@prohost/cli 0.12.1 → 0.12.2

package/CHANGELOG.md

@@ -4,6 +4,74 @@ Versions follow [semver](https://semver.org/). Publishing is automated: merging
 a version bump to `main` triggers `.github/workflows/npm-publish-cli.yml`, which
 builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
+## 0.12.2
+
+- **Two agents on one computer no longer delete each other's account.** Every
+  agent home on a computer shares one account registry, and ProhostAI keeps
+  exactly the accounts a status frame lists. A running `agent run` re-read that
+  list only every 15 minutes, so when a second agent started on a login of its
+  own (a Codex agent beside a Claude Code one), the first kept sending a list
+  without it and the server deleted it on every frame. For up to 15 minutes
+  the second agent showed as "Not on a listed account", on and off.
+- The list is now checked against the registry for every frame. A routine
+  frame, and the first frame after a reconnect, re-reads it when it has
+  changed, so an added account is listed and a removed one is gone within 5
+  minutes instead of 15. Only an account new to the list is asked whether it
+  is signed in; one whose CLI can't answer is listed as `unknown`. The check
+  of every login stays on its 15-minute cadence.
+- A frame sent between routine ones (a run ended on another model, capacity
+  crossed a band) leaves the list out when the registry has changed since it
+  was read, and so does one sent after a re-read that failed. A frame without
+  a list deletes nothing; the next routine frame carries it.
+- **A registry that can't be read is no longer reported as "no accounts".**
+  A registry file that is unreadable, cut short or not a registry used to
+  read as empty, and a status frame built from it listed no accounts, which
+  had ProhostAI delete every account on the computer. Now the frame keeps the
+  account it last knew and leaves the list out until the file reads again;
+  the first frame after start names no account at all. A registry with no
+  file yet is still an empty one.
+- **An account this version can't read is no longer deleted for it.** A
+  registry entry that is damaged, or that names a runtime or billing this
+  version doesn't know (one a newer CLI on the same computer wrote), used to
+  be skipped, and the list sent without it had ProhostAI delete that account.
+  While such an entry is in the registry the agent sends no list. It still
+  names the account it runs on, checks its sign-in and follows a switch, and
+  every other command sees the accounts it can read, as before. After the
+  entry is gone the list returns within 15 minutes.
+- **And it is no longer erased from the registry either.** Every write to the
+  registry (the default login being recorded on first use, `account add`,
+  `account remove`, a login `usage` discovers) used to write back only the
+  accounts this version understands, so one write erased a newer CLI's
+  account from the computer for good. Now a write changes only the entry it
+  is about: entries this version can't read, top-level fields it doesn't
+  know and a `version` that isn't its own are written back as they were, in
+  place. A registry this version wrote is written exactly as before.
+- **One login keeps one identity beside a newer CLI's record of it.** Where
+  an entry this version can't read already stands for the same login (the
+  same runtime and label, or the same runtime and directory), nothing is
+  recorded beside it:
+  - the agent's `default` account takes that entry's key when ProhostAI
+    would accept it and the entry is the agent CLI's own login, and no second
+    default is made. Only the key is taken: the billing reported is what the
+    login itself says, or `subscription`. With no key to use, the agent names
+    no account, says why once in its log, and still runs;
+  - `account add <label>` is refused when such an entry uses the label, with
+    a message to update the CLI, and `usage` discovery skips a login such an
+    entry already holds;
+  - an entry whose runtime or label isn't text claims no login.
+- **One account the server would refuse no longer costs the whole status
+  frame.** ProhostAI drops a status frame if any account in it has a key that
+  is not a UUID or a label that is empty, longer than 64 characters or not
+  storable text, and the agent's own account and capacity are lost with it.
+  Accounts made by this CLI always pass; a hand-edited registry may not.
+  While the registry holds such an account, or says it is at a version other
+  than 1, the agent sends no list, and it never names an account that would
+  be refused. Runs still go out on that account.
+- An agent still running 0.12.1 or older keeps sending its old list for up to
+  15 minutes after another agent's account appears, and any write it makes to
+  the registry still erases the entries it can't read. Upgrade and restart
+  every agent on the computer, not only the newest one.
+
 ## 0.12.1
 
