@moondeck/station 0.0.1 → 1.0.0

package/lib/engine-accounts.ts

@@ -0,0 +1,1970 @@
+import { ENGINE_ACCOUNT_PATHS } from "../src/engine-account-paths";
+/**
+ * Engine accounts (ADR-076) — multiple credentials per engine kind, selected
+ * by ENV at each `docker exec`, rotated automatically with rate-limit failover.
+ *
+ * An account resolves to a small env map merged into the agent's exec:
+ *   - Claude (env account):        CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY.
+ *   - Codex (config-dir account):  CODEX_HOME=<per-account container dir>.
+ *   - OpenCode (config-dir account): OPENCODE_DATA_DIR=<per-account container dir>.
+ *
+ * `accounts(kind) = [synthesized default] + [DB extras]`. The DEFAULT is the
+ * legacy single slot (`.env.local` var, or `~/.codex` / `~/.local/share/opencode`
+ * dir) — so with zero extras behavior is identical to before and `available()`
+ * is unchanged. EXTRA accounts live in `host_engine_accounts`, sealed with the
+ * host master key (env kind) or as an isolated host dir (config-dir kind).
+ *
+ * Isolation invariants (ADR-015/024) are preserved: accounts never leave the
+ * host, the operator's live dirs are never bind-mounted (extras are per-task
+ * writable copies), and every `docker cp` is followed by `chown -R node:node`.
+ *
+ * Rotation state (cooldown / last-used) is in-memory only; a host restart
+ * clears cooldowns (a restarted host retries every account, which is correct —
+ * caps reset over time).
+ */
+
+import {
+  HOST_ACCOUNT_SCOPE,
+  isEngineAccountScope,
+  isEngineAccountLabel,
+} from "../src/protocol";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { eq } from "drizzle-orm";
+
+import {
+  configuredCredentialStore,
+  credentialStorePrefix,
+  isParameterPathSegment,
+  parameterName,
+  queueStoreWrite,
+  settleStoreWrites,
+  type CredentialStore,
+} from "./credential-store";
+import { engineAccountListPaths } from "./credential-store-scope";
+import type { EngineCaptureMaterial } from "./capture-flow";
+import { getDb, schema } from "./db";
+import { brokeredFilesFor } from "./token-broker";
+import {
+  taskContainerBackend,
+  taskContainerCli,
+} from "./task-container-cli";
+import { RUNTIME_AUTHORITY_ENV, runtimeAuthorityDockerExecArgs } from "./runtime-authority";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
+import { openAesGcm, sealAesGcm } from "./secrets";
+import { newId } from "./ulid";
+
+const EXEC_TIMEOUT_MS = 15_000;
+
+/** Engine kinds that participate in the account model. Other kinds resolve to
+ *  no accounts (the orchestrator then injects no account env — old behavior). */
+export type AccountAuthKind = "env" | "config-dir";
+
+interface KindDescriptor {
+  authKind: AccountAuthKind;
+  /** Default (legacy-slot) host dir for config-dir kinds. */
+  defaultHostDir?: (owner: string) => string;
+  /** Default (legacy-slot) container dir for config-dir kinds. */
+  defaultContainerDir?: string;
+  /** Env var that selects a config-dir account's dir in-container. */
+  selectVar?: string;
+  /** Per-account container dir prefix for config-dir extras. */
+  containerDirPrefix?: string;
+  /** Per-account host dir builder for config-dir extras. */
+  extraHostDir?: (owner: string, id: string) => string;
+}
+
+const KINDS: Record<string, KindDescriptor> = {
+  claude: { authKind: "env" },
+  // API-key engines: an extra account is one env var. The default slot stays
+  // the host's own `.env.local` key (the adapters read process.env), so these
+  // never synthesize a default — `defaultAvailable` is false for them.
+  // Grok: a subscription sign-in is a config dir (`grok login --device-auth`
+  // writes auth.json; GROK_HOME selects it in-container). Pasted xAI keys
+  // remain `env` rows (XAI_API_KEY) — rows carry their own authKind.
+  grok: {
+    authKind: "config-dir",
+    defaultHostDir: (owner) => join(owner, ".grok"),
+    ...ENGINE_ACCOUNT_PATHS.grok,
+    selectVar: "GROK_HOME",
+    extraHostDir: (owner, id) => join(owner, `.grok-acct-${id}`),
+  },
+  cursor: { authKind: "env" },
+  codex: {
+    authKind: "config-dir",
+    defaultHostDir: (owner) => join(owner, ".codex"),
+    ...ENGINE_ACCOUNT_PATHS.codex,
+    selectVar: "CODEX_HOME",
+    extraHostDir: (owner, id) => join(owner, `.codex-acct-${id}`),
+  },
+  opencode: {
+    authKind: "config-dir",
+    defaultHostDir: (owner) => join(owner, ".local", "share", "opencode"),
+    ...ENGINE_ACCOUNT_PATHS.opencode,
+    selectVar: "OPENCODE_DATA_DIR",
+    extraHostDir: (owner, id) => join(owner, ".local", "share", `opencode-acct-${id}`),
+  },
+};
+
+/** The env var an extra API-key account injects, per kind (the same vars the
+ *  adapters read for the host's own key). Claude is special-cased in
+ *  `addEngineAccount` (token vs. key); Codex writes an auth.json instead. */
+const API_KEY_ENV_VARS: Record<string, string> = {
+  grok: "XAI_API_KEY",
+  cursor: "CURSOR_API_KEY",
+};
+const API_KEY_ENGINE_LABELS: Record<string, string> = {
+  grok: "Grok",
+  cursor: "Cursor",
+};
+
+/**
+ * Whether ANY stored account exists for `kind`, in any scope. The
+ * advertisement fallback (ADR-131 D3): an adapter's `available()` only sees
+ * the host's own credential, so a shared host whose owner never signed in to
+ * Codex hid the kind from every workspace that had connected its own account
+ * — the cloud then refused the crew with "host does not support agent kind".
+ * A stored account is a usable credential; the cloud scopes it per caller.
+ */
+export function hasStoredEngineAccounts(kind: string): boolean {
+  if (!KINDS[kind]) return false;
+  try {
+    return getDb()
+      .select()
+      .from(schema.engineAccounts)
+      .all()
+      .some((row) => row.kind === kind);
+  } catch {
+    return false;
+  }
+}
+
+/** Public (secret-free) account descriptor for the host UI. */
+export interface EngineAccountInfo {
+  id: string;
+  kind: string;
+  label: string;
+  authKind: AccountAuthKind;
+  isDefault: boolean;
+  /** ADR-131 D3: "host" or "org:<orgId>". */
+  scope: string;
+}
+
+/** A fully-resolved account, ready to inject / provision (host-trusted; the
+ *  execEnv holds decrypted secrets — never log it). */
+export interface ResolvedEngineAccount {
+  id: string;
+  kind: string;
+  label: string;
+  isDefault: boolean;
+  /** ADR-131 D3: "host" or "org:<orgId>". */
+  scope: string;
+  authKind: AccountAuthKind;
+  /** Env merged into the agent's docker exec. Empty for the default env
+   *  account (the ambient `.env.local` credential is account #1). */
+  execEnv: Record<string, string>;
+  /** config-dir accounts only: host dir to copy + container dir target. */
+  configDir?: { hostDir: string; containerDir: string };
+}
+
+// ---------------------------------------------------------------------------
+// Seams (tests inject).
+// ---------------------------------------------------------------------------
+
+export interface AccountSeams {
+  ownerHome: () => string;
+  procEnv: NodeJS.ProcessEnv;
+  fileExists: (p: string) => boolean;
+}
+
+function defaultSeams(): AccountSeams {
+  return {
+    ownerHome: () => process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    procEnv: process.env,
+    fileExists: existsSync,
+  };
+}
+
+function withDefaults(seams: Partial<AccountSeams>): AccountSeams {
+  return { ...defaultSeams(), ...seams };
+}
+
+// ---------------------------------------------------------------------------
+// Sealing (same pack format as host-env.ts).
+// ---------------------------------------------------------------------------
+
+function packSecret(value: string): string {
+  const sealed = sealAesGcm(value);
+  return `${sealed.ct.toString("base64")}.${sealed.nonce.toString("base64")}`;
+}
+
+function unpackSecret(enc: string): string {
+  const dot = enc.indexOf(".");
+  if (dot === -1) throw new Error("malformed secret_enc");
+  const ct = Buffer.from(enc.slice(0, dot), "base64");
+  const nonce = Buffer.from(enc.slice(dot + 1), "base64");
+  return openAesGcm(ct, nonce);
+}
+
+// ---------------------------------------------------------------------------
+// Scopes (ADR-131 Decision 3).
+// ---------------------------------------------------------------------------
+
+/**
+ * Every account has a scope. `host` is the owner's: the default slot plus
+ * every extra account connected before scopes existed (and every one an
+ * owner connects on a BYO/dedicated host). `org:<orgId>` is a workspace's
+ * account on a shared host: resolved ONLY for that workspace's tasks, and
+ * never joined by the default slot — a tenant sees exactly what it connected.
