agent-dag 1.44.1 → 1.45.0

package/src/server/cswap-admin.mjs

@@ -374,7 +374,14 @@ export async function startLogin({ email } = {}) {
   // waiting only for a url meant this POST sat open for the whole fifteen
   // seconds afterwards: a spinner in front of a user whose answer was ready
   // almost immediately.
-  await waitFor(() => flow.url || flow.state === "failed", 15_000);
+  await waitFor(() => flow.url || flow.state === "failed" || flow.state === "done", 15_000);
+  // A sign-in that got somewhere without a link this could read is still a
+  // sign-in, and since #708 the done handler can carry one all the way to
+  // `done` on its own. Saying "no url" over that would throw a completed login
+  // away at the last step, which is the whole of the bug being fixed.
+  if (!flow.url && (flow.state === "registering" || flow.state === "done")) {
+    return { ok: true, ...loginState() };
+  }
   if (!flow.url) {
     flow.child.kill();
     // Same identity check as the done handler below, and for a sharper reason:
@@ -467,18 +474,136 @@ async function spawnLogin(email) {
     // A newline ended that line; whatever comes next is a new one.
     if (!partial) countedOnLine = 0;
   });
-  // The child dying before the code was accepted is a failure of the login, not
-  // of the deck; say so rather than leaving the dialog spinning.
-  child.done.then((r) => {
+  // The child ending before a code was pasted USED to be read as a failure, and
+  // on this CLI that is the ordinary end of a sign-in that worked (#708).
+  //
+  // `claude auth login` 2.1.246 does two things at once: it prints
+  // "Paste code here if prompted > " and blocks on stdin, AND it listens on a
+  // loopback port for the OAuth callback. Which half finishes the exchange is
+  // not decided by the CLI's version — it is decided by whether the browser
+  // that opened can reach this machine's loopback. On the deck's own machine it
+  // can, so the CLI takes the code itself, prints "Login successful." and exits
+  // 0 while the deck is still sitting in `awaiting_code`; the page that
+  // authorised says "You're all set up" and never shows a code to paste. On a
+  // deck reached from another machine it cannot, the page shows the code, and
+  // the paste path below is the one that runs.
+  //
+  // So the exit alone is not the verdict. The verdict is the identity, and
+  // `claude auth status --json` is the oracle this module already trusts for
+  // it — asked here against the identity recorded before the flow started.
+  child.done.then(async (r) => {
     if (flow !== _login) return;
-    if (flow.state === "awaiting_url" || flow.state === "awaiting_code") {
+    if (flow.state !== "awaiting_url" && flow.state !== "awaiting_code") return;
+    // Answered before any await, so that a `claude` which cannot be run at all
+    // is still reported within milliseconds: startLogin waits on this state to
+    // decide whether to keep holding its POST open, and the sentence naming
+    // AGENTS_DECK_CLAUDE is the only one in the flow that names a fix. Nothing
+    // was signed in either way, so there is nothing to ask about.
+    if (r.timedOut || cannotRun(r)) {
       flow.state = "failed";
-      flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login") || "sign-in ended without a code";
+      flow.error = loginFailureText(r);
+      return;
     }
+    // Claimed before asking, for the same reason submitLoginCode claims it: a
+    // code posted while the question is out would otherwise register the same
+    // login a second time, with a second `cswap add` racing this one.
+    flow.state = "registering";
+    const identity = await currentIdentity();
+    if (flow !== _login) return;
+    // A clean exit with somebody logged in is a completed sign-in, including
+    // the re-sign-in of an account the deck already holds — an identity that
+    // did not CHANGE is not an identity that did not arrive. A dirty exit
+    // counts only when the identity moved, which is a login that landed in
+    // spite of whatever the CLI complained about on its way out.
+    if (identity && (r.ok || identity.email !== flow.previousEmail)) {
+      await registerSignedIn(flow, identity);
+      return;
+    }
+    flow.state = "failed";
+    flow.error = loginFailureText(r);
+  }).catch((err) => {
+    // This handler answers nobody's request — its promise is dropped — so a
+    // throw anywhere in it would be an unhandled rejection AND a dialog left
+    // spinning on `registering` until the poll gave up. It was three lines of
+    // synchronous assignment before; it now shells out twice.
+    console.error(`${PRODUCT} sign-in: the sign-in could not be finished:`, err?.message ?? err);
+    if (flow !== _login) return;
+    flow.state = "failed";
+    flow.error = "the sign-in could not be finished — see the deck's log";
   });
   return flow;
 }
 
