@sentropic/llm-mesh 0.24.1 → 0.26.0

package/dist/service/local-account-transport-service.d.ts

@@ -13,18 +13,26 @@ export declare class LocalAccountTransportService {
     private readonly accountsMap;
     private readonly credentialVersions;
     private readonly refreshInFlight;
+    private readonly publicWrites;
     private readonly accountRemovalBarrierRefs;
     private readonly claimedOwnerScopes;
     /** enrollmentId → providerId, so poll completion reaches the owning provider. */
     private readonly enrollmentProviders;
+    private readonly pendingClaudeAccounts;
+    private claudePersistenceTail;
+    private readonly claudeSessions;
     private routeAttemptSequence;
     constructor(keyring: KeyringAdapter, providers: Map<string, EnrollmentProvider>, configResolver: ConfigResolver, legacyAccountOwnerScopeRef?: string | undefined);
     enroll(providerId: string, input: StartEnrollmentInput): Promise<EnrollmentSession>;
+    completeClaudeEnrollment(enrollmentId: string, code: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
+    completeClaudeCredentialImport(credentialJson: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
     waitForCallback(enrollmentId: string): Promise<EnrollmentCompletion>;
     pollForCompletion(enrollmentId: string): Promise<EnrollmentCompletion>;
     completeMuseImport(enrollmentId: string, code: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
     completeMuseDirectImport(apiKey: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
     completeMuseDeviceImport(enrollmentId: string, ownerScopeRef: string, maxAttempts?: number): Promise<EnrollmentCompletion>;
+    private hasClaudeGrant;
+    private persistClaudeCompletion;
     cancel(enrollmentId: string): Promise<void>;
     listAccounts(ownerScope: string): Promise<readonly AccountPublic[]>;
     removeAccount(accountId: string, ownerScope: string): Promise<{
@@ -36,12 +44,22 @@ export declare class LocalAccountTransportService {
     release(acquisition: AccountTransportAcquisition): Promise<void>;
     createRouteDirectory(runtime: Pick<LlmMesh, 'generate' | 'stream'>): AccountDirectoryPort;
     private listRouteDiagnostics;
+    private isCredentialExpired;
+    /**
+     * True when the account cannot recover on its own: its status already
+     * flipped to reauth_required (a refresh failed), or its ACCESS token is
+     * expired with no refresh token to renew it. A merely expired access
+     * token with a live refresh token stays ready — acquire() refreshes it
+     * before dispatch.
+     */
+    private requiresReauth;
     private listRouteAccounts;
     private routeAttempt;
     private diagnosticAccountRef;
     private completeEnrollment;
     private refreshToken;
     private persistCredential;
+    private writePublicRecord;
     private persistAccountState;
     private parseAccountIndex;
     private requireOwnerScope;

package/dist/service/local-account-transport-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-account-transport-service.d.ts","sourceRoot":"","sources":["../../src/service/local-account-transport-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,aAAa,EAGb,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EAGjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAuDjC,qBAAa,4BAA4B;IAarC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAf9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkD;IAClF,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,OAAO,CAAC,oBAAoB,CAAK;gBAGd,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC1C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,CAAC,oBAAQ;IAMhD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAUnF,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiEpE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6DtE,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAyD1B,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IA8D1B,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,SAAK,GACf,OAAO,CAAC,oBAAoB,CAAC;IAoE1B,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;IAyBnE,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqChD,eAAe,CACb,OAAO,EAAE,uBAAuB,EAChC,aAAa,SAAW,EACxB,iBAAiB,CAAC,EAAE,MAAM,GACzB,IAAI;IAYD,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA6FlF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,GAAG,oBAAoB;YAsB3E,oBAAoB;YA0BpB,iBAAiB;IA8B/B,OAAO,CAAC,YAAY;IAgDpB,OAAO,CAAC,oBAAoB;YAOd,kBAAkB;YAIlB,YAAY;YA0BZ,iBAAiB;YAgDjB,mBAAmB;IA2BjC,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,aAAa;YAIP,cAAc;YAiBd,iBAAiB;YAgBjB,uBAAuB;YAgBvB,oBAAoB;YAkBpB,gBAAgB;YAMhB,qBAAqB;YAOrB,6BAA6B;YAK7B,2BAA2B;IAqBzC,OAAO,CAAC,oBAAoB;YAMd,yBAAyB;YAYzB,gBAAgB;YAmBhB,wBAAwB;YA2ExB,kBAAkB;CAOjC"}