+ */
+export { HOST_ACCOUNT_SCOPE, isEngineAccountScope };
+
+/** A row's scope (legacy rows read as `host`) matches the requested one. */
+export function accountInScope(
+  rowScope: string | null | undefined,
+  scope: string,
+): boolean {
+  return (rowScope ?? HOST_ACCOUNT_SCOPE) === scope;
+}
+
+// ---------------------------------------------------------------------------
+// Resolution.
+// ---------------------------------------------------------------------------
+
+/** Whether the kind's DEFAULT (legacy) credential is present on this host. */
+function defaultAvailable(kind: string, s: AccountSeams): boolean {
+  const d = KINDS[kind];
+  if (!d) return false;
+  if (kind === "claude") {
+    return Boolean(
+      s.procEnv.CLAUDE_CODE_OAUTH_TOKEN ||
+        s.procEnv.ANTHROPIC_API_KEY ||
+        s.procEnv.ANTHROPIC_AUTH_TOKEN,
+    );
+  }
+  if (d.authKind === "config-dir" && d.defaultHostDir) {
+    return s.fileExists(join(d.defaultHostDir(s.ownerHome()), "auth.json"));
+  }
+  return false;
+}
+
+function synthesizeDefault(
+  kind: string,
+  s: AccountSeams,
+): ResolvedEngineAccount | null {
+  const d = KINDS[kind];
+  if (!d || !defaultAvailable(kind, s)) return null;
+  if (d.authKind === "env") {
+    // Ambient: the token in .env.local/process.env is forwarded via passEnv,
+    // so the default account injects nothing.
+    return {
+      id: `default:${kind}`,
+      kind,
+      label: "Default",
+      isDefault: true,
+      authKind: "env",
+      scope: HOST_ACCOUNT_SCOPE,
+      execEnv: {},
+    };
+  }
+  const containerDir = d.defaultContainerDir as string;
+  return {
+    id: `default:${kind}`,
+    kind,
+    label: "Default",
+    isDefault: true,
+    authKind: "config-dir",
+    scope: HOST_ACCOUNT_SCOPE,
+    execEnv: d.selectVar ? { [d.selectVar]: containerDir } : {},
+    configDir: {
+      hostDir: (d.defaultHostDir as (o: string) => string)(s.ownerHome()),
+      containerDir,
+    },
+  };
+}
+
+/** DB extras for a kind, resolved into injectable form. */
+function resolveExtras(
+  kind: string,
+  s: AccountSeams,
+  scope: string,
+): ResolvedEngineAccount[] {
+  const d = KINDS[kind];
+  if (!d) return [];
+  const rows = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .all()
+    .filter(
+      (r) =>
+        r.kind === kind &&
+        accountInScope((r as { scope?: string | null }).scope, scope),
+    )
+    .sort(compareAccountRows);
+  const out: ResolvedEngineAccount[] = [];
+  for (const row of rows) {
+    if (row.authKind === "env") {
+      let execEnv: Record<string, string> = {};
+      try {
+        execEnv = row.secretEnc
+          ? (JSON.parse(unpackSecret(row.secretEnc)) as Record<string, string>)
+          : {};
+      } catch (err) {
+        console.warn(
+          `[engine-accounts] skipping ${kind}/${row.id}: decrypt failed (${
+            err instanceof Error ? err.message : String(err)
+          })`,
+        );
+        continue;
+      }
+      out.push({
+        id: row.id,
+        kind,
+        label: row.label,
+        isDefault: false,
+        authKind: "env",
+        scope,
+        execEnv,
+      });
+    } else if (row.authKind === "config-dir" && row.configDir && d.selectVar) {
+      const containerDir = `${d.containerDirPrefix}${row.id}`;
+      out.push({
+        id: row.id,
+        kind,
+        label: row.label,
+        isDefault: false,
+        authKind: "config-dir",
+        scope,
+        execEnv: { [d.selectVar]: containerDir },
+        configDir: { hostDir: row.configDir, containerDir },
+      });
+    } else if (row.authKind === "config-dir" && isStoreHeldRow(row)) {
+      // ADR-136 sign-in box: the material lives in the store, not here. The
+      // row is listed (label, scope — what the capabilities frame carries)
+      // and never provisioned: the box runs no task.
+      out.push({
+        id: row.id,
+        kind,
+        label: row.label,
+        isDefault: false,
+        authKind: "config-dir",
+        scope,
+        execEnv: {},
+      });
+    }
+  }
+  return out;
+}
+
+/** All accounts for a kind: [default if present] + [DB extras]. */
+export function resolveEngineAccounts(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): ResolvedEngineAccount[] {
+  const s = withDefaults(seams);
+  const accounts: ResolvedEngineAccount[] = [];
+  // The default slot is the OWNER's credential: it joins the host scope only.
+  if (scope === HOST_ACCOUNT_SCOPE) {
+    const def = synthesizeDefault(kind, s);
+    if (def) accounts.push(def);
+  }
+  accounts.push(...resolveExtras(kind, s, scope));
+  return accounts;
+}
+
+/** Public account list for the host UI (no secrets). */
+export function listEngineAccounts(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): EngineAccountInfo[] {
+  return resolveEngineAccounts(kind, seams, scope).map((a) => ({
+    id: a.id,
+    kind: a.kind,
+    label: a.label,
+    authKind: a.authKind,
+    isDefault: a.isDefault,
+    scope: a.scope,
+  }));
+}
+
+/** Every scope holding at least one stored account for the kind, plus
+ *  `host` (which may consist of the default slot alone). */
+export function engineAccountScopes(kind: string): string[] {
+  const scopes = new Set<string>([HOST_ACCOUNT_SCOPE]);
+  for (const row of getDb().select().from(schema.engineAccounts).all()) {
+    if (row.kind !== kind) continue;
+    scopes.add((row as { scope?: string | null }).scope ?? HOST_ACCOUNT_SCOPE);
+  }
+  return [...scopes];
+}
+
+/** Account list across ALL scopes — the capabilities advertisement. The
+ *  cloud filters per caller; labels only, never credentials. */
+export function listEngineAccountsAllScopes(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+): EngineAccountInfo[] {
+  return engineAccountScopes(kind).flatMap((scope) =>
+    listEngineAccounts(kind, seams, scope),
+  );
+}
+
+/** How many accounts a kind has right now (default + extras). */
+export function engineAccountCount(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): number {
+  return resolveEngineAccounts(kind, seams, scope).length;
+}
+
+// ---------------------------------------------------------------------------
+// Rotation state (in-memory) + selection.
+// ---------------------------------------------------------------------------
+
+interface RotationState {
+  /** One account may be capped by several independent provider windows. Null
+   * is a rate-limit error that named no window and needs a full snapshot to
+   * disprove. Each cause keeps its own deadline so clearing one cannot clear
+   * or extend another. */
+  cooldowns: Map<string | null, number>;
+  lastUsedAt: number;
+}
+
+const rotationState = new Map<string, RotationState>();
+
+/** Default cooldown when the engine gives no reset hint. */
+export const DEFAULT_COOLDOWN_MS = 15 * 60_000;
+/** Provider resets too close to the current instant still need a short bench
+ * so repeated terminal events cannot hot-loop the same account. */
+export const MIN_ENGINE_ACCOUNT_COOLDOWN_MS = 60_000;
+/** Refuse a corrupt/far-future provider timestamp from benching an account
+ * indefinitely. */
+export const MAX_ENGINE_ACCOUNT_COOLDOWN_MS = 7 * 24 * 60 * 60_000;
+
+function state(id: string): RotationState {
+  let st = rotationState.get(id);
+  if (!st) {
+    st = { cooldowns: new Map(), lastUsedAt: 0 };
+    rotationState.set(id, st);
+  }
+  return st;
+}
+
+function cooldown(
+  id: string,
+  window: string | null,
+  ms: number,
+  now: number,
+): void {
+  const account = state(id);
+  const previous = account.cooldowns.get(window) ?? 0;
+  account.cooldowns.set(window, Math.max(previous, now + ms));
+}
+
+function cooldownDuration(resetsAt: number, now: number): number {
+  return Number.isFinite(resetsAt)
+    ? Math.min(
+        MAX_ENGINE_ACCOUNT_COOLDOWN_MS,
+        Math.max(MIN_ENGINE_ACCOUNT_COOLDOWN_MS, resetsAt - now),
+      )
+    : DEFAULT_COOLDOWN_MS;
+}
+
+function accountCooldownUntil(id: string): number {
+  return Math.max(0, ...state(id).cooldowns.values());
+}
+
+/** Put an account on cooldown (rate-limited). */
+export function cooldownEngineAccount(
+  id: string,
+  ms: number = DEFAULT_COOLDOWN_MS,
+  now: number = Date.now(),
+): void {
+  cooldown(id, null, ms, now);
+}
+
+/** Put an account on cooldown through the engine's real reset, bounded against
+ * stale or corrupt timestamps. */
+export function cooldownEngineAccountUntil(
+  id: string,
+  resetsAt: number,
+  now: number = Date.now(),
+): void {
+  cooldown(id, null, cooldownDuration(resetsAt, now), now);
+}
+
+/** Bench one named provider window without conflating it with another. */
+export function cooldownEngineAccountWindow(
+  id: string,
+  window: string,
+  ms: number = DEFAULT_COOLDOWN_MS,
+  now: number = Date.now(),
+): void {
+  cooldown(id, window, ms, now);
+}
+
+/** Bench one named provider window through its bounded real reset. */
+export function cooldownEngineAccountWindowUntil(
+  id: string,
+  window: string,
+  resetsAt: number,
+  now: number = Date.now(),
+): void {
+  cooldown(id, window, cooldownDuration(resetsAt, now), now);
+}
+
+/** A per-window reading proves only that same provider window usable. */
+export function clearEngineAccountCooldownWindow(
+  id: string,
+  window: string,
+): void {
+  rotationState.get(id)?.cooldowns.delete(window);
+}
+
+/** A complete provider snapshot with no limited window disproves every bench,
+ * including an error that could not name which window was exhausted. */
+export function clearEngineAccountCooldowns(id: string): void {
+  rotationState.get(id)?.cooldowns.clear();
+}
+
+/** Record that an account was just used (least-recently-used ordering). */
+export function noteEngineAccountUsed(id: string, now: number = Date.now()): void {
+  state(id).lastUsedAt = now;
+}
+
+/**
+ * Pure selection over a resolved list: least-recently-used account not in
+ * `exclude` and not cooling. Falls back to the least-recently-used cooling
+ * account if ALL are cooling (better to try a capped account than stall).
