ccdeck 3.22.15 → 3.23.0

package/src/server/claude-accounts.mjs

@@ -19,7 +19,23 @@ import { run, runDetached } from "./exec.mjs";
 // The CLI identity oracle, already written and already trusted by the account
 // admin routes. #721 needs the same answer, so it reuses the same function
 // rather than shelling out a second way to ask one question.
-import { currentIdentity } from "./cswap-admin.mjs";
+//
+// FROM claude-identity.mjs, NOT FROM cswap-admin.mjs. This one import was the
+// single edge that closed the only static import cycle in src/server —
+// cswap-admin.mjs imports this file back for `backupRoot`,
+// `invalidateClaudeAccountsCache` and `verdictNow` — and a cycle is not merely
+// untidy: two dynamic imports entering one concurrently are each handed the
+// other module's half-built namespace, which has no exports on it at all. The
+// boot wires `repairStaleCopyWith` across exactly that pair, and on CI it was
+// handed two empty namespaces and wired nothing, silently. The oracle lives in
+// a module that imports only leaves now, so both sides can reach it and neither
+// closes a loop.
+import { currentIdentity } from "./claude-identity.mjs";
+// The one mutex, from the module that exists so that both halves of the
+// accounts surface can reach it. Not from cswap-admin.mjs, which imports THIS
+// file: the dependency has to go the other way, and a lock imported over a
+// cycle is a lock that may not be there yet when a mutation wants it.
+import { withStoreLock } from "./store-lock.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { homedir, platform } from "node:os";
@@ -849,6 +865,20 @@ export function invalidateClaudeAccountsCache() {
  * Claude Code's own lock files, in its order, with its staleness values, or it
  * can interleave with Claude Code's token refresh and clobber it. cswap does
  * that; a second implementation racing it would be worse than useless.
+ *
+ * AND IT TAKES THE DECK'S OWN MUTEX (#1039). Holding Claude Code's lock files
+ * says nothing about claude-swap's sequence.json, which `cswap switch` reads
+ * and writes with no file lock of its own — the same unlocked read-modify-write
+ * cswap-admin.mjs's header opens by explaining. `cancelLogin` already queues
+ * ITS `cswap switch` behind this lock and spells out why: running one beside an
+ * in-flight `cswap add` means whichever write lands second drops the other's
+ * record, so the account just signed in is registered and immediately lost, or
+ * the rotation is silently undone. This route is the same hazard with a click
+ * instead of a cancel, and it ran outside the lock entirely.
+ *
+ * The validation stays OUTSIDE the lock. A slot number that is not one is not a
+ * mutation and must not wait behind somebody else's sixty-second `cswap add`
+ * to be told so.
  */
 export function switchClaudeAccount(accountNum) {
   // Straight into an exec argument, so nothing but a slot number gets through.
@@ -859,13 +889,13 @@ export function switchClaudeAccount(accountNum) {
 
   // Argument vector, never a shell — and resolved through exec.mjs so the
   // Windows `.exe`/`.cmd` shim is found too.
-  return cswapBin()
+  return withStoreLock(() => cswapBin()
     .then(bin => run(bin, ["switch", String(num)], { timeout: 30_000 }))
     .then(r => {
       if (r.ok) return { ok: true, output: r.stdout.trim() };
       const reason = r.code === "ENOENT" ? "no_cswap" : r.killed ? "timeout" : "switch_failed";
       return { ok: false, reason, output: (r.stderr || r.stdout).trim().slice(0, 500) };
-    });
+    }));
 }
 
 
@@ -916,36 +946,51 @@ export async function seedFirstAccount() {
   if (process.env.AGENTS_DECK_NO_INSTALL === "1") return { state: "skipped" };
   if (existsSync(SEED_MARKER)) return { state: "already-tried" };
 