+{"version":3,"file":"local-account-transport-service.d.ts","sourceRoot":"","sources":["../../src/service/local-account-transport-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,aAAa,EAGb,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EAGjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AA+DjC,qBAAa,4BAA4B;IAiBrC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAnB9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkD;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,qBAAqB,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAC7E,OAAO,CAAC,oBAAoB,CAAK;gBAGd,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC1C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,CAAC,oBAAQ;IAMhD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmBnF,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAC/D,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyBjD,8BAA8B,CAAC,cAAc,EAAE,MAAM,EACzD,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcjD,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiEpE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6DtE,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAyD1B,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IA8D1B,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,SAAK,GACf,OAAO,CAAC,oBAAoB,CAAC;YAoElB,cAAc;YAoBd,uBAAuB;IAsD/B,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3C,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;IA0BnE,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqChD,eAAe,CACb,OAAO,EAAE,uBAAuB,EAChC,aAAa,SAAW,EACxB,iBAAiB,CAAC,EAAE,MAAM,GACzB,IAAI;IAYD,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAgElF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,GAAG,oBAAoB;YAsB3E,oBAAoB;IAoDlC,OAAO,CAAC,mBAAmB;IAM3B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;YAOR,iBAAiB;IAgC/B,OAAO,CAAC,YAAY;IAgDpB,OAAO,CAAC,oBAAoB;YAOd,kBAAkB;YAIlB,YAAY;YA6EZ,iBAAiB;YA6CjB,iBAAiB;YAajB,mBAAmB;IA8BjC,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,aAAa;YAIP,cAAc;YAiBd,iBAAiB;YAgBjB,uBAAuB;YAgBvB,oBAAoB;YAkBpB,gBAAgB;YAMhB,qBAAqB;YAOrB,6BAA6B;YAK7B,2BAA2B;IAqBzC,OAAO,CAAC,oBAAoB;YAMd,yBAAyB;YAYzB,gBAAgB;YAmBhB,wBAAwB;YAwExB,kBAAkB;CAOjC"}

package/dist/service/local-account-transport-service.js

@@ -1,5 +1,6 @@
 import { AccountTransportAcquireError, InMemoryAccountTransportCoordinator, } from '../account-transports.js';
 import { MUSE_DIRECT_BILLING_TYPE } from '../enrollment/muse.js';
+import { ClaudeRefreshPreparationError } from '../enrollment/claude-code.js';
 import { listModelProfilesByProvider } from '../catalog.js';
 // Cloud Code does not currently return a per-account model inventory during
 // enrollment. Advertise only the model proven executable by the live transport
@@ -9,6 +10,7 @@ const VERIFIED_CLOUD_CODE_MODEL_IDS = [
     'claude-opus-4-6-thinking',
     'gemini-3.7-flash',
     'gemini-3.8-flash',
+    'gemini-4-argon',
     'gemini-3.1-pro',
 ];
 const supportedModelIdsForAccount = (account) => {
@@ -37,10 +39,14 @@ export class LocalAccountTransportService {
     accountsMap = new Map();
     credentialVersions = new Map();
     refreshInFlight = new Map();
+    publicWrites = new Map();
     accountRemovalBarrierRefs = new Map();
     claimedOwnerScopes = new Map();
     /** enrollmentId → providerId, so poll completion reaches the owning provider. */
     enrollmentProviders = new Map();
+    pendingClaudeAccounts = new Set();
+    claudePersistenceTail = Promise.resolve();
+    claudeSessions = new Map();
     routeAttemptSequence = 0;
     constructor(keyring, providers, configResolver, legacyAccountOwnerScopeRef) {
         this.keyring = keyring;
@@ -55,10 +61,55 @@ export class LocalAccountTransportService {
         if (!provider) {
             throw new Error(`Enrollment provider '${providerId}' not registered`);
         }
-        const session = await provider.start(input);
-        this.enrollmentProviders.set(session.enrollmentId, providerId);
+        if (providerId !== 'claude-code') {
+            const session = await provider.start(input);
+            this.enrollmentProviders.set(session.enrollmentId, providerId);
+            return session;
+        }
+        const ownerScope = this.requireOwnerScope(input.ownerScope);
+        const session = await provider.start({ ...input, ownerScope });
+        const expiresAt = Date.parse(session.expiresAt);
+        const timer = setTimeout(() => { void this.cancel(session.enrollmentId); }, Math.max(0, expiresAt - Date.now()));
+        timer.unref?.();
+        this.claudeSessions.set(session.enrollmentId, { ownerScope, expiresAt, completing: false, timer });
         return session;
     }
+    async completeClaudeEnrollment(enrollmentId, code, ownerScopeRef) {
+        const owner = this.requireOwnerScope(ownerScopeRef);
+        const session = this.claudeSessions.get(enrollmentId);
+        const provider = this.providers.get('claude-code');
+        if (!provider || !session || session.ownerScope !== owner || session.completing) {
+            throw new Error('Claude enrollment session unavailable for owner');
+        }
+        session.completing = true;
+        const assertCurrent = () => {
+            if (this.claudeSessions.get(enrollmentId) !== session || Date.now() >= session.expiresAt) {