+ * Returns null only when the list (minus exclusions) is empty.
+ */
+export function selectAccount(
+  accounts: ResolvedEngineAccount[],
+  opts: { exclude?: Set<string>; now?: number; preferredId?: string } = {},
+): ResolvedEngineAccount | null {
+  const now = opts.now ?? Date.now();
+  const exclude = opts.exclude ?? new Set<string>();
+  const candidates = accounts.filter((a) => !exclude.has(a.id));
+  if (candidates.length === 0) return null;
+  const lru = (a: ResolvedEngineAccount): number => state(a.id).lastUsedAt;
+  const healthy = candidates.filter((a) => accountCooldownUntil(a.id) <= now);
+  const preferred = opts.preferredId
+    ? healthy.find((account) => account.id === opts.preferredId)
+    : undefined;
+  if (preferred) return preferred;
+  // Manage-v1: the list arrives in PRIORITY order (default slot, then extras
+  // by position) — the first healthy account wins, so the operator's
+  // ordering decides which account a task uses and which are fallbacks.
+  // Only when every account is cooling do we fall back to the least recently
+  // used one (the stalest cooldown is the likeliest to have lifted).
+  if (healthy.length > 0) return healthy[0]!;
+  return candidates.reduce(
+    (best, a) => (lru(a) < lru(best) ? a : best),
+    candidates[0]!,
+  );
+}
+
+/** Pick an account for a kind (default + extras), applying rotation state. */
+export function pickEngineAccount(
+  kind: string,
+  opts: {
+    exclude?: Set<string>;
+    seams?: Partial<AccountSeams>;
+    now?: number;
+    /** One agent's durable preference; cooling or absent falls through. */
+    preferredId?: string;
+    /** ADR-131 D3: the task's scope; default = the host's own accounts. */
+    scope?: string;
+  } = {},
+): ResolvedEngineAccount | null {
+  const accounts = resolveEngineAccounts(
+    kind,
+    opts.seams ?? {},
+    opts.scope ?? HOST_ACCOUNT_SCOPE,
+  );
+  return selectAccount(accounts, {
+    exclude: opts.exclude,
+    now: opts.now,
+    preferredId: opts.preferredId,
+  });
+}
+
+/**
+ * ADR-076 + codex-cli 0.152.0: two codex agents sharing one account share one
+ * CODEX_HOME, and codex's sqlite state runtime cannot be opened by two
+ * concurrent processes. These pure helpers give each codex agent its own
+ * home (a copy of the account's) — the orchestrator wraps them with the
+ * container exec. Only codex config-dir homes under /home/node/.codex are
+ * isolated; ambient/env accounts and other kinds are left untouched.
+ */
+export function codexHomeIsolatable(
+  kind: string,
+  codexHome: string | undefined,
+): codexHome is string {
+  return (
+    kind === "codex" &&
+    typeof codexHome === "string" &&
+    codexHome.startsWith("/home/node/.codex")
+  );
+}
+
+/** The per-agent home for a shared account home. Agent id is sanitized so it
+ *  is always a safe path segment. */
+export function codexPerAgentHome(codexHome: string, agentId: string): string {
+  const safe = agentId.replace(/[^A-Za-z0-9_-]/g, "_");
+  return `${codexHome}-agent-${safe}`;
+}
+
+/** The idempotent seed command: copy the account home into the per-agent home
+ *  ONCE (only when the per-agent home is still empty), node-owned. */
+export function codexHomeSeedCommand(
+  codexHome: string,
+  perAgentHome: string,
+): string {
+  return (
+    `set -e; mkdir -p "${perAgentHome}"; ` +
+    `if [ -z "$(ls -A "${perAgentHome}" 2>/dev/null)" ]; then ` +
+    `cp -a "${codexHome}/." "${perAgentHome}/" 2>/dev/null || true; fi; ` +
+    `chown -R node:node "${perAgentHome}"`
+  );
+}
+
+/** Test hook: clear in-memory rotation state. */
+export function resetRotationState(): void {
+  rotationState.clear();
+}
+
+// ---------------------------------------------------------------------------
+// Provisioning (extra config-dir accounts) — copied into per-account container
+// dirs at session start, since task-up.sh (bash) can't read the sealed DB.
+// ---------------------------------------------------------------------------
+
+/**
+ * ADR-135: what a task receives for a config-dir account. The host dir is
+ * copied verbatim EXCEPT that a lane-owned `auth.json` gets its rotating
+ * refresh token replaced by the broker placeholder, and the broker's own
+ * sidecar never travels. Returns a private temp dir (0700) the caller copies
+ * from and must remove; null means "copy the host dir as it is".
+ */
+export function stageBrokeredAccountDir(
+  kind: string,
+  hostDir: string,
+): { dir: string; cleanup: () => void } | null {
+  let entries: string[];
+  try {
+    entries = readdirSync(hostDir);
+  } catch {
+    return null;
+  }
+  const files: Record<string, string> = {};
+  const binaries = new Map<string, Buffer>();
+  for (const name of entries) {
+    if (name === BROKER_SIDECAR_FILE) continue;
+    const path = join(hostDir, name);
+    let content: Buffer;
+    try {
+      if (!statSync(path).isFile()) continue;
+      content = readFileSync(path);
+    } catch {
+      continue;
+    }
+    if (name === "auth.json") files[name] = content.toString("utf8");
+    else binaries.set(name, content);
+  }
+  if (!("auth.json" in files)) return null;
+  const brokered = brokeredFilesFor(
+    { kind, authKind: "config-dir", id: "staging", scope: HOST_ACCOUNT_SCOPE },
+    files,
+  );
+  if (brokered === files) return null;
+  const dir = mkdtempSync(join(tmpdir(), "uai-brokered-"));
+  try {
+    chmodSync(dir, 0o700);
+    for (const [name, content] of Object.entries(brokered)) {
+      writeFileSync(join(dir, name), content, { mode: 0o600 });
+    }
+    for (const [name, content] of binaries) {
+      writeFileSync(join(dir, name), content, { mode: 0o600 });
+    }
+  } catch (err) {
+    rmSync(dir, { recursive: true, force: true });
+    throw err;
+  }
+  return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}
+
+async function copyDirInto(
+  hostDir: string,
+  containerDir: string,
+  container: string,
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "copy">,
+  kind?: string,
+): Promise<void> {
+  // ADR-135: never hand a task the rotating refresh token.
