@wjarka/cezarion 0.10.0-pr30.54

package/dist/workspace/agent-accounts.d.ts

@@ -0,0 +1,153 @@
+import { z } from 'zod';
+import { DEFAULT_AGENT_ACCOUNT_ID } from '../contract/index.js';
+import { type ProviderId } from '../core/provider-auth.ts';
+/**
+ * `~/.cezar/agent-accounts.json` — the agent-accounts store (spec `2026-07-29-agent-profiles.md`).
+ *
+ * ## Why its own file
+ *
+ * These keys started life in `config.json`, where their survival across a cezar downgrade rested
+ * on a `.passthrough()` modifier in the OTHER version's schema. That held for the versions in
+ * this repo's history — measured, not assumed — but it is not a guarantee this repo can make on
+ * behalf of a build someone switches to, and it fails completely in the one case that matters
+ * most: any version that cannot parse `config.json` degrades to in-memory defaults, and its next
+ * merge-write rewrites the file without whatever it did not understand.
+ *
+ * A version that has never heard of accounts does not open THIS file, so it cannot lose them.
+ * That is the entire argument, and it is why the selections live here too rather than on the
+ * project registry.
+ *
+ * ## House rules (the same ones `config.json` follows, for the same reasons)
+ *
+ * - every field optional/defaulted with `.catch`, so a bad value degrades per key;
+ * - `.passthrough()` at every object level, so a NEWER cezar's keys survive an older one;
+ * - per-entry salvage for `accounts` — one hand-edited row never evicts the rest;
+ * - atomic tmp+rename at `0600` through the shared writer;
+ * - a corrupt or unreadable file degrades to empty with ONE warning, never a boot failure.
+ *
+ * ## Identity
+ *
+ * Selections are keyed by the project's REALPATH'D ROOT, not its registry slug. The root is what
+ * every consumer already has in hand (`resolveProfileEnvForRoot` takes it), it survives the
+ * registry being rebuilt, and it means this file needs no cross-reference into `config.json` at
+ * all. An orphaned entry — a project the user deregistered — resolves to nothing and is inert.
+ */
+/** `id` slug rule — the project rule, for the same URL/segment-safety reason. */
+export declare const AGENT_ACCOUNT_ID_RE: RegExp;
+/**
+ * Reserved id meaning "the dir cezar discovers" (`agentHomePaths()`).
+ *
+ * NEVER stored and never allocated: the default account is the zero-config answer, so an absent
+ * file behaves exactly as cezar always has. Materializing it would turn a discovered fact into
+ * state a user has to maintain.
+ *
+ * Re-exported from the contract rather than spelled again here: the cockpit sends this exact string
+ * to mean "the discovered account, whatever the repo is set to", so a second definition is a place
+ * for the two sides to drift apart silently.
+ */
+export { DEFAULT_AGENT_ACCOUNT_ID };
+/**
+ * Is `configDir` absolute on `platform`? The account routes' only path rule, and the reason it is a
+ * named function rather than a test written inline.
+ *
+ * A relative dir would resolve against whatever cwd the agent happens to be spawned in — for a task
+ * that is a throwaway worktree — so it has to be refused. But the obvious spelling of that refusal,
+ * a leading-`/` test, refuses every real Windows path too: `C:\Users\me\.claude-work` starts with
+ * neither `/` nor `~`. That is not a corner case: `core/shell-env.ts` renders `set "VAR=v"` for
+ * `cmd.exe` precisely so an account survives a Windows terminal handoff, and the Add-account dialog
+ * delegates ALL path validation to the server, so a string test would leave the whole feature
+ * unreachable on the one platform the rest of this work went out of its way to support.
+ *
+ * `platform` is a parameter so both answers stay testable from either OS.
+ */
+export declare function isAbsoluteConfigDir(configDir: string, platform?: NodeJS.Platform): boolean;
+/** C0 controls + DEL. A path containing one is never legitimate and would be interpolated into a
+ *  shell command by the CLI handoff, so it is refused at the schema, not just at the route. */
+export declare const CONTROL_CHARS_RE: RegExp;
+/**
+ * One extra config dir for a provider — a second login of the same CLI
+ * (`CLAUDE_CONFIG_DIR=~/.claude-klaudiusz claude`), see `src/core/agent-profiles.ts`.