+                throw new Error('Claude enrollment cancelled or expired');
+            }
+        };
+        try {
+            assertCurrent();
+            const credential = await provider.complete({ enrollmentId, code });
+            assertCurrent();
+            return await this.persistClaudeCompletion(credential, owner, provider, assertCurrent);
+        }
+        finally {
+            clearTimeout(session.timer);
+            this.claudeSessions.delete(enrollmentId);
+            await provider.cancel?.(enrollmentId);
+        }
+    }
+    async completeClaudeCredentialImport(credentialJson, ownerScopeRef) {
+        const owner = this.requireOwnerScope(ownerScopeRef);
+        const provider = this.providers.get('claude-code');
+        // Capability stays Claude-local; the common provider contract remains unchanged.
+        if (!provider || !('importCredential' in provider) || typeof provider.importCredential !== 'function') {
+            throw new Error('Claude credential import unavailable');
+        }
+        const importer = provider;
+        const credential = await importer.importCredential(credentialJson);
+        return this.persistClaudeCompletion(credential, owner, provider, () => { });
+    }
     async waitForCallback(enrollmentId) {
         const provider = this.providers.get('cloud-code');
         if (!provider?.waitForCallback) {
@@ -311,7 +362,91 @@ export class LocalAccountTransportService {
         }, account);
         return { accountId: credential.accountId, label };
     }
+    async hasClaudeGrant(credential, ownerScopeRef) {
+        const index = await this.keyring.getSecret(LocalAccountTransportService.accountIndexKey);
+        for (const accountId of this.parseAccountIndex(index)) {
+            const record = await this.readPublicRecord(accountId);
+            if (!record || record.account.transportProviderId !== 'claude-code'
+                || record.account.ownerScopeRef !== ownerScopeRef || await this.isPublicRecordRemoved(record)
+                || !(await this.isPublicRecordOwnerClaimValid(record)))
+                continue;
+            const raw = await this.keyring.getSecret(`sentropic-llm-mesh:${accountId}:envelope`);
+            if (!raw)
+                continue;
+            try {
+                const stored = JSON.parse(raw);
+                // Compare only in process; never produce a token fingerprint or diagnostic.
+                if (stored.accountId === accountId && stored.refreshToken === credential.refreshToken)
+                    return true;
+            }
+            catch {
+                // Ignore corrupt entries, as restore does; never log stored contents.
+            }
+        }
+        return false;
+    }
+    async persistClaudeCompletion(credential, ownerScopeRef, provider, assertCurrent) {
+        // Serialize Claude enrollment index updates; no account is executable during the writes.
+        const previous = this.claudePersistenceTail;
+        let unlock;
+        this.claudePersistenceTail = new Promise((resolve) => { unlock = resolve; });
+        await previous;
+        const id = credential.accountId;
+        let claimed = false;
+        let duplicate = false;
+        try {
+            assertCurrent();
+            duplicate = await this.hasClaudeGrant(credential, ownerScopeRef);
+            if (duplicate)
+                throw new Error('Duplicate Claude grant');
+            const metadata = await provider.resolve(credential);
+            const barrier = await this.removalBarrierForEnrollment(id, ownerScopeRef);
+            claimed = true;
+            if (barrier)
+                this.accountRemovalBarrierRefs.set(id, barrier);
+            this.pendingClaudeAccounts.add(id);
+            const now = new Date().toISOString();
+            const label = `Claude (${id})`;
+            const account = { accountId: id, ownerScopeRef, accountLabel: label,
+                targetProviderId: 'anthropic', transportProviderId: 'claude-code', status: 'active',
+                accessToken: credential.accessToken, refreshToken: credential.refreshToken,
+                expiresAt: credential.expiresAt, enrollmentCompletedAt: now, metadata };
+            assertCurrent();
+            await this.persistCredential({ accountId: id, accountLabel: label, providerId: 'claude-code',
+                status: 'active', createdAt: now, updatedAt: now }, credential, account);
+            assertCurrent();
+            await this.assertAccountOwnerClaim(id, ownerScopeRef);
+            if (await this.isAccountRemoved(id))
+                throw new Error('Account removed');
+            assertCurrent();
+            this.registerAccount(account, credential.authClientConfigVersion, barrier);
+            return { accountId: id, label };
+        }
+        catch {
+            if (claimed) {
+                // Keep the immutable owner claim and fence any partial writes on restart.