+  const staged = kind ? stageBrokeredAccountDir(kind, hostDir) : null;
+  if (staged) {
+    try {
+      await copyDirIntoRaw(staged.dir, containerDir, container, environment);
+    } finally {
+      staged.cleanup();
+    }
+    return;
+  }
+  await copyDirIntoRaw(hostDir, containerDir, container, environment);
+}
+
+/** The broker's per-dir metadata (docs/token-broker.md); never copied. */
+export const BROKER_SIDECAR_FILE = "uai-broker.json";
+
+async function copyDirIntoRaw(
+  hostDir: string,
+  containerDir: string,
+  container: string,
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "copy">,
+): Promise<void> {
+  if (environment) {
+    const run = async (argv: [string, ...string[]], step: string) => {
+      const result = await environment.exec({
+        projectEnvProfile: "maintenance",
+        argv,
+        user: "root",
+        env: RUNTIME_AUTHORITY_ENV,
+        timeoutMs: EXEC_TIMEOUT_MS,
+        maxOutputBytes: 64 * 1024,
+      });
+      if (result.exitCode !== 0) {
+        const detail = Buffer.from(result.stderr).toString("utf8").trim().slice(0, 200);
+        throw new Error(
+          `${step} failed (${result.exitCode === null ? "environment timeout" : `exit ${result.exitCode}`})` +
+            (detail ? `: ${detail}` : ""),
+        );
+      }
+    };
+    await run(["/bin/mkdir", "-p", containerDir], `mkdir ${containerDir}`);
+    // The mkdir above runs as root, but a MACHINE copy extracts as the ssh
+    // user (node) — into a root-owned directory it dies with "Cannot open:
+    // Permission denied" and the account never authenticates (live
+    // 2026-09-07, first scoped Codex account on the shared host). Hand the
+    // directory to node BEFORE the copy; this also repairs a directory an
+    // earlier failed attempt left root-owned on a still-running machine.
+    await run(
+      ["/bin/chown", "-R", "node:node", containerDir],
+      `chown -R node:node ${containerDir}`,
+    );
+    await environment.copy({
+      direction: "into",
+      source: hostDir,
+      destination: containerDir,
+    });
+    await run(
+      ["/bin/chown", "-R", "node:node", containerDir],
+      `chown -R node:node ${containerDir}`,
+    );
+    return;
+  }
+  // Backend-aware fallback (2026-08-18 sweep + review round 4): the apple
+  // path normally arrives with an environment handle above; when it does
+  // not, the bundled CLI speaks these exec/cp verbs — but the CALLER's name
+  // is the Docker replica shape, which does not exist on apple.
+  const target = taskContainerBackend().apple
+    ? container.replace(/-app-1$/, "-app")
+    : container;
+  const must = async (args: string[], step: string): Promise<void> => {
+    const res = await taskContainerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
+    if (res.status !== 0) {
+      const detail = res.stderr.trim().slice(0, 200);
+      throw new Error(
+        `${step} failed (${res.status === null ? "docker timeout" : `exit ${res.status}`})` +
+          (detail ? `: ${detail}` : ""),
+      );
+    }
+  };
+  await must(
+    [
+      "exec",
+      "-u",
+      "root",
+      ...runtimeAuthorityDockerExecArgs(),
+      target,
+      "/bin/mkdir",
+      "-p",
+      containerDir,
+    ],
+    `mkdir ${containerDir}`,
+  );
+  // Copy the dir CONTENTS (trailing /.) into the target dir.
+  await must(["cp", `${hostDir}/.`, `${target}:${containerDir}`], "docker cp account dir");
+  await must(
+    [
+      "exec",
+      "-u",
+      "root",
+      ...runtimeAuthorityDockerExecArgs(),
+      target,
+      "/bin/chown",
+      "-R",
+      "node:node",
+      containerDir,
+    ],
+    `chown -R node:node ${containerDir}`,
+  );
+}
+
+/**
+ * Copy every EXTRA config-dir account (for the given kinds) into its per-account
+ * container dir + chown. The DEFAULT account is copied by task-up.sh, so it is
+ * skipped here. Best-effort per account — failures are logged (no secrets) and
+ * reported in aggregate so the orchestrator can retry without hot-looping.
+ */
+export interface ProvisionEngineAccountsResult {
+  copied: number;
+  failed: number;
+  mayHaveMutated: boolean;
+}
+
+export async function provisionEngineAccounts(
+  container: string,
+  kinds: Iterable<string>,
+  seams: Partial<AccountSeams> = {},
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "copy">,
+  scope: string = HOST_ACCOUNT_SCOPE,
+): Promise<ProvisionEngineAccountsResult> {
+  const s = withDefaults(seams);
+  const seen = new Set<string>();
+  let copied = 0;
+  let failed = 0;
+  let mayHaveMutated = false;
+  for (const kind of kinds) {
+    if (seen.has(kind)) continue;
+    seen.add(kind);
+    for (const account of resolveEngineAccounts(kind, s, scope)) {
+      if (account.isDefault || !account.configDir) continue;
+      if (!s.fileExists(account.configDir.hostDir)) {
+        failed += 1;
+        continue;
+      }
+      try {
+        await copyDirInto(
+          account.configDir.hostDir,
+          account.configDir.containerDir,
+          container,
+          environment,
+          kind,
+        );
+        copied += 1;
+      } catch (err) {
+        failed += 1;
+        // copyDirInto performs more than one external operation. A non-zero
+        // result can therefore mean the destination changed before the
+        // failure surfaced; callers must fence/reassert managed config.
+        mayHaveMutated = true;
+        console.error(
+          `[engine-accounts] provision ${kind}/${account.id} into ${container}: ` +
+            `${err instanceof Error ? err.message : err} — this account won't authenticate in the task`,
+        );
+      }
+    }
+  }
+  return { copied, failed, mayHaveMutated };
+}
+
+/** Priority order within (scope, kind): position, then age. Rows from before
+ *  manage-v1 all carry 0 and therefore keep their creation order. */
+function compareAccountRows(
+  a: { position?: number | null; createdAt: number; id: string },
+  b: { position?: number | null; createdAt: number; id: string },
+): number {
+  return (
+    (a.position ?? 0) - (b.position ?? 0) ||
+    a.createdAt - b.createdAt ||
+    a.id.localeCompare(b.id)
+  );
+}
+
+/** New accounts join the END of their (scope, kind) order. */
+function nextPosition(kind: string, scope: string): number {
+  let max = -1;
+  for (const row of getDb().select().from(schema.engineAccounts).all()) {
+    if (row.kind !== kind) continue;
+    if (((row as { scope?: string | null }).scope ?? HOST_ACCOUNT_SCOPE) !== scope) continue;
+    max = Math.max(max, (row as { position?: number | null }).position ?? 0);
+  }
+  return max + 1;
+}
+
+// ---------------------------------------------------------------------------
+// Mutations (host UI).
+// ---------------------------------------------------------------------------
+
+export interface AddAccountResult {
+  ok: boolean;
+  message: string;
+  id?: string;
+}
+
+/**
+ * Register an EXTRA account for a kind by pasting a token / API key (ADR-076).
+ * Claude accepts a `setup-token` token or an `sk-ant-…` key; Codex accepts an
+ * OpenAI API key (written into an isolated `~/.codex-acct-<id>/auth.json`).
+ */
+/** What a labeled account will hold once persisted — the validated shape
+ *  shared by the local writer (owned and shared hosts) and the store-only
+ *  writer (the ADR-136 sign-in box), so both refuse the same inputs with the
+ *  same words. Never logged. */
+type LabeledAccountPlan =
+  | { authKind: "env"; label: string; env: Record<string, string>; message: string }
+  | { authKind: "config-dir"; label: string; files: Record<string, string>; message: string };
+
+type PlannedAccount = { ok: false; message: string } | { ok: true; plan: LabeledAccountPlan };
+
+/**
+ * What a pasted token or API key becomes for an engine: env vars, or (Codex)
+ * an `auth.json` holding the key. Shared by local accounts and ADR-154
+ * capture flows, which carry no local scope.