 - **An account the 0.10.1-row upload un-reports waits for its next report.**

package/dist/agent/account_runtime.d.ts

@@ -6,7 +6,7 @@
  * `--account`, or in ProhostAI through `agent.config_updated`) takes effect on
  * the next run without restarting or reinstalling the daemon.
  */
-import type { AccountRecord, AccountRuntime, CommandRunner, ConfigUpdateOutcome } from './accounts.js';
+import type { AccountBlock, AccountRecord, AccountRuntime, CommandRunner, ConfigUpdateOutcome } from './accounts.js';
 import type { AccountsSnapshot } from './runtime_status.js';
 export type AccountResolution = {
     ok: true;
@@ -35,6 +35,9 @@ export declare class HarnessAccount {
     private readonly inFlight;
     /** `requested_at` of the newest pick applied, so a late older one is dropped. */
     private appliedRequestedAt;
+    private readonly warn;
+    /** The last thing {@link warn} was told, so each reason is said once. */
+    private warned;
     constructor(options: {
         runtime: AccountRuntime;
         /** Environment that locates `$PROHOST_HOME` and the accounts root. */
@@ -43,6 +46,8 @@ export declare class HarnessAccount {
         /** Agent CLI binary used for sign-in checks. */
         binary?: string;
         run?: CommandRunner;
+        /** Told, once per reason, why this agent's account is not named to ProhostAI. */
+        warn?: (message: string) => void;
     });
     /** The label this agent home names now. */
     label(): string;
@@ -84,8 +89,26 @@ export declare class HarnessAccount {
      * credit that run's capacity to an account it isn't using. With several runs
      * executing it is the oldest one's: the pick is not fulfilled until the last
      * run on the previous account has ended.
+     *
+     * `known` are accounts whose sign-in state was checked recently enough to
+     * keep: they are not asked again, so a list that gained or lost an account
+     * costs one check at most, not one per account.
+     *
+     * Rejects when the registry can't be read. There is no snapshot of a
+     * registry nobody could read: "no accounts" would have the server delete
+     * every account on this machine. Checked before anything is resolved, since
+     * resolving the default account against an unreadable registry writes a new
+     * one over it.
+     */
+    snapshot(busy?: boolean, known?: AccountBlock[]): Promise<AccountsSnapshot>;
+    private warnOnce;
+    /**
+     * Keys of every account in the machine's registry right now, or `undefined`
+     * when it can't be read or holds an entry this build doesn't understand —
+     * either way these would not be known to be all of them. A file read; no
+     * login is asked.
      */
-    snapshot(busy?: boolean): Promise<AccountsSnapshot>;
+    keys(): string[] | undefined;
     /** The command that signs the current account in, for a log line. */
     signInHint(): string | undefined;
 }