+/** A run that never reached the CLI at all — nothing can have been signed in. */
+function cannotRun(r) {
+  return r?.code === "ENOENT" || looksMissing(`${r?.stderr ?? ""}\n${r?.stdout ?? ""}`, "", r?.code);
+}
+
+/**
+ * Why a sign-in failed, in words meant for the person who pressed the button.
+ *
+ * The child's own output is offered only when it is a diagnosis — see
+ * failureText, which since #708 refuses a line that announces success or is
+ * merely the prompt the CLI was still sitting on. What it printed is not thrown
+ * away; it goes to the deck's log, where an operator can read it, rather than
+ * onto a dialog as the reason.
+ */
+function loginFailureText(r) {
+  // One line, the way ccusage's `note` says everything it says: an operator
+  // watching the terminal is reading it beside the deck's own repainted status
+  // rows, and the escapes in it are a login link's OSC-8 wrapper.
+  //
+  // stderr goes LAST because the line is cut from the front. What should be
+  // lost to the bound is the CLI's chatter — the greeting and a sign-in link
+  // that is 400 characters by itself — never its complaint.
+  const tail = stripTerminalEscapes(`${r?.stdout ?? ""}\n${r?.stderr ?? ""}`).replace(/\s+/g, " ").trim();
+  if (tail) console.error(`${PRODUCT} sign-in: claude auth login did not complete:`, tail.slice(-300));
+  if (r?.timedOut) return "the sign-in window expired";
+  return failureText(r, "claude auth login", "the sign-in did not complete — nothing new was signed in");
+}
+
+/**
+ * Everything after the sign-in itself: confirm who we are now, record it with
+ * claude-swap, and put the previously-active account back in front.
+ *
+ * Shared by the two ways a sign-in can end (#708) — a code pasted into the
+ * prompt, and the CLI finishing the exchange through its own loopback callback
+ * — because the steps after it are identical and have to stay identical. An
+ * account the deck skipped `cswap add` for is signed in at the CLI level and
+ * invisible to the panel, with the account the user was on left switched away
+ * from.
+ *
+ * Returns the same `{ok, ...loginState()}` both callers answer their request
+ * with; the done handler simply drops it.
+ */
+async function registerSignedIn(flow, identity) {
+  return withStoreLock(async () => {
+    const add = await run(await cswapBin(), ["add"], { timeout: CSWAP_TIMEOUT_MS });
+    if (!add.ok) {
+      flow.state = "failed";
+      flow.error = addFailureText(add);
+      await restoreActive(flow.previousActive);
+      return { ok: false, reason: "add_failed", ...loginState() };
+    }
+
+    const after = await readStore();
+    const slot = newSlot(flow.before, after);
+    // No new slot means the account was already managed and cswap refreshed its
+    // credentials in place. That is a success with a different sentence.
+    const num = slot ?? Object.keys(after.emails).find(k => after.emails[k] === identity.email) ?? null;
+
+    await restoreActive(flow.previousActive);
+    invalidateClaudeAccountsCache();
+    // Collect straight away, so the new row shows numbers instead of "never
+    // collected" until the next poll — the same nudge seedFirstAccount uses.
+    runDetached(await cswapBin(), ["list"]);
+
+    flow.state = "done";
+    flow.account = { num, email: identity.email, added: slot != null };
+    return { ok: true, ...loginState() };
+  });
+}
+
 /**
  * Hand the code back, then register whatever it signed us in as.
  *
@@ -515,7 +640,11 @@ export async function submitLoginCode(code) {
   }
   if (!r.ok) {
     flow.state = "failed";
-    flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login") || "the code was not accepted";
+    // The `|| "the code was not accepted"` this used to end with could never
+    // run: failureText always answered with something, if only an exit status.
+    // The sentence is where it can be reached now — as the fallback failureText
+    // reaches for when the CLI printed nothing worth repeating.
+    flow.error = r.timedOut ? "the sign-in window expired" : failureText(r, "claude auth login", "the code was not accepted");
     return { ok: false, reason: "login_failed", ...loginState() };
   }
 