+ */
+export function pastedSecretMaterial(
+  kind: string,
+  rawSecret: string,
+): { ok: true; material: Exclude<EngineCaptureMaterial, { authKind: "custom-connection" }> } | { ok: false; message: string } {
+  const secret = rawSecret.trim();
+  if (!secret) return { ok: false, message: "Paste a token or API key." };
+  if (/\s/.test(secret) || secret.length < 12) {
+    return { ok: false, message: "That doesn't look like a token. Paste just the value." };
+  }
+  if (kind === "claude") {
+    const envVar = secret.startsWith("sk-ant-api")
+      ? "ANTHROPIC_API_KEY"
+      : "CLAUDE_CODE_OAUTH_TOKEN";
+    return { ok: true, material: { authKind: "env", env: { [envVar]: secret } } };
+  }
+  const envKeyVar = API_KEY_ENV_VARS[kind];
+  if (envKeyVar) {
+    return { ok: true, material: { authKind: "env", env: { [envKeyVar]: secret } } };
+  }
+  if (kind === "codex") {
+    return {
+      ok: true,
+      material: {
+        authKind: "config-dir",
+        files: { "auth.json": `${JSON.stringify({ OPENAI_API_KEY: secret }, null, 2)}\n` },
+      },
+    };
+  }
+  return {
+    ok: false,
+    message: `Adding a second ${kind} account isn't supported yet — connect the primary account from the Engines panel.`,
+  };
+}
+
+function planLabeledAccount(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  scope: string,
+): PlannedAccount {
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  const pasted = pastedSecretMaterial(kind, creds.token ?? creds.apiKey ?? "");
+  if (!pasted.ok) return pasted;
+  const engineName =
+    kind === "claude"
+      ? "Claude"
+      : kind === "codex"
+        ? "Codex"
+        : (API_KEY_ENGINE_LABELS[kind] ?? kind);
+  const message = `Added ${engineName} account "${trimmedLabel}".`;
+  return {
+    ok: true,
+    plan:
+      pasted.material.authKind === "env"
+        ? { authKind: "env", label: trimmedLabel, env: pasted.material.env, message }
+        : { authKind: "config-dir", label: trimmedLabel, files: pasted.material.files, message },
+  };
+}
+
+function planCapturedConfigDirAccount(
+  kind: "codex" | "grok",
+  label: string,
+  authJson: string,
+  scope: string,
+): PlannedAccount {
+  const engineLabel = kind === "codex" ? "Codex" : "Grok";
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  try {
+    const parsed: unknown = JSON.parse(authJson);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("not an object");
+    }
+  } catch {
+    return { ok: false, message: `The captured ${engineLabel} credential is not valid.` };
+  }
+  return {
+    ok: true,
+    plan: {
+      authKind: "config-dir",
+      label: trimmedLabel,
+      files: { "auth.json": authJson.endsWith("\n") ? authJson : `${authJson}\n` },
+      message: `Added ${engineLabel} account "${trimmedLabel}".`,
+    },
+  };
+}
+
+/** Persist a plan on THIS host — a sealed env row or an isolated config dir
+ *  under the owner's home — and mirror it to the store when one is configured. */
+function persistPlannedAccountLocally(
+  kind: string,
+  scope: string,
+  plan: LabeledAccountPlan,
+  s: AccountSeams,
+): AddAccountResult {
+  const id = newId();
+  let configDir: string | null = null;
+  if (plan.authKind === "config-dir") {
+    const d = KINDS[kind];
+    if (!d?.extraHostDir) {
+      return { ok: false, message: `${kind} has no config-dir layout.` };
+    }
+    const hostDir = d.extraHostDir(s.ownerHome(), id);
+    try {
+      mkdirSync(hostDir, { recursive: true });
+      for (const [basename, content] of Object.entries(plan.files)) {
+        const file = join(hostDir, basename);
+        writeFileSync(file, content, { mode: 0o600 });
+        try {
+          chmodSync(file, 0o600);
+        } catch {
+          /* best effort */
+        }
+      }
+    } catch (err) {
+      return {
+        ok: false,
+        message: `Could not write the account config: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      };
+    }
+    configDir = hostDir;
+  }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind,
+      label: plan.label,
+      authKind: plan.authKind,
+      secretEnc: plan.authKind === "env" ? packSecret(JSON.stringify(plan.env)) : null,
+      configDir,
+      createdAt: Date.now(),
+      scope,
+      position: nextPosition(kind, scope),
+    })
+    .run();
+  mirrorEngineAccount(id);
+  return { ok: true, message: plan.message, id };
+}
+
+export function addEngineAccount(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): AddAccountResult {
+  const planned = planLabeledAccount(kind, label, creds, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountLocally(kind, scope, planned.plan, withDefaults(seams));
+}
+
+/**
+ * ADR-116: register an EXTRA Codex account from a browser-login capture — the
+ * verbatim `auth.json` a `codex login` flow produced (OAuth tokens, not an
+ * API key), written into the same isolated `~/.codex-acct-<id>` layout the
+ * pasted-key path uses. Callers pass the file CONTENTS; nothing is logged.
+ */
+export function addCodexAccountFromAuthJson(
+  label: string,
+  authJson: string,
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): AddAccountResult {
+  return addConfigDirAccountFromAuthJson("codex", label, authJson, seams, scope);
+}
+
+/** Grok (host 0.9.105): the `auth.json` a `grok login --device-auth` capture
+ *  produced, stored as an isolated `~/.grok-acct-<id>` selected by GROK_HOME. */
+export function addGrokAccountFromAuthJson(
+  label: string,
+  authJson: string,
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): AddAccountResult {
+  return addConfigDirAccountFromAuthJson("grok", label, authJson, seams, scope);
+}
+
+function addConfigDirAccountFromAuthJson(
+  kind: "codex" | "grok",
+  label: string,
+  authJson: string,
+  seams: Partial<AccountSeams>,
+  scope: string,
+): AddAccountResult {
+  const planned = planCapturedConfigDirAccount(kind, label, authJson, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountLocally(kind, scope, planned.plan, withDefaults(seams));
+}
+
+/** Remove an EXTRA account (idempotent). The synthesized default can't be
+ *  removed here (use the engine disconnect flow for the legacy slot). The
+ *  isolated host config dir of a config-dir account is deleted too. */
+/** Whether a caller acting in `scope` may remove `row`. `undefined` is the
+ *  host's own local UI, which may remove anything. */
+export function accountRemovableInScope(
+  row: { scope?: string | null },
+  scope: string | undefined,
+): boolean {
+  return scope === undefined || accountInScope(row.scope, scope);
+}
+
+export function removeEngineAccount(
+  id: string,
+  scope?: string,
+): { ok: boolean; message: string } {
+  if (id.startsWith("default:")) {
+    return {
+      ok: false,
+      message: "The default account is managed from the engine's Connect/Disconnect.",
+    };
+  }
+  const row = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .where(eq(schema.engineAccounts.id, id))
+    .get();
+  if (!row) return { ok: true, message: "Account already removed." };
+  // ADR-131 D3: a workspace removes only its own accounts — never the host's
+  // and never another workspace's, whatever id it names.
+  if (!accountRemovableInScope(row, scope)) {
+    return { ok: false, message: "That account belongs to a different scope." };
+  }
+  removeLocalAccountRow(row);
+  // ADR-134: the parameter goes too, best effort; the row is already gone.
+  queueStoreWrite(`delete ${id}`, async (store) => {
+    const name = row.storeRef ?? engineAccountParameterName(row);
+    if (name) await store.delete(name);
+  });
+  return { ok: true, message: `Removed "${row.label}".` };
+}
+
+/** Manage-v1: relabel an extra account. Same scope rule as removal. */
+export function renameEngineAccount(
+  id: string,
+  label: string,
+  scope?: string,
+): { ok: boolean; message: string } {
+  if (id.startsWith("default:")) {
+    return { ok: false, message: "The default account cannot be renamed." };
+  }
+  const trimmed = label.trim();
+  if (!isEngineAccountLabel(trimmed)) {
+    return { ok: false, message: "Give the account a label (up to 64 characters)." };
+  }
+  const row = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .where(eq(schema.engineAccounts.id, id))
+    .get();
+  if (!row) return { ok: false, message: "That account no longer exists." };
+  if (!accountRemovableInScope(row, scope)) {
+    return { ok: false, message: "That account belongs to a different scope." };
+  }
+  getDb()
+    .update(schema.engineAccounts)
+    .set({ label: trimmed })
+    .where(eq(schema.engineAccounts.id, id))
+    .run();
+  mirrorEngineAccount(id);
+  return { ok: true, message: `Renamed to "${trimmed}".` };
+}
+
+/**
+ * Manage-v1: set the priority order of `kind`'s extra accounts in `scope`.
+ * `ids` must be exactly the set of that kind's rows in the scope — a stale
+ * list (an account added or removed meanwhile) is refused rather than
+ * silently partially applied.
+ */
+export function reorderEngineAccounts(
+  kind: string,
+  ids: readonly string[],
+  scope: string = HOST_ACCOUNT_SCOPE,
+): { ok: boolean; message: string } {
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
+  const rows = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .all()
+    .filter(
+      (r) =>
+        r.kind === kind &&
+        ((r as { scope?: string | null }).scope ?? HOST_ACCOUNT_SCOPE) === scope,
+    );
+  const have = new Set(rows.map((r) => r.id));
+  const want = new Set(ids);
+  if (
+    have.size !== want.size ||
+    ids.length !== want.size ||
+    [...have].some((id) => !want.has(id))
+  ) {
+    return {
+      ok: false,
+      message: "The account list changed — refresh and try again.",
+    };
+  }
+  ids.forEach((id, index) => {
+    getDb()
+      .update(schema.engineAccounts)
+      .set({ position: index })
+      .where(eq(schema.engineAccounts.id, id))
+      .run();
+  });
+  for (const id of ids) mirrorEngineAccount(id);
+  return { ok: true, message: "Order saved." };
+}
+
+/** Delete a row and its isolated config dir (no store call). */
+function removeLocalAccountRow(row: {
+  id: string;
+  authKind: string;
+  configDir: string | null;
+}): void {
+  getDb().delete(schema.engineAccounts).where(eq(schema.engineAccounts.id, row.id)).run();
+  if (row.authKind === "config-dir" && row.configDir) {
+    try {
+      rmSync(row.configDir, { recursive: true, force: true });
+    } catch {
+      /* best effort — the DB row is gone, which is what matters */
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Credential store mirror (ADR-134, docs/credential-store.md).