+                await this.keyring.setSecret(this.removalKey(id), JSON.stringify({ v: 1,
+                    accountId: id, ownerScopeRef, removedAt: this.nextRemovalTimestamp() })).catch(() => { });
+                await this.keyring.deleteSecret(`sentropic-llm-mesh:${id}:public`).catch(() => { });
+                await this.keyring.deleteSecret(`sentropic-llm-mesh:${id}:envelope`).catch(() => { });
+                this.coordinator.removeAccount(id);
+                this.accountsMap.delete(id);
+                this.credentialVersions.delete(id);
+                this.accountRemovalBarrierRefs.delete(id);
+            }
+            throw new Error(duplicate ? 'This Claude credential is already enrolled'
+                : 'Claude enrollment could not be saved; reauthenticate');
+        }
+        finally {
+            this.pendingClaudeAccounts.delete(id);
+            unlock();
+        }
+    }
     async cancel(enrollmentId) {
+        const session = this.claudeSessions.get(enrollmentId);
+        if (session)
+            clearTimeout(session.timer);
+        this.claudeSessions.delete(enrollmentId);
         for (const provider of this.providers.values()) {
             if (provider.cancel) {
                 await provider.cancel(enrollmentId);
@@ -324,6 +459,8 @@ export class LocalAccountTransportService {
         const rawIndex = await this.keyring.getSecret(LocalAccountTransportService.accountIndexKey);
         const accounts = [];
         for (const accountId of this.parseAccountIndex(rawIndex)) {
+            if (this.pendingClaudeAccounts.has(accountId))
+                continue;
             const record = await this.readPublicRecord(accountId);
             if (!record
                 || record.account.ownerScopeRef !== scope
@@ -408,7 +545,7 @@ export class LocalAccountTransportService {
         // Check if access token is expired
         if (account && account.expiresAt) {
             const expiresAtMs = new Date(account.expiresAt).getTime();
-            if (expiresAtMs <= nowMs) {
+            if (expiresAtMs <= nowMs || this.refreshInFlight.has(account.accountId)) {
                 try {
                     const version = this.credentialVersions.get(account.accountId) ?? 'v1.0.0';
                     const refreshed = await this.refreshToken({
@@ -416,30 +553,6 @@ export class LocalAccountTransportService {
                         refreshToken: account.refreshToken ?? undefined,
                         credentialVersion: version,
                     });
-                    if (await this.isAccountRemoved(account.accountId)) {
-                        await acquisition.release?.();
-                        throw new AccountTransportAcquireError(`Account ${account.accountId} has been removed`, 'no_active_account');
-                    }
-                    // Atomic persistence of updated credentials
-                    account.accessToken = refreshed.accessToken;
-                    if (refreshed.refreshToken) {
-                        account.refreshToken = refreshed.refreshToken;
-                    }
-                    account.expiresAt = refreshed.expiresAt;
-                    await this.persistCredential({
-                        accountId: account.accountId,
-                        accountLabel: account.accountLabel ?? undefined,
-                        providerId: account.transportProviderId,
-                        status: 'active',
-                        createdAt: new Date().toISOString(),
-                        updatedAt: new Date().toISOString(),
-                    }, {
-                        accountId: account.accountId,
-                        accessToken: refreshed.accessToken,
-                        refreshToken: account.refreshToken ?? undefined,
-                        expiresAt: refreshed.expiresAt,
-                        authClientConfigVersion: refreshed.authClientConfigVersion,
-                    }, account);
                     // Update material with refreshed token
                     acquisition.material.accessToken = refreshed.accessToken;
                     if (refreshed.refreshToken) {
@@ -447,11 +560,17 @@ export class LocalAccountTransportService {
                     }
                     acquisition.material.expiresAt = refreshed.expiresAt;
                 }
-                catch (refreshErr) {
-                    await this.markReauthRequired(account.accountId);
-                    throw new AccountTransportAcquireError(`Account ${account.accountId} token refresh failed: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`, 'no_active_account');
+                catch (error) {
+                    await acquisition.release?.();
+                    if (error instanceof AccountTransportAcquireError)
+                        throw error;
+                    throw new AccountTransportAcquireError(`Account ${account.accountId} token refresh failed; reauthentication required`, 'no_active_account');
                 }
             }
+            // Acquisition may have snapshotted the old token before another caller published.
