAccountOnHoldError();
+    if ((status === 400 || status === 401) && oauthErrorCode(body) === 'invalid_grant') throw new ClaudeLoginRejectedError();
+    if (status < 200 || status > 299) throw new ClaudeRequestError(`The Claude sign-in service returned HTTP ${status}.`);
+    return this.tokensFromResponse(body, refreshToken);
+  }
 }

package/ts/classes.codexharness.ts

@@ -69,6 +69,7 @@ export class CodexHarness implements IAuthHarness {
       const isActive = this.recordOf(entryArg, active.identity);
       return {
         id: entryArg.email,
+        providerAccountId: entryArg.accountId,
         label: entryArg.email,
         isActive,
         isStashed,
@@ -77,7 +78,8 @@ export class CodexHarness implements IAuthHarness {
       };
     });
     if (active.identity && !accounts.some((accountArg) => accountArg.isActive)) {
-      accounts.unshift({ id: this.activeAccountId(active.identity.email, active.identity.accountId), label: active.identity.email, isActive: true,
+      accounts.unshift({ id: this.activeAccountId(active.identity.email, active.identity.accountId),
+        providerAccountId: active.identity.accountId, label: active.identity.email, isActive: true,
         isStashed: false, savedAt: null, details: [] });
     }
     return {

package/ts/classes.codexmanaged.ts

@@ -5,7 +5,7 @@ import type { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
 export interface IAuthSwitchManagedCodexOptions {
   /** Private runtime root; only the disposable control socket lives here. */
   runtimeDirectory: string;
-  /** Caller-owned, durable native Codex state home, reserved to one account and scope by SmartData. */
+  /** Caller-owned, durable native Codex state home, reserved to one account and scope by NoSQLDB. */
   codexHomeDirectory: string;
   workspaceDirectory: string;
   executable?: string;
@@ -33,28 +33,91 @@ const isRecord = (value: unknown): value is Record<string, unknown> =>
 const isAlive = (child: plugins.childProcess.ChildProcess): boolean => child.exitCode === null && child.signalCode === null;
 const wait = (ms: number): Promise<void> => new Promise(resolve => setTimeout(resolve, ms));
 
