@phnx-labs/agents-cli 1.22.83 → 1.22.85

package/dist/lib/account-registry.js

@@ -24,10 +24,11 @@ import chalk from 'chalk';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { getUserAgentsDir, readMeta, updateMeta } from './state.js';
 import { isAgentId } from './types.js';
-import { deleteKeychainToken, getKeychainToken, hasKeychainToken } from './secrets/index.js';
-import { bundleExists, deleteBundle, listBundles, readAndResolveBundleEnv, readBundle, renameBundle, writeBundleWithItems } from './secrets/bundles.js';
+import { bundleExistsSync, deleteBundleSync, deleteKeychainTokenSync, getKeychainTokenSync, hasKeychainTokenSync, listBundlesSync, readAndResolveBundleEnvSync, readBundleSync, renameBundleSync, writeBundleWithItemsSync, } from './secrets-client.js';
 import { getAccountProvider } from './account-provider-registry.js';
 import { accountSecretItem, buildAccountBundle, parseAccountBundle, secretVarFor } from './account-schema.js';
+export { recordSlot, readSlots } from './accounts/slots.js';
+export { registeredNativeAccountForEmail, parseNativeIdentityKey } from './native-accounts.js';
 const NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 const NATIVE_LABEL = /^[a-zA-Z0-9][a-zA-Z0-9@._+-]*$/;
 const AUTH_KINDS = ['api-key', 'setup-token', 'bearer-token'];
@@ -56,7 +57,7 @@ function toCredentialAccount(record) {
 /** Every account bundle currently on this device, keyed by stable id. */
 function readAccountBundles() {
     const out = [];
-    for (const bundle of listBundles()) {
+    for (const bundle of listBundlesSync()) {
         const record = parseAccountBundle(bundle);
         if (record)
             out.push(toCredentialAccount(record));
@@ -100,8 +101,8 @@ function migrateLegacyRegistryFile(base) {
         const provider = String(item.provider ?? '');
         const legacySecretRef = String(item.secretRef ?? `agents-cli.accounts.${id}.credential`);
         retiredSecretItems.push(legacySecretRef);
-        if (bundleExists(name)) {
-            const existing = parseAccountBundle(readBundle(name));
+        if (bundleExistsSync(name)) {
+            const existing = parseAccountBundle(readBundleSync(name));
             if (!existing || existing.id !== id) {
                 throw new Error(`Cannot migrate account '${name}': a different secrets bundle already uses that name.`);
             }
@@ -109,17 +110,17 @@ function migrateLegacyRegistryFile(base) {
         }
         const baseUrl = item.baseUrl ? String(item.baseUrl) : undefined;
         const record = { id, name, provider, auth, baseUrl };
-        const secret = hasKeychainToken(legacySecretRef) ? getKeychainToken(legacySecretRef) : '';
+        const secret = hasKeychainTokenSync(legacySecretRef) ? getKeychainTokenSync(legacySecretRef) : '';
         const { bundle, items } = buildAccountBundle(record, secret || 'x');
         if (!secret)
             items.clear(); // no device-local secret: write metadata only
-        writeBundleWithItems(bundle, items);
+        writeBundleWithItemsSync(bundle, items);
     }
     // Success: the file's accounts all exist as bundles now. Archive it and drop
     // the superseded per-account keychain items.
     archiveLegacyFile(file, 'accounts.migrated.yaml');
     for (const legacyItem of retiredSecretItems)
-        deleteKeychainToken(legacyItem);
+        deleteKeychainTokenSync(legacyItem);
 }
 function archiveLegacyFile(file, archiveName) {
     const archived = path.join(path.dirname(file), archiveName);
@@ -275,7 +276,7 @@ function assertUniqueUnifiedName(name, meta, doc, exceptIds, agent) {
 }
 /**
  * Validate a native account NAME (charset + per-harness uniqueness) WITHOUT a
- * known identity — the pre-flight `agents accounts connect` runs before it
+ * known identity — the pre-flight `agents accounts add` runs before it
  * installs a home and drives a login, so a bad/colliding name fails before any
  * side effect instead of orphaning a freshly-minted home (PHNX-3940).