package/dist/agent/account_runtime.js

@@ -6,7 +6,7 @@
  * `--account`, or in ProhostAI through `agent.config_updated`) takes effect on
  * the next run without restarting or reinstalling the daemon.
  */
-import { DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, accountBlock, accountEnv, applyAccountKey, checkAuth, loadAccounts, resolveAgentAccount, runtimeName, signInCommand, } from './accounts.js';
+import { AccountError, DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, accountBlock, accountEnv, applyAccountKey, checkAuth, fitsStatusFrame, readRegistry, resolveAgentAccount, runtimeName, signInCommand, } from './accounts.js';
 import { tryLoadCredentials } from './credentials.js';
 export class HarnessAccount {
     runtime;
@@ -28,12 +28,16 @@ export class HarnessAccount {
     inFlight = [];
     /** `requested_at` of the newest pick applied, so a late older one is dropped. */
     appliedRequestedAt;
+    warn;
+    /** The last thing {@link warn} was told, so each reason is said once. */
+    warned;
     constructor(options) {
         this.runtime = options.runtime;
         this.env = { ...process.env, ...options.env };
         this.binary = options.binary;
         this.run = options.run;
         this.initialLabel = options.initialLabel;
+        this.warn = options.warn;
     }
     /** The label this agent home names now. */
     label() {
@@ -119,18 +123,35 @@ export class HarnessAccount {
      * credit that run's capacity to an account it isn't using. With several runs
      * executing it is the oldest one's: the pick is not fulfilled until the last
      * run on the previous account has ended.
+     *
+     * `known` are accounts whose sign-in state was checked recently enough to
+     * keep: they are not asked again, so a list that gained or lost an account
+     * costs one check at most, not one per account.
+     *
+     * Rejects when the registry can't be read. There is no snapshot of a
+     * registry nobody could read: "no accounts" would have the server delete
+     * every account on this machine. Checked before anything is resolved, since
+     * resolving the default account against an unreadable registry writes a new
+     * one over it.
      */
-    async snapshot(busy = false) {
+    async snapshot(busy = false, known = []) {
+        const registry = readRegistry(this.env);
+        if (!registry)
+            throw new AccountError('The account registry on this machine could not be read.');
+        const records = registry.accounts;
         const label = busy ? (this.inFlight[0] ?? this.spawnedLabel ?? this.label()) : this.label();
         const record = resolveAgentAccount(label, this.runtime, this.env);
         const resolved = record ? { ok: true, record } : { ok: false, error: '' };
-        const records = loadAccounts(this.env);
         // The current account first, so a machine with more than the cap still
         // reports the one this agent is on.
         const ordered = resolved.ok
             ? [resolved.record, ...records.filter((r) => r.key !== resolved.record.key)]
             : records;
+        const checked = new Map(known.map((block) => [block.key, block]));
         const all = await Promise.all(ordered.slice(0, MAX_REPORTED_ACCOUNTS).map(async (record) => {
+            const kept = checked.get(record.key);
+            if (kept)
+                return accountBlock(record, kept.auth_state, kept.billing);
             // Only the login of this runtime's CLI is checked with this binary;
             // another runtime's accounts are checked with that CLI's default name.
             const check = await checkAuth(record, {
@@ -139,10 +160,45 @@ export class HarnessAccount {
             });
             return accountBlock(record, check.state, check.billing);
         }));
-        const current = resolved.ok ? all.find((a) => a.key === resolved.record.key) : undefined;
-        // More accounts than a frame carries (a hand-edited registry): send none
-        // rather than a partial list the server would prune to.
-        return { current, all: ordered.length > MAX_REPORTED_ACCOUNTS ? undefined : all };
+        // The server drops a whole frame over one account it refuses, so the
+        // account in use is named only when it would be taken. Runs still go out
+        // on it either way.
+        const named = resolved.ok && fitsStatusFrame(resolved.record);
+        const current = named ? all.find((a) => a.key === resolved.record.key) : undefined;
+        if (resolved.ok && !named) {
+            const { label: unnamed, runtime } = resolved.record;
+            // Not among the accounts this build reads: the default, held in an
+            // entry it can't read that has no key to report it under.
+            const unread = !records.some((r) => r.label === unnamed && r.runtime === runtime);
+            this.warnOnce(`this agent's ${runtimeName(runtime)} account "${unnamed}" is not named to ProhostAI: ` +
+                (unread
+                    ? "the account registry holds it in an entry this version of the CLI can't read, with no key to " +
+                        'report it under. Runs still use it. Update @prohost/cli.'
+                    : 'its entry in the account registry has a key or label ProhostAI would not accept. Runs still use it.'));
+        }
+        // More accounts than a frame carries (a hand-edited registry), an entry
+        // this build can't read (a newer CLI's account) or one the server would
+        // refuse: send none rather than a partial list the server would prune to,
+        // or a list that costs the whole frame. The account in use is still
+        // known, so it is still named, checked and followed through a switch.
+        const whole = registry.whole && ordered.length <= MAX_REPORTED_ACCOUNTS;
+        return { current, all: whole ? all : undefined };
+    }
+    warnOnce(message) {
+        if (message === this.warned)
+            return;
+        this.warned = message;
+        this.warn?.(message);
+    }
+    /**
+     * Keys of every account in the machine's registry right now, or `undefined`
+     * when it can't be read or holds an entry this build doesn't understand —
+     * either way these would not be known to be all of them. A file read; no
+     * login is asked.
+     */
+    keys() {
+        const registry = readRegistry(this.env);
+        return registry?.whole ? registry.accounts.map((record) => record.key) : undefined;
     }
     /** The command that signs the current account in, for a log line. */
     signInHint() {

package/dist/agent/accounts.d.ts

@@ -58,7 +58,42 @@ export declare function isValidLabel(label: string): boolean;
 export declare function parseAccountRuntime(value: string | undefined): AccountRuntime | undefined;
 /** Machine-wide root shared by every agent home. */
 export declare function accountsRoot(env?: NodeJS.ProcessEnv): string;
-/** Every account on this machine. An unreadable registry is an empty one. */
+/** What the registry file holds, as far as this build can tell. */
+export interface RegistryRead {
+    /** The accounts this build understands. */
+    accounts: AccountRecord[];
+    /**
+     * Whether `accounts` is every account on the machine, each one fit to send.
+     * `false` when an entry was left out — damaged, or written by a newer CLI
+     * with a runtime or billing this build doesn't know — when the file is not
+     * at {@link REGISTRY_VERSION}, or when an account fails
+     * {@link fitsStatusFrame}. The accounts are real and runs still go out on
+     * them, but they are not a list anyone should act on.
+     */
+    whole: boolean;
+}
+/**
+ * Whether the server would take this account in a status frame: a UUID key,
+ * and a label of 1 to {@link MAX_FRAME_LABEL_CHARS} characters it can store.
+ * The server drops a whole frame over one field it refuses — the account in
+ * use and its capacity with it — so an account that fails this is never put
+ * in one. Accounts made here always pass; a hand-edited registry, or one
+ * another tool wrote, may not.
+ */
+export declare function fitsStatusFrame(record: AccountRecord): boolean;
+/**
+ * The registry, or `undefined` when the file is there but can't be read or
+ * isn't a registry — which says nothing about the accounts on this machine,
+ * least of all that there are none. For a caller whose answer someone else
+ * acts on: the server deletes the accounts a status frame leaves out, so that
+ * caller must know when the list is missing or short. No file yet is an empty
+ * registry.
+ */
+export declare function readRegistry(env?: NodeJS.ProcessEnv): RegistryRead | undefined;
+/**
+ * Every account on this machine that this build understands. An unreadable
+ * registry is an empty one, and an entry it can't read is skipped.
+ */
 export declare function loadAccounts(env?: NodeJS.ProcessEnv): AccountRecord[];
 /**
  * This computer's id: a random UUID made once and kept in the machine-wide
@@ -70,9 +105,16 @@ export declare function loadAccounts(env?: NodeJS.ProcessEnv): AccountRecord[];
  */
 export declare function machineId(env?: NodeJS.ProcessEnv): string | undefined;
 export declare function findAccount(label: string, runtime: AccountRuntime, env?: NodeJS.ProcessEnv): AccountRecord | undefined;
+/** {@link unreadEntryFor} against the registry as it is now, for a caller about to register a login. */
+export declare function heldByUnreadableEntry(runtime: AccountRuntime, claim: {
+    label?: string;
+    dir?: string;
+}, env?: NodeJS.ProcessEnv): boolean;
 /**
  * The implicit default account for a runtime, created on first use so it has
- * a stable key the server can recognise across restarts.
+ * a stable key the server can recognise across restarts. Where the registry
+ * already holds it in an entry this build can't read, that one is used (see
+ * {@link borrowedDefault}) and none is created.
  */
 export declare function ensureDefaultAccount(runtime: AccountRuntime, env?: NodeJS.ProcessEnv): AccountRecord;
 /** Create an account and its config directory. Signing in is the operator's next step. */