+            acquisition.material.accessToken = account.accessToken ?? undefined;
+            acquisition.material.refreshToken = account.refreshToken ?? undefined;
+            acquisition.material.expiresAt = account.expiresAt ?? undefined;
         }
         return acquisition;
     }
@@ -486,21 +605,65 @@ export class LocalAccountTransportService {
             diagnostics.push({
                 code: 'reenrollment-required',
                 transportProviderId: 'codex',
-                message: 'Codex enrollment must be renewed for owner-scoped routing',
+                // Lot 7: the repair action rides in the message so a 503 body can
+                // tell the operator exactly what to do.
+                message: 'Codex enrollment must be renewed for owner-scoped routing;'
+                    + ' re-enroll the codex account to restore routing',
             });
         }
         for (const account of this.accountsMap.values()) {
-            if (account.ownerScopeRef !== subject.ownerScopeRef || account.status !== 'reauth_required') {
+            // A credential is reauth-required when its status has already flipped
+            // (a refresh failed) or when it is expired with no refresh token to
+            // mint a fresh access token silently — otherwise expiry dies silently
+            // as no-eligible-account.
+            if (account.ownerScopeRef !== subject.ownerScopeRef
+                || !this.requiresReauth(account)) {
                 continue;
             }
+            const transport = account.transportProviderId;
+            // The stored expiry is owner data, never a validated date, and this
+            // message is client-facing. The expired-at wording applies only when
+            // the expiry predicate holds (a past instant) — a revoked-but-
+            // unexpired credential keeps the generic renewal wording. The emitted
+            // timestamp is the canonical ISO instant, never the raw stored string
+            // (which may carry non-canonical annotations).
+            const rawExpiry = account.expiresAt;
+            const parsedExpiry = typeof rawExpiry === 'string' && rawExpiry
+                ? Date.parse(rawExpiry)
+                : Number.NaN;
+            const expiredAt = Number.isFinite(parsedExpiry) && parsedExpiry <= Date.now()
+                ? new Date(parsedExpiry).toISOString()
+                : undefined;
             diagnostics.push({
                 code: 'reauth-required',
-                transportProviderId: account.transportProviderId,
-                message: `${account.transportProviderId} authentication must be renewed`,
+                transportProviderId: transport,
+                message: expiredAt
+                    ? `${transport} credential expired at ${expiredAt};`
+                        + ` reauthenticate the ${transport} account to restore routing`
+                    : `${transport} authentication must be renewed;`
+                        + ` reauthenticate the ${transport} account to restore routing`,
             });
         }
         return diagnostics;
     }
+    isCredentialExpired(account) {
+        if (!account.expiresAt)
+            return false;
+        const expiresAtMs = Date.parse(account.expiresAt);
+        return Number.isFinite(expiresAtMs) && expiresAtMs <= Date.now();
+    }
+    /**
+     * True when the account cannot recover on its own: its status already
+     * flipped to reauth_required (a refresh failed), or its ACCESS token is
+     * expired with no refresh token to renew it. A merely expired access
+     * token with a live refresh token stays ready — acquire() refreshes it
+     * before dispatch.