  */
@@ -335,71 +336,24 @@ export function labelNativeAccount(agent, identityKey, identityLabel, label, sco
         if (rowScope === 'device') {
             const native = { ...current.deviceAccounts?.native };
             for (const row of matches)
-                native[row.id] = { id: row.id, name: resolvedLabel, agent, identityKey, identityLabel, scope: rowScope };
+                native[row.id] = { ...native[row.id], name: resolvedLabel, identityLabel, scope: rowScope };
             return { ...current, deviceAccounts: { ...current.deviceAccounts, native } };
         }
         const native = { ...current.accounts?.native };
         for (const row of matches)
-            native[row.id] = { id: row.id, name: resolvedLabel, agent, identityKey, identityLabel, scope: rowScope };
+            native[row.id] = { ...native[row.id], name: resolvedLabel, identityLabel, scope: rowScope };
         return { ...current, accounts: { ...current.accounts, native } };
     });
     return { ...matches[0], name: resolvedLabel, identityLabel, scope: rowScope };
 }
 /**
- * Record THIS box's connect home for an account (PHNX-3940). Device-scoped: the
- * home a box minted for an account is not assumed to exist on any other box, so
- * it lives in the device doc keyed by the stable account id, never on the
- * fleet-synced central identity row. Idempotent. A reconnect reads it back via
- * {@link nativeAccountHome} to reuse the exact home even when the credential has
- * expired and local signed-in discovery can no longer find it.
+ * This box's recorded home LABEL for an account, or null.
+ * Reads the leftover device-scoped `homes` map so legacy `acct-*` installation
+ * labels still resolve (T5/T7); spawn-time HOME is {@link readSlots}[id].slotDir.
  */
-export function setNativeAccountHome(accountId, installationLabel) {
-    updateMeta(current => ({
-        ...current,
-        deviceAccounts: {
-            ...current.deviceAccounts,
-            homes: { ...current.deviceAccounts?.homes, [accountId]: installationLabel },
-        },
-    }));
-}
-/** This box's recorded connect home for an account, or null. */
 export function nativeAccountHome(accountId, meta) {
     return meta.deviceAccounts?.homes?.[accountId] ?? null;
 }
-/**
- * Every installation label THIS box has recorded as SOME account's connect home
- * (PHNX-3940). These are identity-bearing and MUST NEVER be re-minted for a new
- * account — the safe-allocation invariant that stops a new connect from
- * overwriting another account's login.
- */
-export function ownedConnectHomeLabels(meta) {
-    return new Set(Object.values(meta.deviceAccounts?.homes ?? {}));
-}
-function pendingConnectKey(agent, name) {
-    return `${agent}:${name.toLowerCase()}`;
-}
-/** This box's in-flight connect slot for `(agent, name)`, or null. */
-export function pendingConnectSlot(agent, name, meta) {
-    return meta.deviceAccounts?.pendingConnects?.[pendingConnectKey(agent, name)] ?? null;
-}
-/** Record an in-flight connect slot for `(agent, name)` (device-scoped). */
-export function setPendingConnectSlot(agent, name, slot) {
-    updateMeta(current => ({
-        ...current,
-        deviceAccounts: {
-            ...current.deviceAccounts,
-            pendingConnects: { ...current.deviceAccounts?.pendingConnects, [pendingConnectKey(agent, name)]: slot },
-        },
-    }));
-}
-/** Clear the in-flight connect slot for `(agent, name)` once the account lands. */
-export function clearPendingConnectSlot(agent, name) {
-    updateMeta(current => {
-        const pendingConnects = { ...current.deviceAccounts?.pendingConnects };
-        delete pendingConnects[pendingConnectKey(agent, name)];
-        return { ...current, deviceAccounts: { ...current.deviceAccounts, pendingConnects } };
-    });
-}
 /**
  * Set the per-harness default account by NAME only when none is configured
  * (PHNX-3940). Never overrides an existing choice — a first connect selecting a
@@ -528,11 +482,11 @@ export function addAccount(name, provider, auth, secret, base = getUserAgentsDir
     assertUniqueUnifiedName(name, readMeta(), readAccountRegistry(base));
     const adapter = getAccountProvider(provider);