-/** Same-user process inspection: a unique private --listen socket is the pre-PID crash identity. */
-export const findManagedCodexProcess = async (socketPath: string): Promise<{ pid: number; startedAt: string } | null> => {
-  if (process.platform === 'win32') throw new Error('Managed Codex Unix socket process inspection is unavailable on Windows.');
+export type TManagedCodexProcessObservation =
+  | { state: 'absent' }
+  | { state: 'observed'; pid: number; startedAt: string }
+  | { state: 'multiple_claimants' };
+
+const linuxArgv = async (pid: number): Promise<Buffer[] | null> => {
+  let raw: Buffer;
+  try {
+    raw = await plugins.fs.promises.readFile(`/proc/${pid}/cmdline`);
+  } catch (error) {
+    if (isRecord(error) && error.code === 'ENOENT') return null;
+    throw new Error('Managed Codex process argument inspection failed.');
+  }
+  if (raw.length === 0) return [];
+  const argv: Buffer[] = [];
+  let start = 0;
+  for (let index = 0; index < raw.length; index++) {
+    if (raw[index] !== 0) continue;
+    argv.push(raw.subarray(start, index));
+    start = index + 1;
+  }
+  if (start < raw.length) argv.push(raw.subarray(start));
+  return argv;
+};
+
+const claimsManagedCodexSocket = (argv: readonly Buffer[], socketPath: string): boolean => {
+  const command = Buffer.from('app-server');
+  const option = Buffer.from('--listen');
+  const value = Buffer.from(`unix://${socketPath}`);
+  for (let index = 0; index + 2 < argv.length; index++) {
+    if (argv[index].equals(command) && argv[index + 1].equals(option) && argv[index + 2].equals(value)) return true;
+  }
+  return false;
+};
+
+/** Same-user Linux process inspection for a bounded socket set, using exact /proc argv boundaries. */
+export const observeManagedCodexProcesses = async (
+  socketPaths: readonly string[],
+): Promise<Map<string, TManagedCodexProcessObservation>> => {
+  const unique = [...new Set(socketPaths)];
+  if (unique.some(value => typeof value !== 'string' || value.length === 0)) {
+    throw new Error('Managed Codex process selector is invalid.');
+  }
+  if (unique.length === 0) return new Map();
+  if (process.platform !== 'linux') {
+    throw new Error('Exact managed Codex process inspection is available only on Linux.');
+  }
+  const uid = process.getuid?.();
+  if (uid === undefined) throw new Error('Managed Codex process owner inspection is unavailable.');
   const output = await new Promise<string>((resolve, reject) => {
-    plugins.childProcess.execFile('ps', ['-ww', '-u', String(process.getuid?.()), '-o', 'pid=,lstart=,args='],
+    plugins.childProcess.execFile('ps', ['-ww', '-u', String(uid), '-o', 'pid=,lstart='],
       { timeout: 5_000, maxBuffer: 8 * 1024 * 1024, env: { ...process.env, LC_ALL: 'C' } },
       (error, stdout) => error ? reject(new Error('Managed Codex process inspection failed.')) : resolve(stdout));
   });
-  const marker = `app-server --listen unix://${socketPath}`;
-  const matches: Array<{ pid: number; startedAt: string }> = [];
+  const processes: Array<{ pid: number; startedAt: string; argv: Buffer[] }> = [];
   for (const line of output.split('\n')) {
     const parts = line.trim().split(/\s+/);
-    if (parts.length < 8) continue;
+    if (parts.length !== 6) continue;
     const pid = Number(parts[0]);
     const date = Date.parse(parts.slice(1, 6).join(' '));
-    const args = parts.slice(6).join(' ');
-    if (Number.isSafeInteger(pid) && pid > 0 && Number.isFinite(date) && args.includes(marker)) {
-      matches.push({ pid, startedAt: new Date(date).toISOString() });
+    if (Number.isSafeInteger(pid) && pid > 0 && Number.isFinite(date)) {
+      const argv = await linuxArgv(pid);
+      if (argv) processes.push({ pid, startedAt: new Date(date).toISOString(), argv });
     }
   }
-  if (matches.length > 1) throw new Error('Multiple managed Codex processes claim one private socket.');
-  return matches[0] ?? null;
+  const result = new Map<string, TManagedCodexProcessObservation>();
+  for (const socketPath of unique) {
+    const matches = processes.filter(process => claimsManagedCodexSocket(process.argv, socketPath));
+    result.set(socketPath, matches.length === 0
+      ? { state: 'absent' }
+      : matches.length === 1
+        ? { state: 'observed', pid: matches[0].pid, startedAt: matches[0].startedAt }
+        : { state: 'multiple_claimants' });
+  }
+  return result;
+};
+
+/** Same-user process inspection: a unique private --listen socket is the pre-PID crash identity. */
+export const findManagedCodexProcess = async (socketPath: string): Promise<{ pid: number; startedAt: string } | null> => {
+  const observed = (await observeManagedCodexProcesses([socketPath])).get(socketPath);
+  if (!observed || observed.state === 'absent') return null;
+  if (observed.state === 'multiple_claimants') {
+    throw new Error('Multiple managed Codex processes claim one private socket.');
+  }
+  return { pid: observed.pid, startedAt: observed.startedAt };
 };
 
 /** Daemon-owned Codex app-server. Only access tokens, never refresh grants, enter Codex. */

package/ts/classes.codexpreuse.ts

@@ -3,6 +3,11 @@ import type { ICodexIdentity } from './interfaces.js';
 import type { IHarnessPreuseOptions, IHarnessPreuseResult } from './interfaces.harness.js';
 import { PreuseError, validatePreuseOptions } from './preuse.js';
 