@@ -526,31 +655,7 @@ export async function submitLoginCode(code) {
     return { ok: false, reason: "no_identity", ...loginState() };
   }
 
-  return withStoreLock(async () => {
-    const add = await run(await cswapBin(), ["add"], { timeout: CSWAP_TIMEOUT_MS });
-    if (!add.ok) {
-      flow.state = "failed";
-      flow.error = addFailureText(add);
-      await restoreActive(flow.previousActive);
-      return { ok: false, reason: "add_failed", ...loginState() };
-    }
-
-    const after = await readStore();
-    const slot = newSlot(flow.before, after);
-    // No new slot means the account was already managed and cswap refreshed its
-    // credentials in place. That is a success with a different sentence.
-    const num = slot ?? Object.keys(after.emails).find(k => after.emails[k] === identity.email) ?? null;
-
-    await restoreActive(flow.previousActive);
-    invalidateClaudeAccountsCache();
-    // Collect straight away, so the new row shows numbers instead of "never
-    // collected" until the next poll — the same nudge seedFirstAccount uses.
-    runDetached(await cswapBin(), ["list"]);
-
-    flow.state = "done";
-    flow.account = { num, email: identity.email, added: slot != null };
-    return { ok: true, ...loginState() };
-  });
+  return registerSignedIn(flow, identity);
 }
 
 export async function cancelLogin() {
@@ -850,7 +955,7 @@ export async function moveAccount(num, slot) {
  * in every language. Without it, a German user pressing "share…" got the last
  * line of a translated sentence instead of the sentence about PATH.
  */
-export function failureText(r, what = "cswap") {
+export function failureText(r, what = "cswap", fallback = "") {
   const out = `${r?.stderr ?? ""}\n${r?.stdout ?? ""}`;
   const tool = String(what).split(" ")[0];
   if (r?.code === "ENOENT" || looksMissing(out, "", r?.code)) {
@@ -863,7 +968,34 @@ export function failureText(r, what = "cswap") {
   // Asked for one anyway, this said "cswap export exited 0", a success code for
   // a command that never completed.
   if (r?.timedOut || r?.code === "ETIMEDOUT") return `${what} took too long and was stopped`;
-  return firstUseful(out) || `${what} exited ${r?.code}`;
+  return diagnosis(r?.stderr) || diagnosis(r?.stdout) || fallback || `${what} exited ${r?.code}`;
+}
+
+/**
+ * A line that is NOT a diagnosis, however it reached us.
+ *
+ * Two shapes were being shown to users as the reason something failed (#708),
+ * both out of `claude auth login`: the CLI's own "Login successful." — a
+ * failure reason containing the word "successful" is not a diagnosis, it is a
+ * dump — and "Paste code here if prompted >", the unterminated prompt it was
+ * still sitting on, which says that something was ASKED and nothing about
+ * anything going wrong.
+ */
+const NOT_A_DIAGNOSIS = /\bsuccess(?:ful|fully)?\b|[>?]\s*$/i;
+
+/**
+ * One stream's last useful line, if it is worth showing a person.
+ *
+ * Split per stream because the two are not equal: a CLI's diagnosis goes to
+ * stderr and its ordinary progress chatter goes to stdout. Reading the LAST
+ * line of the two concatenated — which is what this module did — handed stdout
+ * the answer whenever it had written anything at all, so `claude auth login`
+ * explained itself with the prompt it had printed rather than with the "Login
+ * failed: …" it had put on stderr.
+ */
+function diagnosis(text) {
+  const line = firstUseful(text);
+  return line && !NOT_A_DIAGNOSIS.test(line) ? line : "";
 }
 