     adapter.validate(auth, secret);
-    if (bundleExists(name))
+    if (bundleExistsSync(name))
         throw new Error(`Secrets bundle '${name}' already exists. Choose a different account name.`);
     const record = { id: crypto.randomUUID(), name, provider: adapter.provider, auth, baseUrl: opts.baseUrl };
     const { bundle, items } = buildAccountBundle(record, secret);
-    writeBundleWithItems(bundle, items);
+    writeBundleWithItemsSync(bundle, items);
     return toCredentialAccount(record);
 }
 export function setAccountSecret(name, secret, base = getUserAgentsDir()) {
@@ -542,8 +496,8 @@ export function setAccountSecret(name, secret, base = getUserAgentsDir()) {
     getAccountProvider(account.provider).validate(account.auth, secret);
     const record = { id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl };
     const { bundle, items } = buildAccountBundle(record, secret);
-    bundle.created_at = readBundle(account.name).created_at; // rotate the secret, keep the bundle's birth time
-    writeBundleWithItems(bundle, items);
+    bundle.created_at = readBundleSync(account.name).created_at; // rotate the secret, keep the bundle's birth time
+    writeBundleWithItemsSync(bundle, items);
 }
 /**
  * `oldSelector` is a bare name, a row id, or `<harness>#<name>`. A native row
@@ -606,7 +560,7 @@ export function renameAccount(oldSelector, newName, base = getUserAgentsDir()) {
         }
         return { ...current, accounts: { ...current.accounts, defaults } };
     });
-    renameBundle(account.name, newName); // moves metadata + secret, preserves ACCOUNT_ID
+    renameBundleSync(account.name, newName); // moves metadata + secret, preserves ACCOUNT_ID
     renameProfileConsumers(account.name, newName, base);
 }
 /** `selector` is a bare name, a row id, or `<harness>#<name>` (see {@link renameAccount}). */
@@ -622,20 +576,23 @@ export function removeAccount(selector, base = getUserAgentsDir()) {
         // Sweep every row for the identity (PHNX-3206) from its owning store (PHNX-3315).
         const rowScope = rows[0].scope;
         updateMeta(current => {
-            // Drop this box's connect-home record for the removed account (PHNX-3940).
+            // Drop this box's connect-home and slot records for the removed account (PHNX-3940).
             const homes = { ...current.deviceAccounts?.homes };
-            for (const id of ids)
+            const slots = { ...current.deviceAccounts?.slots };
+            for (const id of ids) {
                 delete homes[id];
+                delete slots[id];
+            }
             if (rowScope === 'device') {
                 const accounts = { ...current.deviceAccounts?.native };
                 for (const id of ids)
                     delete accounts[id];
-                return { ...current, deviceAccounts: { ...current.deviceAccounts, native: accounts, homes } };
+                return { ...current, deviceAccounts: { ...current.deviceAccounts, native: accounts, homes, slots } };
             }
             const accounts = { ...current.accounts?.native };
             for (const id of ids)
                 delete accounts[id];
-            return { ...current, accounts: { ...current.accounts, native: accounts }, deviceAccounts: { ...current.deviceAccounts, homes } };
+            return { ...current, accounts: { ...current.accounts, native: accounts }, deviceAccounts: { ...current.deviceAccounts, homes, slots } };
         });
         return;
     }
@@ -654,17 +611,17 @@ export function removeAccount(selector, base = getUserAgentsDir()) {
     const consumers = [...new Set([...profileConsumers(account.name, base), ...profileConsumers(account.id, base)])].sort();
     if (consumers.length)
         throw new Error(`Account '${account.name}' is used by harness${consumers.length === 1 ? '' : 'es'}: ${consumers.join(', ')}. Reassign them before removing it.`);
-    deleteKeychainToken(account.secretRef);
-    deleteBundle(account.name);
+    deleteKeychainTokenSync(account.secretRef);
+    deleteBundleSync(account.name);
 }
 export function inspectAccount(name, base = getUserAgentsDir()) {
     const account = findAccount(name, readAccountRegistry(base));