+ *
+ * `id`, `provider` and `configDir` are load-bearing and carry no `.catch`: a row missing any of
+ * them names no account, so the per-entry salvage below drops it. Display fields degrade per key.
+ *
+ * `configDir` is stored AS WRITTEN — a literal `~` survives — and every consumer expands it
+ * through `expandTilde`.
+ */
+declare const agentAccountSchema: z.ZodObject<{
+    id: z.ZodString;
+    provider: z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+        opencode: "opencode";
+        pi: "pi";
+    }>;
+    configDir: z.ZodString;
+    label: z.ZodCatch<z.ZodString>;
+    addedAt: z.ZodCatch<z.ZodString>;
+}, z.core.$loose>;
+export type AgentAccount = z.infer<typeof agentAccountSchema>;
+/** One project's choice, per provider. Explicit keys so `PROVIDER_IDS` stays the one source of
+ *  truth and the value is bounded. An absent key means the discovered default. */
+declare const selectionSchema: z.ZodObject<{
+    claude: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    codex: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    opencode: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    pi: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+}, z.core.$loose>;
+export type AgentAccountSelection = z.infer<typeof selectionSchema>;
+declare const storeSchema: z.ZodObject<{
+    version: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    accounts: z.ZodPipe<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown>>>, z.ZodTransform<{
+        [x: string]: unknown;
+        id: string;
+        provider: "claude" | "codex" | "opencode" | "pi";
+        configDir: string;
+        label: string;
+        addedAt: string;
+    }[], unknown[]>>;
+    defaults: z.ZodCatch<z.ZodDefault<z.ZodObject<{
+        claude: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+        codex: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+        opencode: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+        pi: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    }, z.core.$loose>>>;
+    selections: z.ZodPipe<z.ZodCatch<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>>, z.ZodTransform<Record<string, {
+        [x: string]: unknown;
+        claude?: string | undefined;
+        codex?: string | undefined;
+        opencode?: string | undefined;
+        pi?: string | undefined;
+    }>, Record<string, unknown>>>;
+}, z.core.$loose>;
+export type AgentAccountStore = z.infer<typeof storeSchema>;
+/** The in-memory default — what a missing file behaves like, and the zero-config state. */
+export declare function defaultAgentAccountStore(): AgentAccountStore;
+/**
+ * Read the store on demand — never cached, never throws.
+ *
+ * Not cached because `~/.cezar/` is shared by every cezar process on the machine, so a snapshot is
+ * a staleness bug; one small JSON read is free next to spawning a CLI.
+ *
+ * A missing file is the zero-config default (silent). A corrupt one degrades to the default with a
+ * one-line warning and is left on disk untouched, so the user can repair it by hand — the next
+ * successful merge-write is what replaces it.
+ */
+export declare function loadAgentAccounts(): Promise<AgentAccountStore>;
+/**
+ * Read-modify-write merge: re-read, apply `mutator`, atomic-rename write.
+ *
+ * Because every writer re-reads immediately before writing, two cezar processes editing different
+ * accounts converge instead of dropping each other's — last-writer-wins only inside the tiny
+ * read→rename window, which is the same bargain `config.json` makes. Throws on write failure (a
+ * read-only home); degrading is the caller's policy.
+ */
+export declare function mergeWriteAgentAccounts(mutator: (store: AgentAccountStore) => AgentAccountStore | void): Promise<AgentAccountStore>;
+/**
+ * The account `provider` uses for `repoRoot`, or undefined when nothing has an opinion.
+ *
+ * Repo first, then the machine-wide default. The order is the whole feature: a repo that chose is
+ * never overruled by a later change to the default, and a repo that never chose follows it — so
+ * adding a second login is a one-time act rather than one per checkout.
+ */
+export declare function selectionFor(store: Pick<AgentAccountStore, 'selections' | 'defaults'>, repoRoot: string | undefined, provider: ProviderId): string | undefined;

package/dist/workspace/agent-accounts.js

@@ -0,0 +1,304 @@
+import { realpathSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { posix, resolve, win32 } from 'node:path';
+import { z } from 'zod';
+import { DEFAULT_AGENT_ACCOUNT_ID } from '../contract/index.js';
+import { PROVIDER_IDS } from '../core/provider-auth.js';
+import { supportsProfiles } from '../core/agent-profiles.js';
+import { agentAccountsPath, workspaceConfigPath } from '../paths.js';
+import { atomicWriteJsonSync } from './config.js';
+/**
+ * `~/.cezar/agent-accounts.json` — the agent-accounts store (spec `2026-07-29-agent-profiles.md`).