+//
+// On a Uai-operated host the rows above are a CACHE of AWS Parameter Store:
+// every mutation mirrors its row (metadata + secret material) to one
+// parameter, and `reconcileEngineAccountsFromStore` at host start imports
+// what this host lacks, uploads rows that were never mirrored, and drops rows
+// whose parameter is gone. Task-up resolution never waits on the store.
+// On an owned host `configuredCredentialStore()` is null and none of this
+// runs — credentials never leave the machine.
+// ---------------------------------------------------------------------------
+
+/** The versioned JSON a parameter holds. Never logged. */
+export interface StoredEngineAccount {
+  v: 1;
+  id: string;
+  kind: string;
+  label: string;
+  authKind: AccountAuthKind;
+  scope: string;
+  position: number;
+  createdAt: number;
+  /** `env` accounts: the exec env the row injects. */
+  env?: Record<string, string>;
+  /** `config-dir` accounts: the dir's files by basename (today: auth.json). */
+  files?: Record<string, string>;
+}
+
+/** Largest single file mirrored from a config dir (Advanced tier is 8 KB total). */
+const MAX_STORED_FILE_BYTES = 8 * 1024;
+
+type StoreRow = {
+  id: string;
+  kind: string;
+  label: string;
+  authKind: string;
+  secretEnc: string | null;
+  configDir: string | null;
+  scope?: string | null;
+  position?: number | null;
+  storeRef?: string | null;
+  createdAt: number;
+};
+
+let storeHostId: string | null = null;
+let warnedNoHostId = false;
+
+/** main.ts: the host id that names `host`-scope parameters. */
+export function configureEngineAccountStore(opts: { hostId: string | null }): void {
+  storeHostId = opts.hostId;
+}
+
+export function engineAccountHostId(): string | null {
+  return storeHostId;
+}
+
+/** Tests: wait for every queued mirror/delete to settle. */
+export async function settleEngineAccountStoreWrites(): Promise<void> {
+  await settleStoreWrites();
+}
+
+/**
+ * The parameter a row mirrors to: `<prefix>/orgs/<orgId>/engines/<kind>/<id>`
+ * for a workspace's account, `<prefix>/hosts/<hostId>/engines/<kind>/<id>` for
+ * the host's own. Null when a host-scope row has no host id to file under.
+ * Throws when an id would not be a legal path segment.
+ */
+export function engineAccountParameterName(
+  row: { id: string; kind: string; scope?: string | null },
+  hostId: string | null = storeHostId,
+): string | null {
+  const scope = row.scope ?? HOST_ACCOUNT_SCOPE;
+  const prefix = credentialStorePrefix();
+  if (scope === HOST_ACCOUNT_SCOPE) {
+    if (!hostId) return null;
+    return parameterName(prefix, "hosts", hostId, "engines", row.kind, row.id);
+  }
+  if (!isEngineAccountScope(scope)) throw new Error(`invalid account scope: ${scope}`);
+  return parameterName(prefix, "orgs", scope.slice("org:".length), "engines", row.kind, row.id);
+}
+
+/** Inverse of `engineAccountParameterName`; null for parameters that are not
+ *  engine accounts (future slices file MCP/GitHub credentials nearby). */
+export function parseEngineAccountParameterName(
+  name: string,
+  prefix: string = credentialStorePrefix(),
+): { scope: string; hostId?: string; kind: string; id: string } | null {
+  if (!name.startsWith(`${prefix}/`)) return null;
+  const parts = name.slice(prefix.length + 1).split("/");
+  if (parts.length !== 5 || parts[2] !== "engines") return null;
+  if (!parts.every((p) => isParameterPathSegment(p))) return null;
+  const [kindOfOwner, owner, , kind, id] = parts as [string, string, string, string, string];
+  if (kindOfOwner === "orgs") return { scope: `org:${owner}`, kind, id };
+  if (kindOfOwner === "hosts") return { scope: HOST_ACCOUNT_SCOPE, hostId: owner, kind, id };
+  return null;
+}
+
+function storedAccountFromRow(row: StoreRow): StoredEngineAccount {
+  const base = {
+    v: 1 as const,
+    id: row.id,
+    kind: row.kind,
+    label: row.label,
+    scope: row.scope ?? HOST_ACCOUNT_SCOPE,
+    position: row.position ?? 0,
+    createdAt: row.createdAt,
+  };
+  if (row.authKind === "env") {
+    const env = row.secretEnc
+      ? (JSON.parse(unpackSecret(row.secretEnc)) as Record<string, string>)
+      : {};
+    return { ...base, authKind: "env", env };
+  }
+  if (row.authKind !== "config-dir" || !row.configDir) {
+    throw new Error(`account ${row.id} has no mirrorable material`);
+  }
+  const files: Record<string, string> = {};
+  for (const entry of readdirSync(row.configDir, { withFileTypes: true })) {
+    if (!entry.isFile() || entry.name === BROKER_SIDECAR_FILE) continue;
+    const content = readFileSync(join(row.configDir, entry.name));
+    if (content.byteLength > MAX_STORED_FILE_BYTES) continue;
+    files[entry.name] = content.toString("utf8");
+  }
+  return { ...base, authKind: "config-dir", files };
+}
+
+function parseStoredAccount(value: string): StoredEngineAccount {
+  const parsed: unknown = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("not an object");
+  }
+  const o = parsed as Record<string, unknown>;
+  if (o.v !== 1) throw new Error(`unsupported version ${String(o.v)}`);
+  if (typeof o.id !== "string" || !isParameterPathSegment(o.id)) throw new Error("bad id");
+  if (typeof o.kind !== "string" || !isParameterPathSegment(o.kind)) throw new Error("bad kind");
+  if (typeof o.label !== "string" || !isEngineAccountLabel(o.label)) throw new Error("bad label");
+  if (typeof o.scope !== "string" || !isEngineAccountScope(o.scope)) throw new Error("bad scope");
+  if (o.authKind !== "env" && o.authKind !== "config-dir") throw new Error("bad authKind");
+  const stringMap = (v: unknown): Record<string, string> | undefined => {
+    if (v === undefined) return undefined;
+    if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("bad map");
+    const out: Record<string, string> = {};
+    for (const [k, val] of Object.entries(v as Record<string, unknown>)) {
+      if (typeof val !== "string") throw new Error("bad map value");
+      out[k] = val;
+    }
+    return out;
+  };
+  return {
+    v: 1,
+    id: o.id,
+    kind: o.kind,
+    label: o.label,
+    authKind: o.authKind,
+    scope: o.scope,
+    position: typeof o.position === "number" ? o.position : 0,
+    createdAt: typeof o.createdAt === "number" ? o.createdAt : Date.now(),
+    env: stringMap(o.env),
+    files: stringMap(o.files),
+  };
+}
+
+
+function selectRow(id: string): StoreRow | undefined {
+  return getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .where(eq(schema.engineAccounts.id, id))
+    .get() as StoreRow | undefined;
+}
+
+function setStoreRef(id: string, storeRef: string): void {
+  getDb()
+    .update(schema.engineAccounts)
+    .set({ storeRef })
+    .where(eq(schema.engineAccounts.id, id))
+    .run();
+}
+
+async function putRow(store: CredentialStore, row: StoreRow, hostId: string | null): Promise<boolean> {
+  if (isStoreHeldRow(row)) {
+    // ADR-136: nothing here to mirror — an empty env put would overwrite the
+    // only copy of the credential.
+    throw new Error(`account ${row.id} is store-held; this station holds no material to mirror`);
+  }
+  const name = engineAccountParameterName(row, hostId);
+  if (!name) {
+    if (!warnedNoHostId) {
+      warnedNoHostId = true;
+      console.warn(
+        "[engine-accounts] host-scope accounts are not mirrored until the host id is known",
+      );
+    }
+    return false;
+  }
+  await store.put(name, JSON.stringify(storedAccountFromRow(row)));
+  if (row.storeRef !== name) setStoreRef(row.id, name);
+  return true;
+}
+
+/** Mirror one row to its parameter, asynchronously and best effort. A no-op
+ *  on owned hosts. Rows read the CURRENT state when the write runs, so a
+ *  burst of edits collapses to the latest content. */
+export function mirrorEngineAccount(id: string): void {
+  queueStoreWrite(`mirror ${id}`, async (store) => {
+    const row = selectRow(id);
+    if (!row) return;
+    if (isStoreHeldRow(row)) {
+      // ADR-136 sign-in box: a rename or reorder rides as metadata tags —
+      // the secret is not here to re-put, and tags are what a replacement
+      // box reads back.