     if (!account)
         throw new Error(`Unknown account '${name}'.`);
-    const bundle = readBundle(account.name);
+    const bundle = readBundleSync(account.name);
     if (bundle.policy !== 'never')
         throw new Error(`Account bundle '${account.name}' must use secrets policy 'never'.`);
-    return { ...account, secretPresent: hasKeychainToken(account.secretRef), policy: bundle.policy };
+    return { ...account, secretPresent: hasKeychainTokenSync(account.secretRef), policy: bundle.policy };
 }
 export function resolveCredentialAccount(name, host, expectedProvider, base = getUserAgentsDir()) {
     const account = findAccount(name, readAccountRegistry(base));
@@ -677,15 +634,15 @@ export function resolveCredentialAccount(name, host, expectedProvider, base = ge
         throw new Error(`Provider '${account.provider}' cannot use a setup-token with the ${host} harness.`);
     }
     const envVar = account.auth === 'setup-token' ? 'CLAUDE_CODE_OAUTH_TOKEN' : adapter.envFor(host, account.auth);
-    if (!hasKeychainToken(account.secretRef))
+    if (!hasKeychainTokenSync(account.secretRef))
         throw new Error(`Credential for account '${account.name}' is missing on this device. Add it with 'agents accounts set-key ${account.name}'.`);
     const secretVar = secretVarFor(account.auth);
     // Account bundles are policy `never`, so their value items carry no biometry
     // ACL. Resolve through the bundle path that verifies that policy and attests
-    // `silentNoAcl` to the headless keychain guard. Calling getKeychainToken()
+    // `silentNoAcl` to the headless keychain guard. Calling getKeychainTokenSync()
     // directly makes a headless --account launch reject the prompt-free item as
     // if it required Touch ID before the helper ever reads it (PHNX-2939).
-    const secret = readAndResolveBundleEnv(account.name, {
+    const secret = readAndResolveBundleEnvSync(account.name, {
         keys: [secretVar],
         keyMode: 'storage',
         agentOnly: true,
@@ -742,8 +699,8 @@ export function resolveSpawnAccount(explicit, agent, version, meta, opts = {}) {
             return null;
         }
         const remedy = selection.source === 'binding'
-            ? `Detach the stale binding with: agents accounts detach ${selection.id} ${target}`
-            : `Add an account named '${selection.id}' or remove the --account override.`;
+            ? `The binding for ${target} points at an account that no longer exists.`
+            : `Add an account named '${selection.id}' with: agents accounts add ${agent} ${selection.id}`;
         throw new Error(`Unknown account '${selection.id}' for ${agent} harness. ${remedy}`);
     }
     if (unified.kind === 'native') {

package/dist/lib/account-schema.d.ts

@@ -1,4 +1,4 @@
-import type { SecretsBundle } from './secrets/bundles.js';
+import type { SecretsBundle } from './secrets-types.js';
 import type { AccountAuthKind } from './account-provider-registry.js';
 /** Canonical bundle variable names for a provider-account bundle. */
 export declare const ACCOUNT_VARS: {

package/dist/lib/account-schema.js

@@ -20,7 +20,7 @@
  * record back out, with no I/O. The registry ([[account-registry]]) owns
  * reads and writes; the catalog ([[account-catalog]]) owns discovery.
  */
-import { parseBundleValue, secretsKeychainItem } from './secrets/index.js';
+import { parseBundleValue, secretsKeychainItem } from './secrets-client.js';
 /** Canonical bundle variable names for a provider-account bundle. */
 export const ACCOUNT_VARS = {
     id: 'ACCOUNT_ID',

package/dist/lib/accounting/account-pool-collect.js

@@ -1,5 +1,5 @@
 import { readAccountRegistry } from '../account-registry.js';
-import { hasKeychainToken } from '../secrets/index.js';
+import { hasKeychainTokenSync, isSecretsTransportError } from '../secrets-client.js';
 import { getGlobalDefault, listInstalledVersions } from '../installations/versions.js';
 import { collectRunCandidates } from './rotate.js';
 import { registryPoolCandidates } from './account-pool.js';
@@ -11,9 +11,21 @@ import { registryPoolCandidates } from './account-pool.js';
  * rotating to a healthy one.