 /** The line worth showing a user out of a CLI's output. */

package/src/server/cswap-auto.mjs

@@ -34,6 +34,139 @@ const SETTINGS = {
   "autoswitch.model":           { type: "model" },
 };
 
+// ── one reading at a time ──────────────────────────────────────────────────
+
+/**
+ * #616: /api/cswap-auto is a GET with no cache, no dedupe and no throttle, and
+ * autoStatus() runs BOTH of this module's readers on every one of them — so the
+ * number of children was exactly twice the number of requests.
+ *
+ * Measured on macOS with claude-swap installed, counting real children through a
+ * PATH shim: one autoStatus() is 2 children (`cswap config` and `ps -Ao args=`)
+ * and about 190ms warm; two back-to-back calls are 4; twenty-five concurrent
+ * readers produced 50 — twenty-five Python interpreters and twenty-five `ps` —
+ * and took 1.3 to 1.9s between them against 190ms for one, so the cost per
+ * reader grows rather than holds. With the guard below the same twenty-five are
+ * 2 children and 190ms, which is one reader's worth.
+ *
+ * On Windows the process-table half is `Get-CimInstance Win32_Process` through
+ * PowerShell, carrying an 8s deadline of its own, which is the same order of
+ * cost as the Get-Process #544 measured at about six seconds; and where cswap is
+ * not on PATH each call also re-pays cswapBin()'s probe, which memoizes only
+ * success and which `candidates` expands to four spellings there, two of them
+ * launched through cmd.exe.
+ *
+ * Two callers reach these without an attacker anywhere: AccountsPanel polls the
+ * route every 15s per open tab, and runTick asks externalAutoRunning() again
+ * before every tick. And it is a GET, so it passes isTrustedRead for any local
+ * client that sends neither Origin nor Sec-Fetch-Site — curl, a shell script, a
+ * sandboxed agent.
+ *
+ * The fix is #544's, at the route that sweep did not reach: a minimum gap plus
+ * one shared in-flight promise per reader. There is no MAX_OUTSTANDING beside it
+ * the way ccusage.mjs has one, and there does not need to be — ccusage keys its
+ * cache by date range, so a flood of distinct ranges can never share a run,
+ * while each reader here asks exactly one question and every caller of it can
+ * therefore join the same child.
+ *
+ * What is NOT shared is the window, because the two halves are not the same
+ * question. See CONFIG_MIN_GAP_MS and EXTERNAL_MIN_GAP_MS.
+ */
+
+/**
+ * `cswap config` — the settings map, which is also what the panel DISPLAYS.
+ *
+ * The deck is not its only writer: `cswap config set` typed in a terminal
+ * changes it behind the deck's back, and the panel is where the user would
+ * expect to see that. So this window has to stay well under AccountsPanel's
+ * 15s poll, or an edit made outside the deck waits for the window AND the poll.
+ * Three seconds does not delay a single tab by one frame — its polls are five
+ * gaps apart — while a burst of requests and two tabs whose polls land within
+ * three seconds of each other collapse onto one child.
+ */
+const CONFIG_MIN_GAP_MS = 3_000;
+
+/**
+ * The process table — the expensive half, and the one whose answer changes
+ * least: it is a boolean about whether the user has their own `cswap auto`
+ * running, and nobody starts one between two fifteen-second polls.
+ *
+ * Ten seconds is chosen against the two scheduled callers rather than against
+ * the cost: AccountsPanel's poll is 15s and MIN_INTERVAL_S — claude-swap's own
+ * floor, and the smallest tick interval SETTINGS will accept — is also 15, so a
+ * gap below both means neither of them is ever handed a reading older than its