package/dist/agent/accounts.js

@@ -25,7 +25,7 @@
  */
 import { execFile } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { loadCredentials, saveCredentials } from './credentials.js';
@@ -37,6 +37,8 @@ export const DEFAULT_ACCOUNT_LABEL = 'default';
 export const MAX_REPORTED_ACCOUNTS = 16;
 /** How long one `auth status` / `login status` probe may take. */
 const AUTH_PROBE_TIMEOUT_MS = 10_000;
+/** The registry layout this build writes, and the only one it vouches for. */
+const REGISTRY_VERSION = 1;
 /** Labels are filenames and UI text: short, and nothing a shell or a path could misread. */
 const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/;
 export class AccountError extends Error {
@@ -59,25 +61,84 @@ export function accountsRoot(env = process.env) {
 function registryPath(env) {
     return path.join(accountsRoot(env), 'accounts.json');
 }
-/** Every account on this machine. An unreadable registry is an empty one. */
-export function loadAccounts(env = process.env) {
+/** `undefined` when the file is there but can't be read or isn't a registry. No file yet is an empty one. */
+function readRawRegistry(env) {
+    let content;
+    try {
+        content = readFileSync(registryPath(env), 'utf8');
+    }
+    catch (err) {
+        return err.code === 'ENOENT'
+            ? { fields: { version: REGISTRY_VERSION }, entries: [] }
+            : undefined;
+    }
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(registryPath(env), 'utf8'));
+        parsed = JSON.parse(content);
     }
     catch {
-        return [];
+        return undefined;
     }
-    const list = parsed?.accounts;
-    if (!Array.isArray(list))
-        return [];
-    return list.filter((a) => !!a &&
+    const entries = parsed?.accounts;
+    if (!Array.isArray(entries))
+        return undefined;
+    return { fields: parsed, entries };
+}
+/** An entry this build understands: every field present, with a value it knows. */
+function isAccountRecord(entry) {
+    const a = entry;
+    return (!!a &&
         typeof a.key === 'string' &&
         typeof a.label === 'string' &&
         (a.runtime === 'claude_code' || a.runtime === 'codex') &&
         (a.billing === 'subscription' || a.billing === 'api_key') &&
         (a.dir === null || typeof a.dir === 'string'));
 }
+/** Longest label the server takes in a status frame, in characters. */
+const MAX_FRAME_LABEL_CHARS = 64;
+/** A NUL or half a surrogate pair: text the server's database cannot store. */
+const UNSTORABLE = /[\0\p{Cs}]/u;
+/**
+ * Whether the server would take this account in a status frame: a UUID key,
+ * and a label of 1 to {@link MAX_FRAME_LABEL_CHARS} characters it can store.
+ * The server drops a whole frame over one field it refuses — the account in
+ * use and its capacity with it — so an account that fails this is never put
+ * in one. Accounts made here always pass; a hand-edited registry, or one
+ * another tool wrote, may not.
+ */
+export function fitsStatusFrame(record) {
+    if (!UUID_RE.test(record.key) || UNSTORABLE.test(record.label))
+        return false;
+    const length = [...record.label].length;
+    return length >= 1 && length <= MAX_FRAME_LABEL_CHARS;
+}
+/**
+ * The registry, or `undefined` when the file is there but can't be read or
+ * isn't a registry — which says nothing about the accounts on this machine,
+ * least of all that there are none. For a caller whose answer someone else
+ * acts on: the server deletes the accounts a status frame leaves out, so that
+ * caller must know when the list is missing or short. No file yet is an empty
+ * registry.
+ */
+export function readRegistry(env = process.env) {
+    const raw = readRawRegistry(env);
+    if (!raw)
+        return undefined;
+    const accounts = raw.entries.filter(isAccountRecord);
+    return {
+        accounts,
+        whole: raw.fields.version === REGISTRY_VERSION &&
+            accounts.length === raw.entries.length &&
+            accounts.every(fitsStatusFrame),
+    };
+}
+/**
+ * Every account on this machine that this build understands. An unreadable
+ * registry is an empty one, and an entry it can't read is skipped.
+ */
+export function loadAccounts(env = process.env) {
+    return readRegistry(env)?.accounts ?? [];
+}
 /**
  * Run ``fn`` holding the registry lock, so two processes adding accounts (or
  * two agents creating their implicit default at once) can't each write an
@@ -122,7 +183,23 @@ function withRegistryLock(env, fn) {
 }
 const REGISTRY_LOCK_WAIT_MS = 5_000;
 const REGISTRY_LOCK_STALE_MS = 30_000;
-function saveAccounts(accounts, env) {
+/**
+ * Rewrite the registry with `change` applied to its entries — the one place
+ * the file is written. Call it holding the registry lock.
+ *
+ * Every agent home and every CLI version on the machine shares this file, so
+ * what this build doesn't understand is written back as it was read: entries
+ * that fail the shape check (damaged, or a newer CLI's account on a runtime
+ * this build has never heard of), top-level fields other than `accounts`, and