  */
 function localRegistryRecords() {
-    return Object.values(readAccountRegistry().accounts)
-        .filter((a) => hasKeychainToken(a.secretRef))
-        .map((a) => ({ name: a.name, provider: a.provider, auth: a.auth, secretPresent: true }));
+    // Read-only launch input: an unreachable standalone `secrets` (missing binary,
+    // timeout, non-JSON) must not abort the run — it just means no provider
+    // accounts are foldable here, so the run proceeds on the native login rather
+    // than hanging or crashing (PHNX-3989, honoring the ≤3s sync bound). A genuine
+    // non-transport error still throws. DIST-1 holds: no embedded-engine fallback.
+    try {
+        return Object.values(readAccountRegistry().accounts)
+            .filter((a) => hasKeychainTokenSync(a.secretRef))
+            .map((a) => ({ name: a.name, provider: a.provider, auth: a.auth, secretPresent: true }));
+    }
+    catch (err) {
+        if (isSecretsTransportError(err))
+            return [];
+        throw err;
+    }
 }
 /**
  * PURE: fold provider-account candidates into the native version-home list.

package/dist/lib/accounting/rotate.d.ts

@@ -62,6 +62,16 @@ export interface RotateCandidate {
      * authenticates through the existing provider-account injection.
      */
     providerAccount?: string;
+    /**
+     * Native account name when this candidate is a slot (PHNX-3940 T5). The
+     * picker and `--account` / `#name` selector use this; `version` is the
+     * binary (managed install) and is no longer the account identity.
+     */
+    nativeAccount?: string;
+    /** Slot dir when this candidate is a slot — the spawn HOME. */
+    slotDir?: string;
+    /** True when this row came from `deviceAccounts.slots`, not a version home. */
+    fromSlot?: boolean;
 }
 export interface RotateResult {
     /** The version picked for this run. */
@@ -402,16 +412,19 @@ export declare function collectHarnessCandidates(agentIds?: AgentId[]): Promise<
  * (the usual form) or its `accountKey`, and only ever returns a signed-in slot.
  * Returns null when nothing matches, so the caller can fall back and warn.
  */
+export declare function matchAccountCandidate(candidates: RotateCandidate[], account: string, preferredLabel?: string | null): RotateCandidate | null;
 export declare function matchAccountVersion(candidates: RotateCandidate[], account: string, preferredLabel?: string | null): string | null;
 /**
- * Resolve a routine's `account:` pin (login email or account key) to the
- * installed version currently holding that account. Thin I/O wrapper over
- * {@link collectRunCandidates} + {@link matchAccountVersion}; returns null when
- * no signed-in version matches. Pinning a routine to a distinct account is the
- * durable cure for the shared-single-use-refresh-token revocation storm
- * (RUSH-1957): the pinned run never rotates and never lands on another
- * routine's credential.
+ * Resolve a routine's `account:` pin (login email, account key, or native
+ * account name) to the candidate currently holding that account. Thin I/O
+ * wrapper over {@link collectRunCandidates} + {@link matchAccountCandidate};
+ * returns null when no signed-in candidate matches. Pinning a routine to a
+ * distinct account is the durable cure for the shared-single-use-refresh-token
+ * revocation storm (RUSH-1957): the pinned run never rotates and never lands
+ * on another routine's credential. Post-T5 the candidate's `nativeAccount`
+ * (not just `version`) is what disambiguates two slots on one managed install.