+      await store.tag(row.storeRef!, engineAccountMetadataTags(row));
+      return;
+    }
+    await putRow(store, row, storeHostId);
+  });
+}
+
+function importStoredAccount(
+  stored: StoredEngineAccount,
+  storeRef: string,
+  s: AccountSeams,
+): void {
+  const d = KINDS[stored.kind];
+  if (!d) throw new Error(`unknown engine kind ${stored.kind}`);
+  let secretEnc: string | null = null;
+  let configDir: string | null = null;
+  if (stored.authKind === "env") {
+    secretEnc = packSecret(JSON.stringify(stored.env ?? {}));
+  } else {
+    if (!d.extraHostDir) throw new Error(`${stored.kind} has no config-dir layout`);
+    const hostDir = d.extraHostDir(s.ownerHome(), stored.id);
+    mkdirSync(hostDir, { recursive: true, mode: 0o700 });
+    for (const [basename, content] of Object.entries(stored.files ?? {})) {
+      if (basename.includes("/") || basename.includes("\\") || basename === "..") {
+        throw new Error("bad file name");
+      }
+      const file = join(hostDir, basename);
+      writeFileSync(file, content, { mode: 0o600 });
+      try {
+        chmodSync(file, 0o600);
+      } catch {
+        /* best effort */
+      }
+    }
+    configDir = hostDir;
+  }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id: stored.id,
+      kind: stored.kind,
+      label: stored.label,
+      authKind: stored.authKind,
+      secretEnc,
+      configDir,
+      scope: stored.scope,
+      position: stored.position,
+      storeRef,
+      createdAt: stored.createdAt,
+    })
+    .run();
+}
+
+export interface ReconcileEngineAccountsResult {
+  /** No store is configured (an owned host); nothing was touched. */
+  skipped: boolean;
+  imported: number;
+  uploaded: number;
+  removed: number;
+  errors: number;
+}
+
+/**
+ * Host start: make the local cache agree with the store.
+ *  - a parameter with no local row is imported (a replacement host inherits
+ *    every workspace's accounts);
+ *  - a local row with no `store_ref` is uploaded (first start with the flag);
+ *  - a local row whose `store_ref` is under a successfully listed path but
+ *    absent from it was removed elsewhere — it goes locally too.
+ * Listing failures leave the rows under that path untouched.
+ */
+export async function reconcileEngineAccountsFromStore(
+  opts: { hostId?: string | null; seams?: Partial<AccountSeams> } = {},
+): Promise<ReconcileEngineAccountsResult> {
+  const result: ReconcileEngineAccountsResult = {
+    skipped: false,
+    imported: 0,
+    uploaded: 0,
+    removed: 0,
+    errors: 0,
+  };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const s = withDefaults(opts.seams ?? {});
+  const hostId = opts.hostId === undefined ? storeHostId : opts.hostId;
+  const prefix = credentialStorePrefix();
+  const warn = (line: string): void => console.warn(`[engine-accounts] credential store: ${line}`);
+
+  const paths = engineAccountListPaths(prefix, hostId);
+  if (paths === null) return { ...result, skipped: true };
+  const listed: Array<{ name: string; value: string }> = [];
+  const listedPrefixes: string[] = [];
+  for (const path of paths) {
+    try {
+      listed.push(...(await store.list(path)));
+      listedPrefixes.push(`${path}/`);
+    } catch (err) {
+      result.errors++;
+      warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  const rows = getDb().select().from(schema.engineAccounts).all() as StoreRow[];
+  const byId = new Map(rows.map((r) => [r.id, r]));
+  const seen = new Set<string>();
+  for (const param of listed) {
+    const at = parseEngineAccountParameterName(param.name, prefix);
+    if (!at) continue; // not an engine account
+    if (at.scope === HOST_ACCOUNT_SCOPE && at.hostId !== hostId) continue;
+    seen.add(param.name);
+    let stored: StoredEngineAccount;
+    try {
+      stored = parseStoredAccount(param.value);
+    } catch (err) {
+      result.errors++;
+      warn(`${param.name} is unreadable: ${err instanceof Error ? err.message : String(err)}`);
+      continue;
+    }
+    if (stored.id !== at.id || stored.kind !== at.kind || stored.scope !== at.scope) {
+      result.errors++;
+      warn(`${param.name} does not describe the account its path names; ignored`);
+      continue;
+    }
+    const local = byId.get(stored.id);
+    if (local) {
+      if (local.storeRef !== param.name) setStoreRef(local.id, param.name);
+      continue;
+    }
+    try {
+      importStoredAccount(stored, param.name, s);
+      result.imported++;
+    } catch (err) {
+      result.errors++;
+      warn(`importing ${param.name} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  for (const row of rows) {
+    if (row.storeRef) {
+      const under = listedPrefixes.some((p) => row.storeRef!.startsWith(p));
+      if (under && !seen.has(row.storeRef)) {
+        removeLocalAccountRow(row);
+        result.removed++;
+      }
+      continue;
+    }
+    try {
+      if (await putRow(store, row, hostId)) result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`uploading ${row.kind}/${row.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return result;
+}
+
+/**
+ * ADR-135 pickup: a parameter changed in the store (the broker refreshed it,
+ * or a sibling host re-mirrored it). Update the local row's material in
+ * place — config-dir files rewritten atomically, env secret re-sealed — or
+ * import the row when this host lacks it. Returns the kind touched, or null
+ * when the value is not an engine account this host should hold.
+ */
+export function applyStoredEngineAccount(
+  name: string,
+  value: string,
+  seams: Partial<AccountSeams> = {},
+): { kind: string; id: string; imported: boolean } | null {
+  const at = parseEngineAccountParameterName(name);
+  if (!at) return null;
+  if (at.scope === HOST_ACCOUNT_SCOPE && at.hostId !== storeHostId) return null;
+  const stored = parseStoredAccount(value);
+  if (stored.id !== at.id || stored.kind !== at.kind || stored.scope !== at.scope) {
+    throw new Error("payload does not describe the account its path names");
+  }
+  const row = selectRow(stored.id);
+  if (!row) {
+    importStoredAccount(stored, name, withDefaults(seams));
+    return { kind: stored.kind, id: stored.id, imported: true };
+  }
+  if (row.authKind === "env" && stored.authKind === "env") {
+    getDb()
+      .update(schema.engineAccounts)
+      .set({ secretEnc: packSecret(JSON.stringify(stored.env ?? {})), storeRef: name })
+      .where(eq(schema.engineAccounts.id, row.id))
+      .run();
+  } else if (row.authKind === "config-dir" && stored.authKind === "config-dir" && row.configDir) {
+    mkdirSync(row.configDir, { recursive: true, mode: 0o700 });
+    for (const [basename, content] of Object.entries(stored.files ?? {})) {
+      if (basename.includes("/") || basename.includes("\\") || basename === "..") continue;
+      const file = join(row.configDir, basename);
+      const tmp = `${file}.${process.pid}.tmp`;
+      writeFileSync(tmp, content, { mode: 0o600 });
+      renameSync(tmp, file);
+    }
+    if (row.storeRef !== name) setStoreRef(row.id, name);
+  } else {
+    throw new Error("stored auth kind does not match the local row");
+  }
+  return { kind: stored.kind, id: stored.id, imported: false };
+}
+
+// ---------------------------------------------------------------------------
+// Store-only accounts (ADR-136 sign-in box, docs/shared-host-retirement.md).
+//
+// The small always-on machine behind the "Uai Cloud" row writes every capture
+// STRAIGHT into the credential store and keeps only a metadata row — id, kind,
+// label, scope, position, store_ref — with no sealed secret and no config dir.
+// Its store identity is write-only (put, tag, delete, describe names; never
+// get, never decrypt), so a compromised box can break sign-ins but cannot read
+// one. Labels therefore also ride as parameter TAGS, which
+// `ssm:ListTagsForResource` returns without a KMS grant: a replacement box
+// rebuilds its list from names + tags alone (`reconcileEngineAccountMetadataFromStore`).