+ *
+ * ## Why its own file
+ *
+ * These keys started life in `config.json`, where their survival across a cezar downgrade rested
+ * on a `.passthrough()` modifier in the OTHER version's schema. That held for the versions in
+ * this repo's history — measured, not assumed — but it is not a guarantee this repo can make on
+ * behalf of a build someone switches to, and it fails completely in the one case that matters
+ * most: any version that cannot parse `config.json` degrades to in-memory defaults, and its next
+ * merge-write rewrites the file without whatever it did not understand.
+ *
+ * A version that has never heard of accounts does not open THIS file, so it cannot lose them.
+ * That is the entire argument, and it is why the selections live here too rather than on the
+ * project registry.
+ *
+ * ## House rules (the same ones `config.json` follows, for the same reasons)
+ *
+ * - every field optional/defaulted with `.catch`, so a bad value degrades per key;
+ * - `.passthrough()` at every object level, so a NEWER cezar's keys survive an older one;
+ * - per-entry salvage for `accounts` — one hand-edited row never evicts the rest;
+ * - atomic tmp+rename at `0600` through the shared writer;
+ * - a corrupt or unreadable file degrades to empty with ONE warning, never a boot failure.
+ *
+ * ## Identity
+ *
+ * Selections are keyed by the project's REALPATH'D ROOT, not its registry slug. The root is what
+ * every consumer already has in hand (`resolveProfileEnvForRoot` takes it), it survives the
+ * registry being rebuilt, and it means this file needs no cross-reference into `config.json` at
+ * all. An orphaned entry — a project the user deregistered — resolves to nothing and is inert.
+ */
+/** `id` slug rule — the project rule, for the same URL/segment-safety reason. */
+export const AGENT_ACCOUNT_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/**
+ * Reserved id meaning "the dir cezar discovers" (`agentHomePaths()`).
+ *
+ * NEVER stored and never allocated: the default account is the zero-config answer, so an absent
+ * file behaves exactly as cezar always has. Materializing it would turn a discovered fact into
+ * state a user has to maintain.
+ *
+ * Re-exported from the contract rather than spelled again here: the cockpit sends this exact string
+ * to mean "the discovered account, whatever the repo is set to", so a second definition is a place
+ * for the two sides to drift apart silently.
+ */
+export { DEFAULT_AGENT_ACCOUNT_ID };
+/**
+ * Is `configDir` absolute on `platform`? The account routes' only path rule, and the reason it is a
+ * named function rather than a test written inline.
+ *
+ * A relative dir would resolve against whatever cwd the agent happens to be spawned in — for a task
+ * that is a throwaway worktree — so it has to be refused. But the obvious spelling of that refusal,
+ * a leading-`/` test, refuses every real Windows path too: `C:\Users\me\.claude-work` starts with
+ * neither `/` nor `~`. That is not a corner case: `core/shell-env.ts` renders `set "VAR=v"` for
+ * `cmd.exe` precisely so an account survives a Windows terminal handoff, and the Add-account dialog
+ * delegates ALL path validation to the server, so a string test would leave the whole feature
+ * unreachable on the one platform the rest of this work went out of its way to support.
+ *
+ * `platform` is a parameter so both answers stay testable from either OS.
+ */
+export function isAbsoluteConfigDir(configDir, platform = process.platform) {
+    return (platform === 'win32' ? win32 : posix).isAbsolute(configDir);
+}
+/** C0 controls + DEL. A path containing one is never legitimate and would be interpolated into a
+ *  shell command by the CLI handoff, so it is refused at the schema, not just at the route. */
+export const CONTROL_CHARS_RE = /[\u0000-\u001f\u007f]/;
+/**
+ * One extra config dir for a provider — a second login of the same CLI
+ * (`CLAUDE_CONFIG_DIR=~/.claude-klaudiusz claude`), see `src/core/agent-profiles.ts`.