+ * own period. The deck's tick still decides on a fresh process table, and the
+ * panel still shows one; what disappears is the second, third and twenty-fifth
+ * copy taken in the same ten seconds.
+ *
+ * Worst case for a caller in a loop is now 20 `cswap config` and 6 process-table
+ * children a minute, whatever it asks for, against a pair per request before.
+ */
+const EXTERNAL_MIN_GAP_MS = 10_000;
+
+const _config   = { last: null, inFlight: null };
+const _external = { last: null, inFlight: null };
+
+/**
+ * One reading of `read`, shared by everyone who asks inside `gapMs`.
+ *
+ * Only a real reading is remembered, which is what `value != null` means here:
+ * readCswapConfig spells its failure `null` — autoStatus reports
+ * `ok: config != null`, so holding one for three seconds would turn a single
+ * hiccup into a panel that renders itself as broken for longer than the hiccup
+ * lasted — and externalAutoRunning has no failure spelling at all, answering
+ * `false` for a process table it could not read because that is the same answer
+ * as an empty one and is the safe one either way. The in-flight share still
+ * applies to a failing read, so a burst arriving during one is a single failing
+ * child rather than a burst of them.
+ *
+ * `slot.inFlight === mine` on both hops is claude-accounts.mjs's guard and is
+ * here for its reason: invalidateCswapAutoCache drops `inFlight` so the next
+ * caller starts a read that knows the settings moved, and a read from BEFORE the
+ * write must neither store its answer under the new state nor clear the new
+ * read's promise on its way out.
+ *
+ * The reading is not keyed by platform even though externalAutoRunning branches
+ * on one. A process does not change platform; the two test files that flip
+ * `process.platform` to reach the other half from this one call
+ * invalidateCswapAutoCache between cases.
+ */
+function throttled(slot, gapMs, read) {
+  const now = Date.now();
+  if (slot.last && now - slot.last.at < gapMs) return Promise.resolve(slot.last.value);
+  if (slot.inFlight) return slot.inFlight;
+  const mine = read()
+    .then(value => {
+      if (value != null && slot.inFlight === mine) slot.last = { at: Date.now(), value };
+      return value;
+    })
+    .finally(() => { if (slot.inFlight === mine) slot.inFlight = null; });
+  slot.inFlight = mine;
+  return mine;
+}
+
+/**
+ * Forget both readings, because the deck has just changed what they would say.
+ *
+ * The one caller is setCswapConfig. There is no `?refresh=1` on /api/cswap-auto
+ * and no force argument through autoStatus, because the panel's explicit-refresh
+ * path is not a query parameter: every auto-switch control is a POST followed by
+ * `load(true)`, which re-fetches this route. Dropping the reading inside the
+ * write is what makes that reload show what was written rather than the map read
+ * a moment before it — the same disagreement between an optimistic value and the
+ * next read that #584 was.
+ *
+ * The process-table reading goes with it. A settings write does not start
+ * anybody's `cswap auto`, so this is not correctness for that half — it is that
+ * one function which forgets everything this module is holding cannot be called
+ * half-right, and the cost is at most one extra `ps` on a path the user reached
+ * by clicking. It is also what the tests reset between cases.
+ */
+export function invalidateCswapAutoCache() {
+  _config.last = _config.inFlight = null;
+  _external.last = _external.inFlight = null;
+}
+
 // ── settings ───────────────────────────────────────────────────────────────
 