+export interface ICodexPreuseLifecycle {
+  /** Persist the may-have-started marker before the inference API is invoked. */
+  beforeRequest(model: string): Promise<void>;
+}
+
 /** One tool-free request through the FlexHarness ChatGPT provider, with no credential writes. */
 export class CodexPreuse {
   constructor(private readonly fetcher: typeof fetch = globalThis.fetch) {}
@@ -11,9 +16,6 @@ export class CodexPreuse {
     validatePreuseOptions(optionsArg);
     if (identityArg.kind !== 'chatgpt') throw new PreuseError('Codex preuse requires a ChatGPT subscription login; API-key logins have no subscription reset window.');
     if (!identityArg.accountId) throw new PreuseError('This login has no account ID for preuse.');
-    const signal = optionsArg.signal
-      ? AbortSignal.any([optionsArg.signal, AbortSignal.timeout(180_000)])
-      : AbortSignal.timeout(180_000);
     let credentials: plugins.flexAuth.IOpenAiChatGptAuthCredentials;
     let oauth: plugins.flexAccounts.IOpenAiChatGptOAuthCredential;
     try {
@@ -24,12 +26,37 @@ export class CodexPreuse {
     } catch {
       throw new PreuseError('No complete, matching Codex login is available for preuse. Log in again with Codex and save the account.');
     }
+    return this.runCredential(oauth, credentials, optionsArg);
+  }
+
+  /** Authority-owned access grants contain no refresh token and are never serialized by this helper. */
+  public async runAccess(credentialArg: plugins.flexAccounts.IOpenAiChatGptAccessCredential,
+    optionsArg: IHarnessPreuseOptions, lifecycleArg: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult> {
+    validatePreuseOptions(optionsArg);
+    if (!credentialArg || credentialArg.kind !== 'chatgptAccess' || credentialArg.providerId !== 'openai'
+      || typeof credentialArg.accessToken !== 'string' || !credentialArg.accessToken
+      || typeof credentialArg.accountId !== 'string' || !credentialArg.accountId
+      || typeof credentialArg.isFedrampAccount !== 'boolean') {
+      throw new PreuseError('No complete, matching Codex login is available for preuse. Log in again with Codex and save the account.');
+    }
+    return this.runCredential(credentialArg, {
+      accessToken: credentialArg.accessToken, accountId: credentialArg.accountId,
+      isFedrampAccount: credentialArg.isFedrampAccount,
+    }, optionsArg, lifecycleArg);
+  }
+
+  private async runCredential(readCredentialArg: plugins.flexAccounts.TOpenAiChatGptReadCredential,
+    credentialsArg: plugins.flexAuth.IOpenAiChatGptAuthCredentials, optionsArg: IHarnessPreuseOptions,
+    lifecycleArg?: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult> {
+    const signal = optionsArg.signal
+      ? AbortSignal.any([optionsArg.signal, AbortSignal.timeout(180_000)])
+      : AbortSignal.timeout(180_000);
     let model = optionsArg.model;
     let reasoningEffort: string | undefined;
     if (!model) {
       const adapter = new plugins.flexAccounts.OpenAiProviderAdapter({ fetch: this.fetcher });
       try {
-        const catalog = await adapter.listModels(oauth, { signal, timeoutMs: 10_000 });
+        const catalog = await adapter.listModels(readCredentialArg, { signal, timeoutMs: 10_000 });
         if (!catalog.success) throw new PreuseError(catalog.errorCode === 'CREDENTIAL_REFRESH_REQUIRED'
           ? 'The saved login has expired. Log in again with Codex and save it before preuse.'
           : 'Could not read the account model catalog. No preuse prompt was sent.');
@@ -45,9 +72,10 @@ export class CodexPreuse {
     let requestStarted = false;
     try {
       signal.throwIfAborted();
-      const connection = plugins.flexAuth.createOpenAiChatGptModelConnection(credentials);
+      const connection = plugins.flexAuth.createOpenAiChatGptModelConnection(credentialsArg);
       connection.settings.fetch = this.fetcher;
       const languageModel = plugins.flexOpenAi.createOpenAiModelProvider().getModel({ provider: 'openai', model, connection });
+      await lifecycleArg?.beforeRequest(model);
       requestStarted = true;
       const stream = plugins.flexModels.streamText({
         model: languageModel,

package/ts/classes.fileharness.ts

@@ -6,6 +6,8 @@ import { plainText } from './formatting.js';
 export interface IFileAccount {
   slotId: string;
   identity: string;
+  /** Exact provider-native account identifier when the credential carries one. */
+  providerAccountId: string | null;
   label: string;
   credential: Record<string, unknown>;
 }
@@ -80,14 +82,16 @@ export abstract class FileHarness implements IAuthHarness {
     const snapshot = this.snapshot();
     const saved = this.store.list();
     const accounts: IHarnessState['accounts'] = saved.map(entry => {
-      this.saved(entry);
-      return { id: entry.id, slotId: entry.slotId, label: entry.label, isActive: false, isStashed: true, savedAt: entry.savedAt, details: [`Provider: ${entry.slotId}`] };
+      const account = this.saved(entry);
+      return { id: entry.id, providerAccountId: account.providerAccountId, slotId: entry.slotId, label: entry.label,
+        isActive: false, isStashed: true, savedAt: entry.savedAt, details: [`Provider: ${entry.slotId}`] };
     });
     for (const active of snapshot.accounts) {
       const id = this.store.id(active.slotId, active.identity);
       const existing = accounts.find(account => account.id === id);
       if (existing) { existing.isActive = true; existing.label = active.label; }
-      else accounts.unshift({ id, slotId: active.slotId, label: active.label, isActive: true, isStashed: false, savedAt: null, details: [`Provider: ${active.slotId}`] });
+      else accounts.unshift({ id, providerAccountId: active.providerAccountId, slotId: active.slotId, label: active.label,
+        isActive: true, isStashed: false, savedAt: null, details: [`Provider: ${active.slotId}`] });
     }
     for (const account of accounts) {
       if (accounts.some(other => other.id !== account.id && other.label === account.label)) account.details.push(`Account ID: ${account.id}`);