  */
+export declare function resolveAccountCandidate(agent: AgentId, account: string, preferredLabel?: string | null): Promise<RotateCandidate | null>;
 export declare function resolveAccountVersion(agent: AgentId, account: string, preferredLabel?: string | null): Promise<string | null>;
 /**
  * Pick a healthy version for `agent` using weighted random by remaining

package/dist/lib/accounting/rotate.js

@@ -10,6 +10,9 @@ import { PROJECTION_HORIZON_MIN, capacityWeight } from './capacity.js';
 import { accountDisplayLabel, getAccountInfo, credentialPresence, ALL_AGENT_IDS, } from '../agents.js';
 import { readMeta, writeMeta, getHelpersDir } from '../state.js';
 import { listInstalledVersions, getVersionHomePath, resolveVersion } from '../installations/versions.js';
+import { resolveManagedInstallation } from '../installations/store.js';
+import { listNativeAccounts } from '../account-registry.js';
+import { readSlots } from '../accounts/slots.js';
 import { getProjectRunConfigs } from '../run-config.js';
 import { emit } from '../feed/events.js';
 import { getUsageInfoByIdentity, getUsageLookupKey, deriveUsageStatusFromSnapshot, } from './usage.js';
@@ -74,7 +77,14 @@ export function setGlobalRunStrategy(agent, strategy) {
  * warning can never disagree: an account is eligible iff its readiness is
  * `ready` — signed in, not server-revoked, and not out of usage.
  */
+/** Slot verdicts balanced/available will launch (PHNX-3940 T5). */
+const LAUNCHABLE_SLOT_VERDICTS = new Set(['live', 'unverified']);
+function isLaunchableSlotVerdict(verdict) {
+    return verdict !== null && LAUNCHABLE_SLOT_VERDICTS.has(verdict);
+}
 function isRotationEligible(candidate) {
+    if (candidate.fromSlot && !isLaunchableSlotVerdict(candidate.authVerdict))
+        return false;
     return readinessFromCandidate(candidate).ready;
 }
 /**
@@ -684,9 +694,65 @@ export async function collectRunCandidates(agent) {
     // LOCAL host — routing decides which local version to launch.
     const authCache = readAuthHealthCache();
     const localHost = machineId();
-    const rows = await Promise.all(versions.map(async (version) => {
+    const meta = readMeta();
+    const binaryLabel = resolveManagedInstallation(agent)?.label ?? versions[0];
+    const slotRows = [];
+    const slotIdentities = new Set();
+    const slotDirs = new Set();
+    if (binaryLabel) {
+        const slots = readSlots(meta);
+        const natives = listNativeAccounts(meta).filter((row) => row.agent === agent);
+        const probed = await Promise.all(natives.map(async (account) => {
+            const slot = slots[account.id];
+            if (!slot || !fs.existsSync(slot.slotDir))
+                return null;
+            const home = slot.slotDir;
+            const info = await getAccountInfo(agent, home);
+            const launchable = isLaunchableSignedIn(info.signedIn, credentialPresence(agent, home));
+            const slotOk = isLaunchableSlotVerdict(slot.verdict);
+            return {
+                agent,
+                version: binaryLabel,
+                home,
+                info,
+                accountKey: launchable ? info.accountKey : null,
+                accountLabel: account.name || (launchable ? accountDisplayLabel(info) : ''),
+                email: launchable ? info.email : null,
+                usageStatus: launchable ? info.usageStatus : null,
+                plan: launchable ? info.plan : null,
+                signedIn: launchable && slotOk,
+                authVerdict: slot.verdict,
+                authCheckedAt: (() => {
+                    const ts = slot.checkedAt ? Date.parse(slot.checkedAt) : NaN;
+                    return Number.isFinite(ts) ? ts : null;
+                })(),
+                lastActive: info.lastActive,
+                nativeAccount: account.name,
+                slotDir: home,
+                fromSlot: true,
+            };
+        }));
+        for (const row of probed) {
+            if (!row)
+                continue;
+            slotRows.push(row);
+            slotDirs.add(path.resolve(row.home));
+            if (row.info.accountKey)
+                slotIdentities.add(row.info.accountKey);
+            if (row.email)
+                slotIdentities.add(row.email.toLowerCase());
+        }
+    }
+    // Legacy per-account installations (`acct-*` homes) until T7 migrates them.