+ *
+ * `id`, `provider` and `configDir` are load-bearing and carry no `.catch`: a row missing any of
+ * them names no account, so the per-entry salvage below drops it. Display fields degrade per key.
+ *
+ * `configDir` is stored AS WRITTEN — a literal `~` survives — and every consumer expands it
+ * through `expandTilde`.
+ */
+const agentAccountSchema = z
+    .object({
+    id: z.string().regex(AGENT_ACCOUNT_ID_RE).refine((v) => v !== DEFAULT_AGENT_ACCOUNT_ID, {
+        message: `"${DEFAULT_AGENT_ACCOUNT_ID}" is reserved for the discovered account`,
+    }),
+    // Refused at the SCHEMA, not just at the route, for the same reason the reserved `default` id
+    // is: this file is designed to survive hand edits, foreign writers and the legacy import, and a
+    // provider whose credentials do not follow its config dir resolves to a LIE — `profileEnv`
+    // returns `{}` for it, so the step records the account, the UI names it, and the CLI runs on
+    // the default login anyway. Dropped by the per-entry salvage instead, which is the one
+    // degradation that cannot mislead.
+    provider: z.enum(PROVIDER_IDS).refine(supportsProfiles, {
+        message: 'this agent cannot carry more than one account (its credentials do not follow its config dir)',
+    }),
+    configDir: z
+        .string()
+        .min(1)
+        .max(4096)
+        .refine((v) => !CONTROL_CHARS_RE.test(v), 'configDir must not contain control characters'),
+    label: z.string().max(200).catch(''),
+    addedAt: z.string().max(64).catch(''),
+})
+    .passthrough();
+/** One project's choice, per provider. Explicit keys so `PROVIDER_IDS` stays the one source of
+ *  truth and the value is bounded. An absent key means the discovered default. */
+const selectionSchema = z
+    .object({
+    claude: z.string().max(64).optional().catch(undefined),
+    codex: z.string().max(64).optional().catch(undefined),
+    opencode: z.string().max(64).optional().catch(undefined),
+    pi: z.string().max(64).optional().catch(undefined),
+})
+    .passthrough();
+const storeSchema = z
+    .object({
+    /** Format cursor for THIS file, independent of `config.json`'s `schemaVersion`. Nothing reads
+     *  it yet; it exists so a future shape change has somewhere to say so. */
+    version: z.number().int().min(0).default(1).catch(1),
+    accounts: z
+        .array(z.unknown())
+        .default(() => [])
+        .catch(() => [])
+        .transform((entries) => {
+        const seen = new Set();
+        return entries.flatMap((entry) => {
+            const parsed = agentAccountSchema.safeParse(entry);
+            // First-wins on a duplicated id, so two consumers never resolve the same id differently.
+            if (!parsed.success || seen.has(parsed.data.id))
+                return [];
+            seen.add(parsed.data.id);
+            return [parsed.data];
+        });
+    }),
+    /**
+     * The per-provider account a repo with no selection of its own uses.
+     *
+     * A machine-wide answer to "which login do I work under", so a second account does not have to
+     * be re-chosen for every checkout. Consulted only where `selections` is silent for that repo
+     * and provider — a repo that HAS chosen keeps its choice, which is what makes this a default
+     * rather than an override.
+     */
+    defaults: selectionSchema.default(() => ({})).catch(() => ({})),
+    /** Repo root → per-provider choice. Per-entry salvage: a bad row is dropped, the rest stay. */
+    selections: z
+        .record(z.string(), z.unknown())
+        .default(() => ({}))
+        .catch(() => ({}))
+        .transform((raw) => {
+        const out = {};
+        for (const [root, value] of Object.entries(raw)) {
+            const parsed = selectionSchema.safeParse(value);
+            if (parsed.success)
+                out[root] = parsed.data;
+        }
+        return out;
+    }),
+})
+    .passthrough();
+/** The in-memory default — what a missing file behaves like, and the zero-config state. */
+export function defaultAgentAccountStore() {
+    return storeSchema.parse({});
+}
+/**
+ * Read the store on demand — never cached, never throws.
+ *
+ * Not cached because `~/.cezar/` is shared by every cezar process on the machine, so a snapshot is
+ * a staleness bug; one small JSON read is free next to spawning a CLI.