+ * a `version` that isn't ours. Writing only what {@link loadAccounts} returns
+ * would erase another CLI's account from the machine for good. `change` sees
+ * those entries too and must leave them be.
+ *
+ * A file that can't be read or parsed at all is an empty registry here, as it
+ * is for {@link loadAccounts}, and is replaced.
+ */
+function rewriteRegistry(env, change) {
+    const raw = readRawRegistry(env) ?? { fields: {}, entries: [] };
     const root = accountsRoot(env);
     mkdirSync(root, { recursive: true, mode: 0o700 });
     chmodSync(root, 0o700);
@@ -130,11 +207,14 @@ function saveAccounts(accounts, env) {
     // Write-then-rename: two agents creating the implicit default at once must
     // not leave a half-written registry for the next reader.
     const temp = `${file}.${process.pid}.tmp`;
-    writeFileSync(temp, `${JSON.stringify({ version: 1, accounts }, null, 2)}\n`, {
-        mode: 0o600,
-    });
+    const registry = { version: REGISTRY_VERSION, ...raw.fields, accounts: change(raw.entries) };
+    writeFileSync(temp, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
     renameSync(temp, file);
 }
+/** Add one account to the registry, after everything already in it. Call it holding the lock. */
+function appendAccount(record, env) {
+    rewriteRegistry(env, (entries) => [...entries, record]);
+}
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function readMachineId(env) {
     try {
@@ -177,17 +257,96 @@ export function machineId(env = process.env) {
 export function findAccount(label, runtime, env = process.env) {
     return loadAccounts(env).find((a) => a.label === label && a.runtime === runtime);
 }
+/** Whether two paths are one directory, through symlinks where both exist. */
+function sameDirectory(a, b) {
+    if (path.resolve(a) === path.resolve(b))
+        return true;
+    try {
+        return realpathSync(a) === realpathSync(b);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The entry this build can't read that says it is this account: the same
+ * runtime and the same label, or the same runtime and the same directory.
+ *
+ * Such an entry is a login this build knows how to run, recorded by a CLI
+ * that knows something this one doesn't (a billing value, say) — or a damaged
+ * record of one. Recording the login again beside it would give one login two
+ * identities, here and on the server. An entry whose `runtime` or `label`
+ * isn't even text says nothing about which account it is and claims none.
+ */
+function unreadEntryFor(entries, runtime, claim) {
+    for (const entry of entries) {
+        if (isAccountRecord(entry) || !entry || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        if (e.runtime !== runtime || typeof e.label !== 'string')
+            continue;
+        if (e.label === claim.label)
+            return e;
+        if (claim.dir !== undefined && typeof e.dir === 'string' && sameDirectory(e.dir, claim.dir))
+            return e;
+    }
+    return undefined;
+}
+/** {@link unreadEntryFor} against the registry as it is now, for a caller about to register a login. */
+export function heldByUnreadableEntry(runtime, claim, env = process.env) {
+    return unreadEntryFor(readRawRegistry(env)?.entries ?? [], runtime, claim) !== undefined;
+}
+function heldByUnreadableEntryError(what) {
+    return new AccountError(`The account registry already has ${what} in an entry this version of the CLI can't read — ` +
+        'most likely one a newer version wrote. Update @prohost/cli and try again.');
+}
+/**
+ * The default account where an entry this build can't read already stands for
+ * it. One login gets one identity, so no second default is recorded beside
+ * the entry and nothing is written.
+ *
+ * Only the key is taken from the entry, and only when the server would take
+ * it and the entry is the login this build means by "default": the agent
+ * CLI's own directory (`dir: null`). Its billing is not taken — this build
+ * can't tell what it means. Otherwise the key is empty: the account has no
+ * identity here, {@link fitsStatusFrame} keeps it out of every status frame,
+ * and runs still go out on the CLI's own login.
+ */
+function borrowedDefault(entry, runtime) {
+    const record = {
+        key: typeof entry.key === 'string' ? entry.key : '',
+        label: DEFAULT_ACCOUNT_LABEL,
+        runtime,
+        billing: 'subscription',
+        dir: null,
+        created_at: '',
+    };
+    return entry.dir === null && fitsStatusFrame(record) ? record : { ...record, key: '' };
+}
+/** This runtime's default account as the registry holds it: read, borrowed, or not there yet. */
+function defaultAccount(runtime, env) {
+    const entries = readRawRegistry(env)?.entries ?? [];
+    const known = entries
+        .filter(isAccountRecord)
+        .find((a) => a.label === DEFAULT_ACCOUNT_LABEL && a.runtime === runtime);
+    if (known)
+        return known;
+    const unread = unreadEntryFor(entries, runtime, { label: DEFAULT_ACCOUNT_LABEL });
+    return unread && borrowedDefault(unread, runtime);
+}
 /**
  * The implicit default account for a runtime, created on first use so it has