package/ts/classes.limits.ts

@@ -52,6 +52,7 @@ const accountKeys = (harnessArg: IHarnessAccountList, accountArg: TListedAccount
   harnessId: harnessArg.id,
   provider: providerName(harnessArg, accountArg),
   account: plainText(accountArg.label),
+  providerAccountId: accountArg.providerAccountId,
   accountId: accountArg.id,
   ...(accountArg.slotId === undefined ? {} : { slotId: plainText(accountArg.slotId) }),
 });
@@ -164,11 +165,13 @@ export const accountLimits = (listArg: IAccountList, harnessesArg: readonly THar
       limitType: null, scope: null, windowSeconds: null, usedPercent: null, resetAt: null, resetsIn: UNAVAILABLE, severity: null, headline: false,
     } as const;
     if (problem !== null) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, billing: null, ...empty, unavailableReason: problem });
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, isActive: false, accountType: null, billing: null, ...empty, unavailableReason: problem });
       continue;
     }
     if (!harness.accounts.length) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, billing: null, ...empty,
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, isActive: false, accountType: null, billing: null, ...empty,
         unavailableReason: harness.saveUnavailableReason === null ? 'No accounts are known for this harness.' : plainText(harness.saveUnavailableReason) });
       continue;
     }
@@ -192,7 +195,7 @@ export const accountLimits = (listArg: IAccountList, harnessesArg: readonly THar
     }
   }
   const limits = byProviderThenAccount(rows);
-  return { schemaVersion: 1, generatedAt: listArg.generatedAt, complete: listArg.complete, limits, notes: [...collectNotes(limits), ...renewalNotes] };
+  return { schemaVersion: 2, generatedAt: listArg.generatedAt, complete: listArg.complete, limits, notes: [...collectNotes(limits), ...renewalNotes] };
 };
 
 /**
@@ -214,14 +217,16 @@ export const activeAccounts = (listArg: IAccountList, harnessesArg: readonly THa
       return index < 0 ? null : activeDrift(traits, drifts.splice(index, 1)[0]);
     };
     if (problem !== null) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, accountType: null, savedAt: null, savedAgo: UNAVAILABLE, source: 'none', unavailableReason: problem, drift: null });
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, accountType: null, savedAt: null, savedAgo: UNAVAILABLE, source: 'none', unavailableReason: problem, drift: null });
       continue;
     }
     const active = harness.accounts.filter(account => account.isActive);
     if (!active.length) {
       const stashed = harness.accounts.filter(account => account.isStashed);
       rows.push({
-        harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, accountType: null,
+        harnessId: harness.id, provider: providerName(harness), account: null, providerAccountId: null,
+        accountId: null, accountType: null,
         savedAt: null, savedAgo: UNAVAILABLE, source: stashed.length ? 'stash only' : 'none',
         unavailableReason: harness.saveUnavailableReason !== null ? plainText(harness.saveUnavailableReason)
           : stashed.length ? `No login is active; ${stashed.length} saved account(s) can be activated with authswitch ${plainText(harness.id)} use.`
@@ -245,7 +250,7 @@ export const activeAccounts = (listArg: IAccountList, harnessesArg: readonly THa
   const active = byProviderThenAccount(rows);
   const driftNotes = active.filter(row => row.drift !== null)
     .map(row => `${row.provider}${row.account === null ? '' : ` · ${row.account}`}: ${row.drift!.reason}`);
-  return { schemaVersion: 1, generatedAt: listArg.generatedAt, complete: listArg.complete, active, notes: [...collectNotes(active), ...driftNotes, ...unattached] };
+  return { schemaVersion: 2, generatedAt: listArg.generatedAt, complete: listArg.complete, active, notes: [...collectNotes(active), ...driftNotes, ...unattached] };
 };
 