+ *
+ * A missing file is the zero-config default (silent). A corrupt one degrades to the default with a
+ * one-line warning and is left on disk untouched, so the user can repair it by hand — the next
+ * successful merge-write is what replaces it.
+ */
+export async function loadAgentAccounts() {
+    const path = agentAccountsPath();
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch {
+        // Absent — but accounts may predate this file (they lived in config.json on the branch that
+        // introduced them), so give those one chance to come across.
+        return importLegacyAccounts();
+    }
+    try {
+        const parsed = storeSchema.safeParse(JSON.parse(raw));
+        if (parsed.success)
+            return parsed.data;
+    }
+    catch {
+        // malformed JSON — fall through to the warning + defaults
+    }
+    console.warn(`[cez] agent accounts ${path} is corrupt — ignoring it (every project falls back to its default account)`);
+    return defaultAgentAccountStore();
+}
+/**
+ * Read-modify-write merge: re-read, apply `mutator`, atomic-rename write.
+ *
+ * Because every writer re-reads immediately before writing, two cezar processes editing different
+ * accounts converge instead of dropping each other's — last-writer-wins only inside the tiny
+ * read→rename window, which is the same bargain `config.json` makes. Throws on write failure (a
+ * read-only home); degrading is the caller's policy.
+ */
+export async function mergeWriteAgentAccounts(mutator) {
+    const current = await loadAgentAccounts();
+    const next = mutator(current) ?? current;
+    atomicWriteJsonSync(agentAccountsPath(), next);
+    return next;
+}
+/**
+ * One-time, non-destructive import of accounts that were written into `config.json` by the branch
+ * that first introduced them (before they got their own file).
+ *
+ * Reads the RAW object rather than going through the workspace schema, because that schema no
+ * longer names these keys — they only survive there as passthrough. Nothing is deleted from
+ * `config.json`: an older cezar sharing this home keeps reading what it has always read, and this
+ * import is idempotent because it only runs while `agent-accounts.json` is absent.
+ */
+async function importLegacyAccounts() {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(workspaceConfigPath(), 'utf8'));
+    }
+    catch {
+        return defaultAgentAccountStore();
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return defaultAgentAccountStore();
+    const legacy = parsed;
+    const selections = {};
+    if (Array.isArray(legacy.projects)) {
+        for (const entry of legacy.projects) {
+            if (!entry || typeof entry !== 'object')
+                continue;
+            const { root, agentProfile } = entry;
+            if (typeof root === 'string' && agentProfile && typeof agentProfile === 'object') {
+                selections[root] = agentProfile;
+            }
+        }
+    }
+    const imported = storeSchema.safeParse({ accounts: legacy.agentProfiles, selections });
+    if (!imported.success)
+        return defaultAgentAccountStore();
+    // Only worth persisting when there was something to carry over; an empty import must not create
+    // a file, or the zero-config promise ("delete any of them and cezar rebuilds") gains a file that
+    // exists for no reason.
+    if (imported.data.accounts.length === 0)
+        return imported.data;
+    try {
+        atomicWriteJsonSync(agentAccountsPath(), imported.data);
+    }
+    catch {
+        // read-only home: the import stays in memory for this process, which is still correct
+    }
+    return imported.data;
+}
+/**
+ * The account `provider` uses for `repoRoot`, or undefined when nothing has an opinion.
+ *
+ * Repo first, then the machine-wide default. The order is the whole feature: a repo that chose is
+ * never overruled by a later change to the default, and a repo that never chose follows it — so
+ * adding a second login is a one-time act rather than one per checkout.
+ */
+export function selectionFor(store, repoRoot, provider) {
+    const chosen = repoRoot === undefined ? undefined : selectionForRoot(store, repoRoot)?.[provider];
+    return chosen ?? store.defaults[provider];
+}
+/**
+ * The selection stored for `repoRoot`, matched on the literal spelling first and the realpath'd
+ * one second.
+ *
+ * The keys come from the REGISTRY, which realpath-normalizes every root it stores
+ * (`workspace/projects.ts` `normalizeRoot`); the readers hold whatever spelling their caller had —
+ * `RunManager` is constructed with `repoInfo?.root ?? cwd` for the boot project, not with the
+ * registry entry. `workspace/semaphore.ts` already normalizes at lookup for the per-project
+ * concurrency map for exactly this reason. Doing it here too matters more, not less: a missed
+ * concurrency override runs the task with the wrong ceiling, a missed account selection runs it on
+ * the wrong subscription and says nothing.