+// ---------------------------------------------------------------------------
+
+export const ACCOUNT_LABEL_TAG = "uai_label_b64";
+export const ACCOUNT_POSITION_TAG = "uai_position";
+export const ACCOUNT_CREATED_AT_TAG = "uai_created_at";
+export const ACCOUNT_AUTH_KIND_TAG = "uai_auth_kind";
+/** SSM tag values: 256 chars of `[A-Za-z0-9_.:/=+@ -]`; base64url fits. */
+const MAX_TAG_VALUE_CHARS = 256;
+
+/** A row whose material lives ONLY in the store: a store_ref and no secret. */
+export function isStoreHeldRow(row: {
+  authKind: string;
+  secretEnc: string | null;
+  configDir: string | null;
+  storeRef?: string | null;
+}): boolean {
+  if (!row.storeRef) return false;
+  return row.authKind === "env" ? row.secretEnc === null : row.configDir === null;
+}
+
+/** The secret-free metadata a parameter carries as tags. The label is
+ *  base64url so any label character survives SSM's tag charset; a label too
+ *  long to fit is shortened (the store value keeps the full one). */
+export function engineAccountMetadataTags(row: {
+  label: string;
+  authKind: string;
+  position?: number | null;
+  createdAt: number;
+}): Record<string, string> {
+  let label = row.label;
+  let encoded = Buffer.from(label, "utf8").toString("base64url");
+  while (encoded.length > MAX_TAG_VALUE_CHARS && label.length > 1) {
+    label = label.slice(0, -1);
+    encoded = Buffer.from(label, "utf8").toString("base64url");
+  }
+  return {
+    [ACCOUNT_LABEL_TAG]: encoded,
+    [ACCOUNT_POSITION_TAG]: String(row.position ?? 0),
+    [ACCOUNT_CREATED_AT_TAG]: String(row.createdAt),
+    [ACCOUNT_AUTH_KIND_TAG]: row.authKind,
+  };
+}
+
+function derivedAccountLabel(kind: string, id: string): string {
+  const engine = kind.charAt(0).toUpperCase() + kind.slice(1);
+  return `${engine} ${id.slice(-6)}`;
+}
+
+function labelFromTags(tags: Record<string, string>, kind: string, id: string): string {
+  const encoded = tags[ACCOUNT_LABEL_TAG];
+  if (encoded) {
+    try {
+      const label = Buffer.from(encoded, "base64url").toString("utf8").trim();
+      if (isEngineAccountLabel(label)) return label;
+    } catch {
+      /* fall through */
+    }
+  }
+  return derivedAccountLabel(kind, id);
+}
+
+async function persistPlannedAccountToStore(
+  kind: string,
+  scope: string,
+  plan: LabeledAccountPlan,
+): Promise<AddAccountResult> {
+  const store = configuredCredentialStore();
+  if (!store) {
+    return { ok: false, message: "This station has no credential store to hold the account." };
+  }
+  if (scope === HOST_ACCOUNT_SCOPE) {
+    return { ok: false, message: "Store-only accounts belong to a workspace, not the station." };
+  }
+  const id = newId();
+  const now = Date.now();
+  const position = nextPosition(kind, scope);
+  const row = { id, kind, label: plan.label, authKind: plan.authKind, scope, position, createdAt: now };
+  const name = engineAccountParameterName(row);
+  if (!name) {
+    return { ok: false, message: "Store-only accounts belong to a workspace, not the station." };
+  }
+  const stored: StoredEngineAccount = {
+    v: 1,
+    ...row,
+    ...(plan.authKind === "env" ? { env: plan.env } : { files: plan.files }),
+  };
+  try {
+    await store.put(name, JSON.stringify(stored));
+  } catch (err) {
+    console.warn(
+      `[engine-accounts] store-only ${kind}/${id}: put failed (${err instanceof Error ? err.message : String(err)})`,
+    );
+    return {
+      ok: false,
+      message: "The credential store refused the write; nothing was kept on this station.",
+    };
+  }
+  try {
+    await store.tag(name, engineAccountMetadataTags(row));
+  } catch (err) {
+    console.warn(
+      `[engine-accounts] store-only ${kind}/${id}: tagging failed (${err instanceof Error ? err.message : String(err)}) — a replacement sign-in box lists it as "${derivedAccountLabel(kind, id)}"`,
+    );
+  }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind,
+      label: plan.label,
+      authKind: plan.authKind,
+      secretEnc: null,
+      configDir: null,
+      createdAt: now,
+      scope,
+      position,
+      storeRef: name,
+    })
+    .run();
+  return { ok: true, message: plan.message, id };
+}
+
+/** `addEngineAccount` for the sign-in box: the same validation, the store
+ *  written FIRST and awaited, then a metadata-only row. A store failure is the
+ *  caller's failure and leaves nothing behind. */
+export async function addEngineAccountToStore(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  scope: string,
+): Promise<AddAccountResult> {
+  const planned = planLabeledAccount(kind, label, creds, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountToStore(kind, scope, planned.plan);
+}
+
+/** `addCodexAccountFromAuthJson` / `addGrokAccountFromAuthJson` for the
+ *  sign-in box: the captured auth.json goes to the store, never to a dir. */
+export async function addCapturedConfigDirAccountToStore(
+  kind: "codex" | "grok",
+  label: string,
+  authJson: string,
+  scope: string,
+): Promise<AddAccountResult> {
+  const planned = planCapturedConfigDirAccount(kind, label, authJson, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountToStore(kind, scope, planned.plan);
+}
+
+export interface PurgeLocalEngineAccountSecretsResult {
+  /** Workspace rows whose sealed secret or config dir was removed. */
+  stripped: number;
+  /** Rows deleted outright: host-scope accounts and rows never mirrored. */
+  removed: number;
+  errors: number;
+}
+
+/**
+ * Sign-in box start: nothing the previous release (or an operator) left on
+ * this machine may hold a credential. Workspace rows keep their metadata and
+ * lose their material; host-scope rows and rows the store never received are
+ * deleted — the box holds workspace accounts only, and a secret with no copy
+ * in the store still may not live here.
+ */
+export function purgeLocalEngineAccountSecrets(): PurgeLocalEngineAccountSecretsResult {
+  const result: PurgeLocalEngineAccountSecretsResult = { stripped: 0, removed: 0, errors: 0 };
+  const rows = getDb().select().from(schema.engineAccounts).all() as StoreRow[];
+  for (const row of rows) {
+    const scope = row.scope ?? HOST_ACCOUNT_SCOPE;
+    if (scope === HOST_ACCOUNT_SCOPE || !row.storeRef) {
+      removeLocalAccountRow(row);
+      result.removed++;
+      continue;
+    }
+    if (isStoreHeldRow(row)) continue;
+    if (row.configDir) {
+      try {
+        rmSync(row.configDir, { recursive: true, force: true });
+      } catch {
+        result.errors++;
+      }
+    }
+    getDb()
+      .update(schema.engineAccounts)
+      .set({ secretEnc: null, configDir: null })
+      .where(eq(schema.engineAccounts.id, row.id))
+      .run();
+    result.stripped++;
+  }
+  return result;
+}
+
+export interface ReconcileEngineAccountMetadataResult {
+  skipped: boolean;
+  imported: number;
+  removed: number;
+  errors: number;
+}
+
+/**
+ * Sign-in box start: make the metadata rows agree with the store WITHOUT
+ * reading a value. Names come from `describe-parameters` (allowed on `*`),
+ * labels and order from each new parameter's tags. A workspace parameter this
+ * box lacks becomes a metadata row; a row whose parameter is gone is dropped;
+ * host-scope rows are dropped (the box has none). A failed listing touches
+ * nothing.
+ */
+export async function reconcileEngineAccountMetadataFromStore(): Promise<ReconcileEngineAccountMetadataResult> {
+  const result: ReconcileEngineAccountMetadataResult = { skipped: false, imported: 0, removed: 0, errors: 0 };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  const warn = (line: string): void => console.warn(`[engine-accounts] metadata reconcile: ${line}`);
+  let names: string[];
+  try {
+    names = await store.describeNames(`${prefix}/orgs`);
+  } catch (err) {
+    warn(`listing ${prefix}/orgs failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { ...result, errors: 1 };
+  }
+  const rows = getDb().select().from(schema.engineAccounts).all() as StoreRow[];
+  const byRef = new Set(rows.map((r) => r.storeRef).filter((ref): ref is string => Boolean(ref)));
+  const seen = new Set<string>();
+  for (const name of names) {
+    const at = parseEngineAccountParameterName(name, prefix);
+    if (!at || at.scope === HOST_ACCOUNT_SCOPE) continue;
+    seen.add(name);
+    if (byRef.has(name)) continue;
+    let tags: Record<string, string> = {};
+    try {
+      tags = await store.listTags(name);
+    } catch (err) {
+      result.errors++;
+      warn(`tags of ${name} unreadable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const taggedAuthKind = tags[ACCOUNT_AUTH_KIND_TAG];
+    const authKind: AccountAuthKind =
+      taggedAuthKind === "env" || taggedAuthKind === "config-dir"
+        ? taggedAuthKind
+        : (KINDS[at.kind]?.authKind ?? "env");
+    const position = Number.parseInt(tags[ACCOUNT_POSITION_TAG] ?? "", 10);
+    const createdAt = Number.parseInt(tags[ACCOUNT_CREATED_AT_TAG] ?? "", 10);
+    try {
+      getDb()
+        .insert(schema.engineAccounts)
+        .values({
+          id: at.id,
+          kind: at.kind,
+          label: labelFromTags(tags, at.kind, at.id),
+          authKind,
+          secretEnc: null,
+          configDir: null,
+          scope: at.scope,
+          position: Number.isFinite(position) ? position : 0,
+          storeRef: name,
+          createdAt: Number.isFinite(createdAt) ? createdAt : Date.now(),
+        })
+        .run();
+      result.imported++;
+    } catch (err) {
+      result.errors++;
+      warn(`importing ${name} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const row of rows) {
+    const scope = row.scope ?? HOST_ACCOUNT_SCOPE;
+    if (scope !== HOST_ACCOUNT_SCOPE && row.storeRef && seen.has(row.storeRef)) continue;
+    removeLocalAccountRow(row);
+    result.removed++;
+  }
+  return result;
+}