- * a stable key the server can recognise across restarts.
+ * a stable key the server can recognise across restarts. Where the registry
+ * already holds it in an entry this build can't read, that one is used (see
+ * {@link borrowedDefault}) and none is created.
  */
 export function ensureDefaultAccount(runtime, env = process.env) {
-    const existing = findAccount(DEFAULT_ACCOUNT_LABEL, runtime, env);
+    const existing = defaultAccount(runtime, env);
     if (existing)
         return existing;
     return withRegistryLock(env, () => {
         // Re-read under the lock: another agent may have just created it.
-        const again = findAccount(DEFAULT_ACCOUNT_LABEL, runtime, env);
+        const again = defaultAccount(runtime, env);
         if (again)
             return again;
         const record = {
@@ -198,7 +357,7 @@ export function ensureDefaultAccount(runtime, env = process.env) {
             dir: null,
             created_at: new Date().toISOString(),
         };
-        saveAccounts([...loadAccounts(env), record], env);
+        appendAccount(record, env);
         return record;
     });
 }
@@ -217,6 +376,9 @@ function addAccountLocked(label, runtime, billing, env) {
     if (findAccount(label, runtime, env)) {
         throw new AccountError(`A ${runtimeName(runtime)} account named "${label}" already exists on this machine.`);
     }
+    if (heldByUnreadableEntry(runtime, { label }, env)) {
+        throw heldByUnreadableEntryError(`a ${runtimeName(runtime)} account named "${label}"`);
+    }
     // The server keeps exactly the accounts a machine reports, and a frame
     // carries at most MAX_REPORTED_ACCOUNTS (room left for both defaults).
     if (loadAccounts(env).filter((a) => a.label !== DEFAULT_ACCOUNT_LABEL).length >= MAX_REPORTED_ACCOUNTS - 2) {
@@ -233,7 +395,7 @@ function addAccountLocked(label, runtime, billing, env) {
         dir,
         created_at: new Date().toISOString(),
     };
-    saveAccounts([...loadAccounts(env), record], env);
+    appendAccount(record, env);
     return record;
 }
 /**
@@ -253,9 +415,15 @@ export function registerAccountDir(options, env = process.env) {
         const same = accounts.find((a) => a.runtime === runtime && a.dir !== null && path.resolve(a.dir) === dir);
         if (same)
             return same;
+        if (heldByUnreadableEntry(runtime, { dir }, env)) {
+            throw heldByUnreadableEntryError(`a ${runtimeName(runtime)} account for ${dir}`);
+        }
         if (findAccount(label, runtime, env)) {
             throw new AccountError(`A ${runtimeName(runtime)} account named "${label}" already exists on this machine.`);
         }
+        if (heldByUnreadableEntry(runtime, { label }, env)) {
+            throw heldByUnreadableEntryError(`a ${runtimeName(runtime)} account named "${label}"`);
+        }
         if (accounts.filter((a) => a.label !== DEFAULT_ACCOUNT_LABEL).length >= MAX_REPORTED_ACCOUNTS - 2) {
             throw new AccountError(`This machine already has ${MAX_REPORTED_ACCOUNTS - 2} accounts, the most ProhostAI can show. Remove one first.`);
         }
@@ -267,7 +435,7 @@ export function registerAccountDir(options, env = process.env) {
             dir,
             created_at: new Date().toISOString(),
         };
-        saveAccounts([...accounts, record], env);
+        appendAccount(record, env);
         return record;
     });
 }
@@ -290,7 +458,12 @@ export function removeAccount(label, runtime, env = process.env) {
         const found = accounts.find((a) => a.label === label && a.runtime === runtime);
         if (!found)
             throw new AccountError(`No ${runtimeName(runtime)} account named "${label}" on this machine.`);
-        saveAccounts(accounts.filter((a) => a !== found), env);
+        rewriteRegistry(env, (entries) => {
+            // Only the entry asked for: the first one this build reads as that
+            // account, which is the one `found` came from.
+            const index = entries.findIndex((e) => isAccountRecord(e) && e.label === label && e.runtime === runtime);
+            return entries.filter((_, i) => i !== index);
+        });
         return found;
     });
     // Only ever a directory this module created under the root.
@@ -421,7 +594,10 @@ export function resolveAgentAccount(label, runtime, env = process.env) {
 export function applyAccountKey(key, runtime, env = process.env) {
     if (typeof key !== 'string' || !key)
         return { applied: false, reason: 'no account_key in the update' };
-    const record = loadAccounts(env).find((a) => a.key === key);
+    // The default this agent reports under a key borrowed from an entry this
+    // build can't read is one an operator can pick, like any other it reports.
+    const borrowed = defaultAccount(runtime, env);
+    const record = loadAccounts(env).find((a) => a.key === key) ?? (borrowed?.key === key ? borrowed : undefined);
     if (!record)
         return { applied: false, reason: `account ${key.slice(0, 8)}… is not on this machine` };
     if (record.runtime !== runtime) {