+ *
+ * The literal probe comes first because it is free and answers the overwhelmingly common case; the
+ * normalized one only pays a `realpathSync` when the literal key is absent.
+ */
+function selectionForRoot(store, repoRoot) {
+    const literal = store.selections[repoRoot];
+    if (literal !== undefined)
+        return literal;
+    const normalized = normalizeRootSync(repoRoot);
+    return normalized === repoRoot ? undefined : store.selections[normalized];
+}
+/** Realpath-normalize a root the way the registry does, but synchronously — this answers a run's
+ *  per-step lookup and must not `await`. A path that cannot be realpath'd (gone, unreadable)
+ *  degrades to `resolve()`, matching the registry's own fallback and `semaphore.ts`'s. */
+function normalizeRootSync(root) {
+    try {
+        return realpathSync(root);
+    }
+    catch {
+        return resolve(root);
+    }
+}
+//# sourceMappingURL=agent-accounts.js.map

package/dist/workspace/agent-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-accounts.js","sourceRoot":"","sources":["../../src/workspace/agent-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAmB,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACtE,CAAC;AAED;+FAC+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,wBAAwB,EAAE;QACtF,OAAO,EAAE,IAAI,wBAAwB,0CAA0C;KAChF,CAAC;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,2FAA2F;IAC3F,6FAA6F;IAC7F,uFAAuF;IACvF,mCAAmC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE;QACtD,OAAO,EAAE,8FAA8F;KACxG,CAAC;IACF,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,+CAA+C,CAAC;IAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;CACtC,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB;kFACkF;AAClF,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CACnD,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN;8EAC0E;IAC1E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SAClB,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACjB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACf,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnD,yFAAyF;YACzF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC3D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACJ;;;;;;;OAOG;IACH,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,+FAA+F;IAC/F,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;SACnB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;SACjB,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;QACjB,MAAM,GAAG,GAA0C,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;CACL,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,2FAA2F;AAC3F,MAAM,UAAU,wBAAwB;IACtC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,6DAA6D;QAC7D,OAAO,oBAAoB,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,6EAA6E,CAAC,CAAC;IACxH,OAAO,wBAAwB,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA+D;IAE/D,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IACzC,mBAAmB,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB;IACjC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,wBAAwB,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAyD,CAAC;IACzE,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAClD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,KAAmD,CAAC;YACnF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACjF,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,wBAAwB,EAAE,CAAC;IACzD,gGAAgG;IAChG,iGAAiG;IACjG,wBAAwB;IACxB,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,CAAC;QACH,mBAAmB,CAAC,iBAAiB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAyD,EACzD,QAA4B,EAC5B,QAAoB;IAEpB,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAClG,OAAO,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CACvB,KAA4C,EAC5C,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC5E,CAAC;AAED;;0FAE0F;AAC1F,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/workspace/agent-profiles.d.ts

@@ -0,0 +1,78 @@
+import type { ProviderId } from '../core/provider-auth.ts';
+import { type AgentAccount, type AgentAccountStore } from './agent-accounts.ts';
+/**
+ * Resolving an agent account against `~/.cezar/agent-accounts.json` — the I/O half of
+ * `src/core/agent-profiles.ts` (which stays pure and owns the vendor knowledge).
+ *
+ * Nothing here is cached. `~/.cezar/` is shared by every cezar process on the machine (a `serve`
+ * per repo, headless `cezar run`s, a settings PUT), so a snapshot is a staleness bug waiting to
+ * happen — and one small JSON read is free next to spawning an agent CLI.
+ */
+/** An account as the rest of the codebase consumes it: id, provider, and the dir to point at. */
+export interface ResolvedAgentProfile {
+    id: string;
+    provider: ProviderId;
+    label: string;
+    /** As stored (`~` kept) — what the user typed, or the discovered default's path. */
+    configDir: string;
+    /** Expanded absolute path — what actually gets handed to the CLI. */
+    path: string;
+    /** True for the discovered account, which is never stored and cannot be edited or deleted. */
+    isDefault: boolean;
+}
+/**
+ * The implicit account for a provider: whatever `agentHomePaths()` discovers, which already
+ * honours the vendors' own `CLAUDE_CONFIG_DIR` / `CODEX_HOME` / `XDG_CONFIG_HOME`. Setting one of
+ * those on the cezar process therefore moves the DEFAULT account rather than being ignored.