 /**

package/ts/classes.opencodeharness.ts

@@ -100,7 +100,7 @@ export class OpenCodeHarness extends FileHarness {
     const fingerprint = credentialHash(secret);
     const identity = info.accountId ? `oauth:${info.accountId}` : `${type}:${fingerprint}`;
     const label = info.email ?? (info.accountId ? `openai:${info.accountId}` : `${slotId} ${type === 'api' ? 'API key' : type} ${fingerprint.slice(0, 12)}`);
-    return { slotId, identity, label, credential };
+    return { slotId, identity, providerAccountId: info.accountId ?? null, label, credential };
   }
   protected snapshot(): IFileHarnessSnapshot {
     if (this.env.OPENCODE_AUTH_CONTENT !== undefined) return { accounts: [], unavailable: 'OPENCODE_AUTH_CONTENT overrides the credential file. Unset it before managing file logins.' };

package/ts/claudehttp.ts

@@ -1,10 +1,17 @@
 import { commitinfo } from './00_commitinfo_data.js';
-import { credentialRecord } from './classes.credentialstore.js';
 import { retryAtFrom } from './ratelimit.js';
 
 /** A fixed, local diagnostic. Nothing a service sent (a body, a header) and no request header ever becomes one. */
 export class ClaudeRequestError extends Error {}
 
+/** A rotating refresh POST is never assumed unsent after fetch has been invoked. */
+export type TClaudeRotatingRequestOutcome = 'notSent' | 'outcomeUnknown';
+export class ClaudeRotatingRequestError extends ClaudeRequestError {
+  constructor(message: string, public readonly requestOutcome: TClaudeRotatingRequestOutcome) {
+    super(message);
+  }
+}
+
 /** How every Claude lookup reports a login the service does not accept (HTTP 401, or a refresh grant it rejected). */
 export const CLAUDE_LOGIN_REJECTED = 'Login expired or was rejected. Log in again with Claude Code and save it.';
 
@@ -80,7 +87,11 @@ const jsonBody = async (responseArg: Response, subjectArg: string): Promise<Reco
       chunks.push(part.value);
     }
   } finally { reader.releaseLock(); }
-  try { return credentialRecord(JSON.parse(Buffer.concat(chunks).toString('utf8'))); }
+  try {
+    const parsed: unknown = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown> : null;
+  }
   catch { return null; }
 };
 
@@ -112,3 +123,21 @@ export const claudeRequest = async (fetcherArg: typeof fetch, requestArg: IClaud
     throw new ClaudeRequestError(`The ${requestArg.subject} service could not be reached.`);
   }
 };
+
+/** Use only after the authority has durably committed its pre-send attempt marker. */
+export const claudeRotatingRequest = async (fetcherArg: typeof fetch,
+  requestArg: IClaudeRequest & { method: 'POST' }): Promise<IClaudeResponse> => {
+  if (requestArg.signal?.aborted) {
+    throw new ClaudeRotatingRequestError('The Claude sign-in request was cancelled before sending.', 'notSent');
+  }
+  let invoked = false;
+  const observedFetch: typeof fetch = (input, init) => {
+    invoked = true;
+    return fetcherArg(input, init);
+  };
+  try { return await claudeRequest(observedFetch, requestArg); }
+  catch (error) {
+    const message = error instanceof ClaudeRequestError ? error.message : 'The Claude sign-in request failed.';
+    throw new ClaudeRotatingRequestError(message, invoked ? 'outcomeUnknown' : 'notSent');
+  }
+};

package/ts/index.ts

@@ -24,13 +24,19 @@ export * from './classes.watch.js';
 export * from './classes.watchlock.js';
 export * from './watchpolicy.js';
 export * from './classes.authorityclient.js';
+export * from './classes.authoritycli.js';
 export * from './classes.authoritydaemon.js';
 export * from './classes.authorityservice.js';
 
 import { AuthSwitchCli } from './classes.cli.js';
+import { runAuthSwitchAuthorityCli } from './classes.authoritycli.js';
 import { AuthSwitchAuthorityService, resolveAuthSwitchAuthorityPaths, runAuthSwitchAuthorityDaemon } from './classes.authorityservice.js';
 
 export const runCli = async (argvArg: string[] = process.argv.slice(2)): Promise<void> => {
+  if (argvArg[0] === 'account' || (argvArg[0] === 'authority' && argvArg[1] === 'doctor')) {
+    process.exitCode = await runAuthSwitchAuthorityCli(argvArg);
+    return;
+  }
   if (argvArg[0] === 'authority') {
     const paths = resolveAuthSwitchAuthorityPaths();
     if (argvArg[1] === 'daemon' && argvArg.length === 2) {