+    const versionRows = await Promise.all(versions.map(async (version) => {
         const home = getVersionHomePath(agent, version);
+        if (slotDirs.has(path.resolve(home)))
+            return null;
         const info = await getAccountInfo(agent, home);
+        if (info.accountKey && slotIdentities.has(info.accountKey))
+            return null;
+        if (info.email && slotIdentities.has(info.email.toLowerCase()))
+            return null;
         // We used to additionally call isClaudeAuthValid(home), which reads
         // "Claude Code-credentials-<hash>" from the system keychain. That item is
         // written by Claude Code itself with its own process in the ACL, so our
@@ -717,6 +783,7 @@ export async function collectRunCandidates(agent) {
             lastActive: info.lastActive,
         };
     }));
+    const rows = [...slotRows, ...versionRows.filter((row) => row !== null)];
     // These candidates feed a routing decision on the `agents run` hot path, so
     // this read is CACHE-ONLY (`readOnly`): it never blocks on a live provider
     // fetch. A snapshot older than USAGE_DECISION_MAX_AGE_MS is not trusted for
@@ -775,26 +842,35 @@ export async function collectHarnessCandidates(agentIds = ALL_AGENT_IDS) {
  * (the usual form) or its `accountKey`, and only ever returns a signed-in slot.
  * Returns null when nothing matches, so the caller can fall back and warn.
  */
-export function matchAccountVersion(candidates, account, preferredLabel) {
+export function matchAccountCandidate(candidates, account, preferredLabel) {
     const needle = account.trim().toLowerCase();
     if (!needle)
         return null;
     const matching = candidates.filter((c) => c.signedIn &&
-        (c.email?.toLowerCase() === needle || c.accountKey?.toLowerCase() === needle));
-    return matching.find(candidate => candidate.version === preferredLabel)?.version ?? matching[0]?.version ?? null;
+        (c.email?.toLowerCase() === needle
+            || c.accountKey?.toLowerCase() === needle
+            || c.nativeAccount?.toLowerCase() === needle));
+    return matching.find(candidate => candidate.version === preferredLabel) ?? matching[0] ?? null;
+}
+export function matchAccountVersion(candidates, account, preferredLabel) {
+    return matchAccountCandidate(candidates, account, preferredLabel)?.version ?? null;
 }
 /**
- * Resolve a routine's `account:` pin (login email or account key) to the
- * installed version currently holding that account. Thin I/O wrapper over
- * {@link collectRunCandidates} + {@link matchAccountVersion}; returns null when
- * no signed-in version matches. Pinning a routine to a distinct account is the
- * durable cure for the shared-single-use-refresh-token revocation storm
- * (RUSH-1957): the pinned run never rotates and never lands on another
- * routine's credential.
+ * Resolve a routine's `account:` pin (login email, account key, or native
+ * account name) to the candidate currently holding that account. Thin I/O
+ * wrapper over {@link collectRunCandidates} + {@link matchAccountCandidate};
+ * returns null when no signed-in candidate matches. Pinning a routine to a
+ * distinct account is the durable cure for the shared-single-use-refresh-token
+ * revocation storm (RUSH-1957): the pinned run never rotates and never lands
+ * on another routine's credential. Post-T5 the candidate's `nativeAccount`
+ * (not just `version`) is what disambiguates two slots on one managed install.