+ */
+export declare function defaultAgentProfile(provider: ProviderId, env?: NodeJS.ProcessEnv): ResolvedAgentProfile;
+/** Expand a stored account into its resolved form. Pure; the caller supplies the row. */
+export declare function resolveStoredProfile(account: AgentAccount): ResolvedAgentProfile;
+/** Every account for `provider`, discovered default first, then the stored extras in file order. */
+export declare function profilesForProvider(store: Pick<AgentAccountStore, 'accounts'>, provider: ProviderId, env?: NodeJS.ProcessEnv): ResolvedAgentProfile[];
+/** Every account across every provider — the listing route's source. */
+export declare function listAgentProfiles(store: Pick<AgentAccountStore, 'accounts'>, providers: readonly ProviderId[], env?: NodeJS.ProcessEnv): ResolvedAgentProfile[];
+/**
+ * The account a given `(project, provider)` pair resolves to.
+ *
+ * `profileId` is the caller's explicit choice — a run's recorded account, or a composer override.
+ * When it is absent the project's stored selection decides, and when THAT is absent (or names an
+ * account that no longer exists) the answer is the discovered default.
+ *
+ * Note the deliberate asymmetry with a missing DIRECTORY: an UNKNOWN id degrades silently to the
+ * default, because a dangling reference names no account and the default is the only safe answer.
+ * A KNOWN id whose directory has vanished does NOT degrade — see `profileDirState`. Falling back
+ * there would run the task on the personal subscription while the UI still said "Work", and a
+ * billing boundary is not a preference to degrade quietly across.
+ */
+export declare function selectProfile(store: AgentAccountStore, options: {
+    provider: ProviderId;
+    repoRoot?: string;
+    profileId?: string;
+    env?: NodeJS.ProcessEnv;
+}): ResolvedAgentProfile;
+/**
+ * The env a spawned `provider` process needs for the account selected by `repoRoot`/`profileId`.
+ *
+ * `{}` for the default account, which is the whole point: the zero-config path adds nothing to the
+ * child environment. Reads the store per call (see the module note) and never throws — an
+ * unreadable home degrades to the default account, which is the behaviour cezar had before
+ * accounts existed.
+ */
+export declare function resolveProfileEnvForRoot(repoRoot: string | undefined, provider: ProviderId, profileId?: string, env?: NodeJS.ProcessEnv): Promise<{
+    profile: ResolvedAgentProfile;
+    env: Record<string, string>;
+}>;
+/** Whether an account's directory exists and looks like the agent wrote it. Never throws. */
+export declare function profileDirState(provider: ProviderId, path: string): Promise<{
+    exists: boolean;
+    looksValid: boolean;
+}>;
+/**
+ * Is `path` the same directory as an existing account's (or the default's)?
+ *
+ * Compared through `realpath` so two spellings of one dir — a symlink, a trailing slash — cannot
+ * become two accounts that silently share a session store. A path that does not exist yet cannot
+ * collide with anything, which is correct: the CLI has not created it, so it is nobody's home.
+ */
+export declare function sameProfileDir(a: string, b: string): Promise<boolean>;

package/dist/workspace/agent-profiles.js

@@ -0,0 +1,115 @@
+import { readdir, realpath } from 'node:fs/promises';
+import { profileEnv, looksLikeProfileDir } from '../core/agent-profiles.js';
+import { agentHomePaths, expandTilde } from '../paths.js';
+import { DEFAULT_AGENT_ACCOUNT_ID, loadAgentAccounts, selectionFor, } from './agent-accounts.js';
+/**
+ * The implicit account for a provider: whatever `agentHomePaths()` discovers, which already
+ * honours the vendors' own `CLAUDE_CONFIG_DIR` / `CODEX_HOME` / `XDG_CONFIG_HOME`. Setting one of
+ * those on the cezar process therefore moves the DEFAULT account rather than being ignored.