 /**
@@ -47,8 +180,15 @@ const SETTINGS = {
  * clamped anyway. The parse itself is a regex over human-formatted output from a
  * separate Python tool, on both line-ending conventions. See
  * cswap-auto-readers.test.ts.
+ *
+ * One reading at a time and one every CONFIG_MIN_GAP_MS at most; the parse below
+ * is what a reading is, and admission control is the wrapper. See throttled.
  */
-export async function readCswapConfig() {
+export function readCswapConfig() {
+  return throttled(_config, CONFIG_MIN_GAP_MS, readCswapConfigNow);
+}
+
+async function readCswapConfigNow() {
   const r = await run(await cswapBin(), ["config"]);
   if (!r.ok) return null;
   const out = {};
@@ -107,6 +247,12 @@ export async function setCswapConfig(key, value) {
   }
 
   const r = await run(await cswapBin(), ["config", "set", key, str]);
+  // Whatever the CLI said. A write that reported a failure may still have landed
+  // — and `r.ok` is not proof either way here, which is the whole of #584 — so
+  // the only safe thing to hold after asking cswap to change a setting is
+  // nothing. The panel reloads this route immediately afterwards and gets a real
+  // read; see invalidateCswapAutoCache.
+  invalidateCswapAutoCache();
   return r.ok ? { ok: true } : { ok: false, reason: "set_failed", detail: (r.stderr || r.stdout).trim().slice(0, 300) };
 }
 
@@ -230,8 +376,16 @@ export function looksLikeAutoLoop(line) {
  * two halves also run completely different commands, `ps` against
  * `Get-CimInstance`, so on any one machine only half of it is ever exercised at
  * all. See cswap-auto-readers.test.ts, which drives both from either host.
+ *
+ * One reading at a time and one every EXTERNAL_MIN_GAP_MS at most — the
+ * expensive half of #616, and the one both of its callers ask for on a
+ * fifteen-second timer. See throttled.
  */
-export async function externalAutoRunning() {
+export function externalAutoRunning() {
+  return throttled(_external, EXTERNAL_MIN_GAP_MS, externalAutoRunningNow);
+}
+
+async function externalAutoRunningNow() {
   // A line is the user's loop if it runs `cswap auto` without --once. Our own
   // ticks are --once, and so is a cron user's. See looksLikeAutoLoop.
   const isLoop = looksLikeAutoLoop;