+     */
+    requiresReauth(account) {
+        if (account.status === 'reauth_required')
+            return true;
+        return this.isCredentialExpired(account) && !account.refreshToken;
+    }
     async listRouteAccounts(subject) {
         await this.restorePersistedAccounts();
         const recovered = this.coordinator.refreshLifecycle();
@@ -517,11 +680,13 @@ export class LocalAccountTransportService {
             transportProviderId: account.transportProviderId,
             supportedModelIds: supportedModelIdsForAccount(account),
             enrollmentCompletedAt: account.enrollmentCompletedAt ?? '1970-01-01T00:00:00.000Z',
-            readiness: account.status === 'active' || account.status === undefined
-                ? 'ready'
-                : account.status === 'reauth_required'
-                    ? 'reauth-required'
-                    : account.status,
+            readiness: this.requiresReauth(account)
+                ? 'reauth-required'
+                : account.status === 'active' || account.status === undefined
+                    ? 'ready'
+                    : account.status === 'reauth_required'
+                        ? 'reauth-required'
+                        : account.status,
             revision: [
                 this.credentialVersions.get(account.accountId) ?? 'v1.0.0',
                 account.expiresAt ?? '', account.status ?? 'active', account.enrollmentCompletedAt ?? '',
@@ -590,14 +755,70 @@ export class LocalAccountTransportService {
             return this.refreshInFlight.get(input.accountId);
         }
         const refreshPromise = (async () => {
+            const account = this.accountsMap.get(input.accountId);
+            let requestMayHaveBeenSent = false;
             try {
-                const account = this.accountsMap.get(input.accountId);
                 const providerId = account?.transportProviderId ?? 'cloud-code';
                 const provider = this.providers.get(providerId);
                 if (!provider) {
                     throw new Error(`No provider registered for refresh: ${providerId}`);
                 }
-                return await provider.refresh(input);
+                if (account?.status === 'reauth_required')
+                    throw new Error('Reauthentication required');
+                // Fence persisted grants before a potentially rotating request. A crash or
+                // storage outage afterwards must not make a restart replay the old token.
+                const record = await this.readPublicRecord(input.accountId);
+                if (record) {
+                    await this.assertAccountOwnerClaim(input.accountId, account?.ownerScopeRef);
+                    if (await this.isAccountRemoved(input.accountId))
+                        throw new Error('Account removed');
+                    await this.writePublicRecord(input.accountId, JSON.stringify({
+                        ...record, status: 'reauth_required', account: { ...record.account, status: 'reauth_required' },
+                    }));
+                }
+                requestMayHaveBeenSent = true;
+                const refreshInput = providerId === 'claude-code'
+                    ? { ...input, grantedScopes: account?.metadata?.scopes } : input;
+                const refreshed = await provider.refresh(refreshInput);
+                if (!account || refreshed.accountId !== input.accountId
+                    || !refreshed.accessToken?.trim() || /[\r\n]/.test(refreshed.accessToken)
+                    || !Number.isFinite(Date.parse(refreshed.expiresAt))
+                    || Date.parse(refreshed.expiresAt) <= Date.now()
+                    || (providerId === 'claude-code' && refreshed.authClientConfigVersion !== input.credentialVersion)
+                    || (refreshed.refreshToken !== undefined && (!refreshed.refreshToken.trim()
+                        || /[\r\n]/.test(refreshed.refreshToken))))
+                    throw new Error('Invalid refresh grant');
+                const updated = { ...account, accessToken: refreshed.accessToken,
+                    refreshToken: refreshed.refreshToken ?? account.refreshToken, expiresAt: refreshed.expiresAt };
+                if (providerId === 'claude-code') {
+                    const metadata = await provider.resolve(refreshed);
+                    updated.metadata = { ...account.metadata, ...metadata,
+                        enrollmentMethod: account.metadata?.enrollmentMethod };
+                }
+                const now = new Date().toISOString();
+                await this.persistCredential({ accountId: account.accountId,
+                    accountLabel: account.accountLabel ?? undefined, providerId, status: 'active',
+                    createdAt: account.enrollmentCompletedAt ?? now, updatedAt: now }, { ...refreshed, refreshToken: updated.refreshToken ?? undefined }, updated);
+                if (await this.isAccountRemoved(input.accountId))
+                    throw new Error('Account removed');
+                Object.assign(account, updated);
+                this.credentialVersions.set(input.accountId, refreshed.authClientConfigVersion);
+                return { ...refreshed, refreshToken: updated.refreshToken ?? undefined };
+            }
+            catch (error) {
+                if ((account && !this.accountsMap.has(input.accountId))
+                    || await this.isAccountRemoved(input.accountId).catch(() => false)) {
+                    throw new AccountTransportAcquireError(`Account ${input.accountId} has been removed`, 'no_active_account');
+                }
+                if ((!requestMayHaveBeenSent || error instanceof ClaudeRefreshPreparationError)
+                    && account?.status !== 'reauth_required') {
+                    // A fence write can commit and then throw, but no provider request occurred.