  */
-export async function resolveAccountVersion(agent, account, preferredLabel) {
+export async function resolveAccountCandidate(agent, account, preferredLabel) {
     const candidates = await collectRunCandidates(agent);
-    return matchAccountVersion(candidates, account, preferredLabel);
+    return matchAccountCandidate(candidates, account, preferredLabel);
+}
+export async function resolveAccountVersion(agent, account, preferredLabel) {
+    return (await resolveAccountCandidate(agent, account, preferredLabel))?.version ?? null;
 }
 /**
  * Pick a healthy version for `agent` using weighted random by remaining

package/dist/lib/accounting/usage.js

@@ -19,7 +19,7 @@ import { promisify } from 'util';
 import chalk from 'chalk';
 import { decodeJwtPayload, decryptDroidAuthPayload } from '../agents.js';
 import { walkForFiles } from '../fs-walk.js';
-import { getKeychainToken, setKeychainToken, deleteKeychainToken, isKeychainBackendOverridden, } from '../secrets/index.js';
+import { deleteKeychainToken, deleteKeychainTokenSync, getKeychainTokenSync, setKeychainToken, } from '../secrets-client.js';
 import { resolveClaudeSetupToken } from '../claude-account-token.js';
 import { formatBackoffRemaining, noteUsageRateLimited, usageRateLimitedUntil, } from '../usage-backoff.js';
 import { getCacheDir } from '../state.js';
@@ -1547,7 +1547,7 @@ function claudeOauthCacheItem(service) {
  */
 function deleteCachedClaudeOauth(service) {
     try {
-        deleteKeychainToken(claudeOauthCacheItem(service));
+        deleteKeychainTokenSync(claudeOauthCacheItem(service));
     }
     catch {
         /* best-effort — cache is an optimization */
@@ -1627,13 +1627,11 @@ export async function loadClaudeOauth(home, opts) {
     // dispatch does not (SING-1b / RUSH-2359). The OS keychain/keyring step is
     // macOS/Linux-only; Windows and any
     // fileOnly caller skip to the .credentials.json read below (the Claude CLI
-    // stores its OAuth token in that file too). An injected test backend makes the
-    // keychain path exercisable anywhere, so the platform check yields to it.
-    if (!opts?.fileOnly
-        && (process.platform === 'darwin' || process.platform === 'linux' || isKeychainBackendOverridden())) {
+    // stores its OAuth token in that file too).
+    if (!opts?.fileOnly && (process.platform === 'darwin' || process.platform === 'linux')) {
         const service = getClaudeKeychainService(home);
         try {
-            const fromKeychain = parseClaudeOauthPayload(getKeychainToken(service));
+            const fromKeychain = parseClaudeOauthPayload(getKeychainTokenSync(service));
             if (fromKeychain)
                 return fromKeychain;
         }
@@ -1658,12 +1656,9 @@ export async function loadClaudeOauth(home, opts) {
  * Exported for regression tests; not part of the public command surface.
  */
 export async function saveClaudeOauth(home, credentials) {
-    // Windows not yet supported. An injected test backend is the exception, for
-    // the same reason as the loadClaudeOauth guard above: it makes the keychain
-    // path exercisable anywhere, and without it this returns before the rotated
-    // credential is written OR a stale no-ACL cache item an earlier version wrote
-    // is evicted (deleteCachedClaudeOauth) — leaving that stale item behind.
-    if (process.platform !== 'darwin' && process.platform !== 'linux' && !isKeychainBackendOverridden()) {
+    // Windows not yet supported: Claude Code keeps its credential in the file
+    // there, so the rotated credential is written by the harness, not here.
+    if (process.platform !== 'darwin' && process.platform !== 'linux') {
         return false;
     }
     try {
@@ -1671,7 +1666,7 @@ export async function saveClaudeOauth(home, credentials) {
         // Read existing payload to preserve other fields
         let existingPayload = {};
         try {
-            const stdout = getKeychainToken(service);
+            const stdout = getKeychainTokenSync(service);
             existingPayload = JSON.parse(stdout.trim());
         }
         catch {
@@ -1691,12 +1686,12 @@ export async function saveClaudeOauth(home, credentials) {
         const payloadJson = JSON.stringify(newPayload);
         // Delete existing entry first, then add updated entry
         try {
-            deleteKeychainToken(service);
+            await deleteKeychainToken(service);
         }
         catch {
             // Entry might not exist, ignore
         }
-        setKeychainToken(service, payloadJson);
+        await setKeychainToken(service, payloadJson);
         // A new credential rotation means any cached access token is stale.
         deleteCachedClaudeOauth(service);
         return true;