package/src/server/exec.mjs

@@ -63,8 +63,9 @@ export const isBatch = (file, platform = process.platform) =>
  * Mirrors what Node does internally for `shell: true` on Windows — comspec,
  * /d /s /c, the whole command line as a single quoted argument, and
  * windowsVerbatimArguments so Node does not quote it a second time. Each
- * argument is quoted here, with embedded quotes doubled, which is the escape
- * cmd.exe understands inside a quoted string.
+ * argument is quoted by shellQuoteArg below, which has to satisfy cmd.exe AND
+ * the argv parser of whatever it launches — see the note there, and #624 for
+ * the half of that rule this file was missing until a real cmd.exe was asked.
  */
 export function viaCmd(file, args) {
   const line = [file, ...args].map(a => shellQuoteArg(a, "win32")).join(" ");
@@ -98,17 +99,61 @@ export function viaCmd(file, args) {
  *
  * POSIX gets single quotes, inside which NOTHING is special, with the one
  * escape that form has: close the quote, emit a backslash-quote, reopen.
- * Windows gets cmd.exe's rule — the same one viaCmd applies above, so this file
- * has one Windows quoting rule rather than two — with the same single residual
- * exec.mjs already documents: cmd.exe expands `%VAR%` inside quotes too, and a
- * command line has no escape for it. That is narrower than it sounds, since
- * `%foo%` with no variable `foo` is left alone, and it is a limit of the
- * platform rather than of this function.
+ *
+ * Windows gets the rule below — the same one viaCmd applies above, so this file
+ * has one Windows quoting rule rather than two. It has to satisfy TWO parsers,
+ * and that is the whole of its difficulty, because they disagree about the
+ * backslash:
+ *
+ *   cmd.exe reads the line only far enough to find where the command ends. It
+ *   has no escape for a quote at all — a `"` toggles "inside quotes", and `&`,
+ *   `|`, `<`, `>`, `^`, `(` and `)` are syntax only while outside — and it does
+ *   not treat `\` as anything. Then it hands the rest of the line on AS TEXT.
+ *
+ *   The program on the other end splits that text into argv itself, and for
+ *   node that is the UCRT parser, which DOES read `\` as an escape in front of
+ *   a quote: 2n backslashes before a `"` are n backslashes and a quote that
+ *   toggles, 2n+1 are n backslashes and a literal `"`.
+ *
+ * So an embedded `"` is written `""` rather than `\"` — two toggles is no net
+ * change to cmd.exe's idea of where it is, while the child's parser turns the
+ * pair back into one quote — and every run of backslashes that ends up in front
+ * of a quote, INCLUDING THE CLOSING ONE THIS ADDS, is doubled so the child does
+ * not read it as an escape.
+ *
+ * That last clause is #624 and it was missing. `"` + arg + `"` alone turns a
+ * path ending in a separator — `C:\Program Files\nodejs\` — into
+ * `"C:\Program Files\nodejs\"`, whose final `\"` is an escaped quote to the
+ * child: the quoted region never closes, and the argument swallows every
+ * argument after it on the line. `--provider claude` in the hook command is
+ * exactly what it swallowed. A backslash immediately before an embedded quote
+ * was the quieter half of the same defect — it was eaten as the escape.
+ *
+ * The one residual left, unchanged: cmd.exe expands `%VAR%` inside quotes too,
+ * and a command line has no escape for it. That is narrower than it sounds,
+ * since `%foo%` with no variable `foo` is left alone, and it is a limit of the
+ * platform rather than of this function. `!VAR!` is the same limit on a machine
+ * with delayed expansion turned on, which is not the default for `cmd /c`.
+ *
+ * no-shell-hook-commands.test.ts runs the output of this through a real cmd.exe
+ * on the Windows leg of the matrix and compares what the child RECEIVED against
+ * what was intended. Four literals said this function agreed with itself for
+ * three releases; they could not say whether it agreed with Windows.
  */
 export function shellQuoteArg(arg, platform = process.platform) {
   const s = String(arg ?? "");
-  if (platform === "win32") return `"${s.replace(/"/g, '""')}"`;
-  return `'${s.split("'").join("'\\''")}'`;
+  if (platform !== "win32") return `'${s.split("'").join("'\\''")}'`;
+  let out = '"';
+  let slashes = 0;
+  for (const ch of s) {
+    if (ch === "\\") { slashes++; continue; }
+    if (ch === '"') { out += "\\".repeat(slashes * 2) + '""'; slashes = 0; continue; }
+    out += "\\".repeat(slashes) + ch;
+    slashes = 0;
+  }
+  // A run that reaches the end of the argument is in front of the closing quote,
+  // which is a quote like any other.
+  return `${out}${"\\".repeat(slashes * 2)}"`;
 }
 
 /**
@@ -680,14 +725,17 @@ export function run(cmd, args, { timeout = 20_000, maxBuffer = 4 << 20, env } =
  *
  * Returns immediately with a handle:
  *   write(text)  — into the child's stdin
- *   kill()       — give up; `done` still settles
+ *   kill()       — give up; `done` settles within killGrace either way
  *   onLine(cb)   — every complete stdout/stderr line as it arrives
  *   done         — Promise<{ok, code, killed, timedOut, stdout, stderr}>
  *
- * Never rejects, for the same reason `run` never does. Same Windows candidate
- * resolution, since `claude` and `cswap` are `.cmd` shims there.
+ * Never rejects, for the same reason `run` never does. And never stays pending:
+ * the deadline answers with `code: "ETIMEDOUT", timedOut: true` at the moment
+ * it expires rather than waiting on a 'close' a surviving descendant can hold
+ * back forever — see the timer below, and #614 for what that cost. Same Windows
+ * candidate resolution, since `claude` and `cswap` are `.cmd` shims there.
  */
-export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 << 10 } = {}) {
+export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 << 10, killGrace = 2_000 } = {}) {
   const tries = candidates(cmd);
   const lineSubs = [];
   let child = null;
@@ -715,15 +763,39 @@ export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 <
     }
   };
 