+ */
+export function defaultAgentProfile(provider, env = process.env) {
+    const home = agentHomePaths(env);
+    const path = provider === 'codex' ? home.codex : provider === 'opencode' ? home.opencodeConfig : home.claude;
+    return {
+        id: DEFAULT_AGENT_ACCOUNT_ID,
+        provider,
+        label: 'Default',
+        configDir: path,
+        path,
+        isDefault: true,
+    };
+}
+/** Expand a stored account into its resolved form. Pure; the caller supplies the row. */
+export function resolveStoredProfile(account) {
+    return {
+        id: account.id,
+        provider: account.provider,
+        label: account.label || account.id,
+        configDir: account.configDir,
+        path: expandTilde(account.configDir),
+        isDefault: false,
+    };
+}
+/** Every account for `provider`, discovered default first, then the stored extras in file order. */
+export function profilesForProvider(store, provider, env = process.env) {
+    return [
+        defaultAgentProfile(provider, env),
+        ...store.accounts.filter((a) => a.provider === provider).map(resolveStoredProfile),
+    ];
+}
+/** Every account across every provider — the listing route's source. */
+export function listAgentProfiles(store, providers, env = process.env) {
+    return providers.flatMap((provider) => profilesForProvider(store, provider, env));
+}
+/**
+ * The account a given `(project, provider)` pair resolves to.
+ *
+ * `profileId` is the caller's explicit choice — a run's recorded account, or a composer override.
+ * When it is absent the project's stored selection decides, and when THAT is absent (or names an
+ * account that no longer exists) the answer is the discovered default.
+ *
+ * Note the deliberate asymmetry with a missing DIRECTORY: an UNKNOWN id degrades silently to the
+ * default, because a dangling reference names no account and the default is the only safe answer.
+ * A KNOWN id whose directory has vanished does NOT degrade — see `profileDirState`. Falling back
+ * there would run the task on the personal subscription while the UI still said "Work", and a
+ * billing boundary is not a preference to degrade quietly across.
+ */
+export function selectProfile(store, options) {
+    const { provider, repoRoot, profileId } = options;
+    const env = options.env ?? process.env;
+    const chosen = profileId ?? selectionFor(store, repoRoot, provider);
+    if (chosen === undefined || chosen === DEFAULT_AGENT_ACCOUNT_ID)
+        return defaultAgentProfile(provider, env);
+    const stored = store.accounts.find((a) => a.id === chosen && a.provider === provider);
+    return stored ? resolveStoredProfile(stored) : defaultAgentProfile(provider, env);
+}
+/**
+ * The env a spawned `provider` process needs for the account selected by `repoRoot`/`profileId`.
+ *
+ * `{}` for the default account, which is the whole point: the zero-config path adds nothing to the
+ * child environment. Reads the store per call (see the module note) and never throws — an
+ * unreadable home degrades to the default account, which is the behaviour cezar had before
+ * accounts existed.
+ */
+export async function resolveProfileEnvForRoot(repoRoot, provider, profileId, env = process.env) {
+    let store;
+    try {
+        store = await loadAgentAccounts();
+    }
+    catch {
+        return { profile: defaultAgentProfile(provider, env), env: {} };
+    }
+    const profile = selectProfile(store, { provider, repoRoot, profileId, env });
+    // The default account contributes nothing: `agentHomePaths()` already reflects whatever the host
+    // env says, so re-exporting it would be a no-op at best and a surprise at worst.
+    return { profile, env: profile.isDefault ? {} : profileEnv(provider, profile.path) };
+}
+/** Whether an account's directory exists and looks like the agent wrote it. Never throws. */
+export async function profileDirState(provider, path) {
+    let entries;
+    try {
+        entries = await readdir(path);
+    }
+    catch {
+        return { exists: false, looksValid: false };
+    }
+    return { exists: true, looksValid: looksLikeProfileDir(provider, entries) };
+}
+/**
+ * Is `path` the same directory as an existing account's (or the default's)?
+ *
+ * Compared through `realpath` so two spellings of one dir — a symlink, a trailing slash — cannot
+ * become two accounts that silently share a session store. A path that does not exist yet cannot
+ * collide with anything, which is correct: the CLI has not created it, so it is nobody's home.
+ */
+export async function sameProfileDir(a, b) {
+    if (a === b)
+        return true;
+    try {
+        return (await realpath(a)) === (await realpath(b));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=agent-profiles.js.map