package/dist/agent/run.js

@@ -293,6 +293,7 @@ function buildRuntime(options, log) {
         initialLabel: options.credentials.account,
         binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
         run: options.accountCommandRunner,
+        warn: (message) => log(`${timestamp()} ! ${message}`),
     });
     const mcpUrl = options.credentials.mcp_url;
     let announced = '';
@@ -1098,8 +1099,9 @@ export async function runAgentHarness(options) {
             ? defaultQuotaProvider(runtime.brain, options.exec, () => runtime.account?.spawnEnv() ?? {})
             : (options.quotaProvider ?? undefined),
         accounts: runtime.account
-            ? () => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing))
+            ? (known) => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing), known)
             : undefined,
+        accountKeys: runtime.account ? () => runtime.account.keys() : undefined,
         // A run in flight reports fresh numbers when it ends; don't probe beside it.
         isBusy: () => [...accepted.values()].some((entry) => entry.executing),
         log,

package/dist/agent/runtime_status.d.ts

@@ -190,8 +190,20 @@ export interface RuntimeStatusReporterOptions {
      * Accounts on this machine and which one this agent uses. Re-read on the
      * same cadence as the idle quota probe (it asks each login whether it is
      * signed in), and straight away after {@link RuntimeStatusReporter.accountsChanged}.
+     * Also re-read on the first tick after {@link accountKeys} shows the list
+     * moved, with `known`: the accounts whose sign-in state is recent enough to
+     * keep, so only the ones new to the list are asked.
      */
-    accounts?: () => Promise<AccountsSnapshot | undefined>;
+    accounts?: (known?: AccountBlock[]) => Promise<AccountsSnapshot | undefined>;
+    /**
+     * Keys of every account on this machine right now — one local file read,
+     * done for every frame. Every agent home on the machine shares the registry
+     * and the server deletes whatever a frame's list leaves out, so a list from
+     * before another home added its account would delete the account that home
+     * runs on. `undefined` when the registry can't be read, or not all of it:
+     * no list is sent until it can.
+     */
+    accountKeys?: () => string[] | undefined;
     /** A run is executing — it will bring fresh numbers, so don't probe beside it. */
     isBusy?: () => boolean;
     now?: () => number;
@@ -222,6 +234,7 @@ export declare class RuntimeStatusReporter {
     private refreshing;
     private accountGeneration;
     private accounts;
+    /** When every login was last asked whether it is signed in. */
     private accountsObservedAt;
     constructor(options: RuntimeStatusReporterOptions);
     /** Merge what a source learned. Absent fields keep their previous value. */
@@ -247,6 +260,13 @@ export declare class RuntimeStatusReporter {
     detach(): void;
     /** The frame as it would be sent now. */
     frame(): Record<string, unknown>;
+    /**
+     * Whether the machine's registry no longer holds exactly the accounts the
+     * snapshot lists: another agent home started on a login of its own, or an
+     * operator added or removed one. A registry that can't be read counts as
+     * moved — it vouches for no list at all.
+     */
+    private accountsMoved;
     /** Routine tick: refresh idle quota if it is stale, send, and re-arm. */
     private tick;
     private refresh;