+                    if (account)
+                        await this.persistAccountState(account, true).catch(() => { });
+                    throw new AccountTransportAcquireError('Token refresh preparation failed; retry later', 'no_active_account');
+                }
+                await this.markReauthRequired(input.accountId).catch(() => { });
+                throw new AccountTransportAcquireError('Token refresh failed; reauthentication required', 'no_active_account');
             }
             finally {
                 this.refreshInFlight.delete(input.accountId);
@@ -621,7 +842,7 @@ export class LocalAccountTransportService {
         await this.assertAccountOwnerClaim(pub.accountId, account.ownerScopeRef);
         await this.keyring.setSecret(`sentropic-llm-mesh:${pub.accountId}:envelope`, JSON.stringify(env));
         await this.assertAccountOwnerClaim(pub.accountId, account.ownerScopeRef);
-        await this.keyring.setSecret(`sentropic-llm-mesh:${pub.accountId}:public`, JSON.stringify(publicRecord));
+        await this.writePublicRecord(pub.accountId, JSON.stringify(publicRecord));
         if (await this.isAccountRemoved(pub.accountId)) {
             await this.cleanupRemovedPersistence(pub.accountId, removalBarrierRef);
             throw new Error(`Account '${pub.accountId}' has been removed`);
@@ -638,7 +859,20 @@ export class LocalAccountTransportService {
             throw new Error(`Account '${pub.accountId}' has been removed`);
         }
     }
-    async persistAccountState(account) {
+    async writePublicRecord(accountId, value) {
+        // A fence must land after every earlier route write, even one already in the keyring.
+        const previous = this.publicWrites.get(accountId) ?? Promise.resolve();
+        const pending = previous.catch(() => { }).then(() => this.keyring.setSecret(`sentropic-llm-mesh:${accountId}:public`, value));
+        this.publicWrites.set(accountId, pending);
+        try {
+            await pending;
+        }
+        finally {
+            if (this.publicWrites.get(accountId) === pending)
+                this.publicWrites.delete(accountId);
+        }
+    }
+    async persistAccountState(account, restoreBeforeRequest = false) {
         await this.assertAccountOwnerClaim(account.accountId, account.ownerScopeRef);
         if (await this.isAccountRemoved(account.accountId))
             return;
@@ -653,7 +887,11 @@ export class LocalAccountTransportService {
             const { accessToken: _accessToken, refreshToken: _refreshToken, expiresAt: _expiresAt, ...persistedAccount } = account;
             if (await this.isAccountRemoved(account.accountId))
                 return;
-            await this.keyring.setSecret(key, JSON.stringify({
+            // Route outcomes must not clear the durable no-replay fence during rotation.
+            if (!restoreBeforeRequest && this.refreshInFlight.has(account.accountId)
+                && account.status !== 'reauth_required')
+                return;
+            await this.writePublicRecord(account.accountId, JSON.stringify({
                 ...current,
                 status: account.status ?? current.status,
                 updatedAt: new Date().toISOString(),
@@ -831,7 +1069,7 @@ export class LocalAccountTransportService {
         }
         const rawIndex = await this.keyring.getSecret(LocalAccountTransportService.accountIndexKey);
         for (const accountId of this.parseAccountIndex(rawIndex)) {
-            if (this.accountsMap.has(accountId))
+            if (this.accountsMap.has(accountId) || this.pendingClaudeAccounts.has(accountId))
                 continue;
             const publicRaw = await this.keyring.getSecret(`sentropic-llm-mesh:${accountId}:public`);
             const envelopeRaw = await this.keyring.getSecret(`sentropic-llm-mesh:${accountId}:envelope`);
@@ -878,7 +1116,7 @@ export class LocalAccountTransportService {
                     this.claimedOwnerScopes.set(accountId, ownerClaim.ownerScopeRef);
                 }
                 if (migrateLegacyOwner && restoredAccount.ownerScopeRef) {
-                    await this.keyring.setSecret(`sentropic-llm-mesh:${accountId}:public`, JSON.stringify({ ...publicRecord, account: restoredAccount }));
+                    await this.writePublicRecord(accountId, JSON.stringify({ ...publicRecord, account: restoredAccount }));
                 }
             }
             catch {