+  let graceTimer = null;
+
   const finish = (code, err) => {
     if (!settle) return;
     const s = settle; settle = null;
     clearTimeout(timer);
+    clearTimeout(graceTimer);
     s({ ok: code === 0 && !err && !timedOut, code: err?.code ?? code ?? -1, killed, timedOut, stdout, stderr });
   };
 
+  // The deadline states the outcome and only then kills — the order `run` uses
+  // forty lines above, for the reason its own header already spells out.
+  //
+  // This used to set the flag, kill, and leave `done` to the child's 'close'.
+  // 'close' waits for the stdio pipes, not merely for the exit, so ONE
+  // descendant that outlives the kill holding the inherited stdout keeps it
+  // from ever arriving: the child is dead, the promise is pending, and it stays
+  // pending for the life of the process. On Windows that is the ordinary shape
+  // rather than a corner — a `.cmd` shim runs the real tool as a grandchild
+  // under cmd.exe, so a taskkill that cannot run reaches only the wrapper — and
+  // on macOS/Linux any cswap subprocess still alive when SIGTERM lands does it.
+  //
+  // What it cost: both callers await this INSIDE withStoreLock, so the pending
+  // promise is the accounts mutex. Every later mutation — login, cancel,
+  // import, remove, alias, reorder — queued behind a link that would never
+  // settle, the HTTP request was never answered, and spawnLogin's
+  // process-on-exit handler leaked with the promise. Reported as #614.
   const timer = setTimeout(() => {
     timedOut = true;
+    killed = true;
+    // Whatever the child managed to print rides along, the way run()'s tail
+    // does: it had not finished, but it is all a caller has to go on.
+    finish(-1, { code: "ETIMEDOUT" });
     killTree(child);
   }, timeout);
   timer.unref?.();
@@ -777,6 +849,12 @@ export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 <
     proc.stderr?.on("data", (d) => { if (stale()) return; const t = String(d); stderr = keep(stderr, t); emitLines(t); });
     proc.on("close", (code) => {
       if (stale()) return;
+      // Already answered — by the deadline above, or by kill()'s grace below.
+      // A late 'close' has nothing left to report, and this is not merely
+      // tidiness: the retry underneath re-runs the WHOLE command, and re-running
+      // `cswap remove` on behalf of a promise nobody is waiting for any more is
+      // exactly the thing that must not happen.
+      if (!settle) return;
       // Same cmd.exe case as in `run`: exit 1 with "is not recognized" means
       // this spelling does not exist, not that the tool failed. Restricted to a
       // batch candidate, which is the only kind launched through a shell, and
@@ -808,10 +886,20 @@ export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 <
       try { child?.stdin?.end(); } catch { /* already closed */ }
     },
     /** Stop the run. On Windows that means the tool under the cmd.exe wrapper
-     *  too — see killTree; a cancelled sign-in used to leave it running. */
+     *  too — see killTree; a cancelled sign-in used to leave it running.
+     *
+     *  `done` settles either way. The kill cannot promise the pipes close —
+     *  that is the deadline's problem reached from the other side — so if the
+     *  child's own 'close' has not arrived within killGrace, the handle answers
+     *  without it. A cancelled sign-in must not be able to wedge the accounts
+     *  mutex any more than an expired one. */
     kill() {
       killed = true;
       killTree(child);
+      if (settle && !graceTimer) {
+        graceTimer = setTimeout(() => finish(-1, null), killGrace);
+        graceTimer.unref?.();
+      }
     },
     onLine(cb) { lineSubs.push(cb); },
     done,