package/dist/agent/runtime_status.js

@@ -499,6 +499,7 @@ export class RuntimeStatusReporter {
     refreshing;
     accountGeneration = 0;
     accounts;
+    /** When every login was last asked whether it is signed in. */
     accountsObservedAt;
     constructor(options) {
         this.options = options;
@@ -537,7 +538,6 @@ export class RuntimeStatusReporter {
     setAccounts(snapshot, options = {}) {
         const before = this.accounts;
         this.accounts = snapshot;
-        this.accountsObservedAt = this.now();
         const switched = before?.current?.key !== snapshot?.current?.key;
         if (switched) {
             this.accountGeneration += 1;
@@ -597,9 +597,34 @@ export class RuntimeStatusReporter {
             observed_at: new Date(nowMs).toISOString(),
             // Optional additions: an older server ignores keys it doesn't know.
             ...(this.accounts?.current ? { account: this.accounts.current } : {}),
-            ...(this.accounts?.all ? { machine_accounts: this.accounts.all } : {}),
+            // Never a list the registry has moved on from — the server would delete
+            // what it leaves out. Left out, nothing is deleted; the next tick re-reads it.
+            ...(this.accounts?.all && !this.accountsMoved() ? { machine_accounts: this.accounts.all } : {}),
         };
     }
+    /**
+     * Whether the machine's registry no longer holds exactly the accounts the
+     * snapshot lists: another agent home started on a login of its own, or an
+     * operator added or removed one. A registry that can't be read counts as
+     * moved — it vouches for no list at all.
+     */
+    accountsMoved() {
+        const listed = this.accounts?.all;
+        if (!listed || !this.options.accountKeys)
+            return false;
+        let registry;
+        try {
+            registry = this.options.accountKeys();
+        }
+        catch {
+            registry = undefined;
+        }
+        if (!registry)
+            return true;
+        const keys = new Set(registry);
+        const known = new Set(listed.map((account) => account.key));
+        return keys.size !== known.size || [...keys].some((key) => !known.has(key));
+    }
     /** Routine tick: refresh idle quota if it is stale, send, and re-arm. */
     async tick() {
         if (!this.send)
@@ -607,11 +632,16 @@ export class RuntimeStatusReporter {
         const stale = this.quotaObservedAt === undefined || this.now() - this.quotaObservedAt >= QUOTA_REFRESH_AFTER_MS;
         const sentBefore = this.lastSentAt;
         const accountsStale = this.accountsObservedAt === undefined || this.now() - this.accountsObservedAt >= QUOTA_REFRESH_AFTER_MS;
-        if (accountsStale && this.options.accounts) {
+        if ((accountsStale || this.accountsMoved()) && this.options.accounts) {
             // Before the quota probe: after a switch it must ask the new login.
             try {
                 // Quiet: the tick sends one frame once the quota probe below is in.
-                this.setAccounts(await this.options.accounts(), { quiet: true });
+                // A list that only moved keeps the sign-in states it has, and the
+                // check every login is due stays on its own clock.
+                const known = accountsStale ? undefined : this.accounts?.all;
+                this.setAccounts(await this.options.accounts(known), { quiet: true });
+                if (accountsStale)
+                    this.accountsObservedAt = this.now();
             }
             catch {
                 /* fail soft — keep what we had */

package/dist/usage/discovery.js

@@ -16,7 +16,7 @@
 import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { AccountError, DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, ensureDefaultAccount, isValidLabel, loadAccounts, registerAccountDir, } from '../agent/accounts.js';
+import { AccountError, DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, ensureDefaultAccount, heldByUnreadableEntry, isValidLabel, loadAccounts, registerAccountDir, } from '../agent/accounts.js';
 /** Entries whose presence says "this is a Claude Code config directory". None of them hold a login. */
 const CLAUDE_MARKERS = ['projects', 'settings.json', '.claude.json', 'history.jsonl', 'todos', 'statsig', 'shell-snapshots'];
 /** Same for Codex. `auth.json` is deliberately not one of them. */
@@ -153,6 +153,16 @@ export function discoverAccounts(options = {}, env = process.env) {
             result.known.push({ ...found, label: existing.label, record: existing });
             continue;
         }
+        // Already recorded, by a CLI that knows something this one doesn't:
+        // registering it again would give one login two identities.
+        const claim = found.isDefault ? { label: DEFAULT_ACCOUNT_LABEL } : { dir: found.dir };
+        if (heldByUnreadableEntry(found.runtime, claim, env)) {
+            result.skipped.push({
+                ...found,
+                reason: "already in the account registry, in an entry this version of the CLI can't read (update @prohost/cli)",
+            });
+            continue;
+        }
         if (found.isDefault) {
             if (options.dryRun)
                 result.added.push(found);

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.12.1";
+export declare const CLI_VERSION = "0.12.2";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.12.1";
+export declare const USER_AGENT = "prohost-cli/0.12.2";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.12.1';
+export const CLI_VERSION = '0.12.2';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",