-  // Empty store only. A store with accounts in it is the user's, not ours, and
-  // a store we cannot parse is treated the same way.
-  // No file at all is the fresh install this exists for; a file that will not
-  // parse is a store in an unknown state. readJson answers null to both, so
-  // they are told apart before deciding, because they call for opposite
-  // decisions — seed, and keep well away.
-  const seqPath = join(backupRoot(), "sequence.json");
-  const before = existsSync(seqPath) ? accountCount(await readJson(seqPath)) : 0;
-  if (before > 0) return { state: "has-accounts", count: before };
-  if (before < 0) return { state: "unreadable-store" };
-
-  // Mark before running, not after: if `cswap add` half-succeeds or the process
-  // dies mid-way, the retry-forever loop is the worse outcome.
-  try {
-    await mkdir(dirname(SEED_MARKER), { recursive: true });
-    await writeFile(SEED_MARKER, new Date().toISOString());
-  } catch { /* best-effort — worst case it is attempted again */ }
-
-  const r = await run(await cswapBin(), ["add"], { timeout: 60_000 });
-  if (!r.ok) {
-    return { state: "failed", detail: (r.stderr || r.stdout).trim().slice(0, 200) };
-  }
+  // THE TEST AND THE WRITE ARE ONE CRITICAL SECTION (#1039). The whole guard
+  // below is a read of sequence.json — "only when the store holds no accounts
+  // at all, so nothing can be overwritten or reordered" — followed by a `cswap
+  // add` that assigns a slot as max+1 with no file lock of its own. Outside the
+  // mutex that pair is exactly the read-modify-write cswap-admin.mjs's header
+  // says every mutation must go through, and #796 is what it costs when the
+  // read and the write disagree about what is in the store: an add against a
+  // populated store, re-pointing activeAccountNumber with nothing here to put
+  // it back. This runs unawaited at boot, so there is no user to notice.
+  //
+  // The two refusals above stay outside: neither touches the store, and a deck
+  // that has already seeded must not wait behind a stranger's mutation to say
+  // so on every start.
+  return withStoreLock(async () => {
+    // Empty store only. A store with accounts in it is the user's, not ours, and
+    // a store we cannot parse is treated the same way.
+    // No file at all is the fresh install this exists for; a file that will not
+    // parse is a store in an unknown state. readJson answers null to both, so
+    // they are told apart before deciding, because they call for opposite
+    // decisions — seed, and keep well away.
+    const seqPath = join(backupRoot(), "sequence.json");
+    const before = existsSync(seqPath) ? accountCount(await readJson(seqPath)) : 0;
+    if (before > 0) return { state: "has-accounts", count: before };
+    if (before < 0) return { state: "unreadable-store" };
+
+    // Mark before running, not after: if `cswap add` half-succeeds or the process
+    // dies mid-way, the retry-forever loop is the worse outcome.
+    try {
+      await mkdir(dirname(SEED_MARKER), { recursive: true });
+      await writeFile(SEED_MARKER, new Date().toISOString());
+    } catch { /* best-effort — worst case it is attempted again */ }
+
+    const r = await run(await cswapBin(), ["add"], { timeout: 60_000 });
+    if (!r.ok) {
+      return { state: "failed", detail: (r.stderr || r.stdout).trim().slice(0, 200) };
+    }
 
-  invalidateClaudeAccountsCache();
-  const count = existsSync(seqPath) ? accountCount(await readJson(seqPath)) : 0;
-  if (count > 0) {
-    // Collect straight away. Otherwise the first thing the user sees is their
-    // account listed with "never fetched" beside it, waiting on a poll cycle
-    // for numbers that are the reason the panel exists.
-    runDetached(await cswapBin(), ["list"]);
-  }
-  return count > 0 ? { state: "added", count } : { state: "nothing-to-add" };
+    invalidateClaudeAccountsCache();
+    const count = existsSync(seqPath) ? accountCount(await readJson(seqPath)) : 0;
+    if (count > 0) {
+      // Collect straight away. Otherwise the first thing the user sees is their
+      // account listed with "never fetched" beside it, waiting on a poll cycle
+      // for numbers that are the reason the panel exists.
+      runDetached(await cswapBin(), ["list"]);
+    }
+    return count > 0 ? { state: "added", count } : { state: "nothing-to-add" };
+  });
 }

package/src/server/claude-identity.mjs

@@ -0,0 +1,121 @@
+// Who the `claude` CLI says is signed in, and which `claude` binary answers.
+//
+// WHY THIS IS ITS OWN MODULE. It was in cswap-admin.mjs, and claude-accounts.mjs
+// imported `currentIdentity` from there — the single edge that closed the only
+// static import cycle in src/server, because cswap-admin.mjs imports
+// claude-accounts.mjs back for `backupRoot`, `invalidateClaudeAccountsCache`
+// and `verdictNow`.
+//
+// A cycle is not merely untidy here. Two dynamic imports that enter one
+// concurrently are each handed the other module's HALF-BUILT namespace rather
+// than waiting for it, and a half-built namespace has no exports on it at all.
+// `startServer` wires cswap-admin's `autoRecapture` into claude-accounts'
+// `repairStaleCopyWith` at boot, and on CI both namespaces arrived with zero
+// keys: the call was a TypeError in a promise nothing awaited, so the repair
+// was silently never wired while every test still passed. See
+// boot-module-graph.test.ts, which now asserts that src/server has no cycles at
+// all rather than trying to police the call sites of one.
+//
+// This file imports only leaves — exec.mjs and claude-dir.mjs have no relative
+// imports of their own — so it can be reached from either side without closing
+// anything. Both functions are re-exported from cswap-admin.mjs, which is where
+// their callers and their tests already look for them.
+import { pathLookup, run } from "./exec.mjs";
+import { claudeCliCandidates } from "./claude-dir.mjs";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+
+/**
+ * Which `claude` the account surface runs: the configured one, else the first
+ * candidate this machine actually has, else the bare name.
+ *
+ * WHY THIS IS NOT `AGENTS_DECK_CLAUDE ?? "claude"` ANY MORE (#570). That was
+ * the whole of this module's resolution, and it feeds every child the accounts
+ * panel starts — `claude auth status --json` for `currentIdentity`, and the
+ * `claude auth login` whose output the sign-in dialog reads a link out of. On a
+ * machine whose `claude` is at `~/.local/bin/claude` but whose deck was started
+ * from something that never sourced a shell rc — a LaunchAgent, a systemd user
+ * unit, pm2, a desktop shortcut — the bare name is an ENOENT, so the login
+ * child is dead within milliseconds, the flow reports `no_url`, and the dialog
+ * shows "the claude CLI could not be run: not on PATH. Set AGENTS_DECK_CLAUDE
+ * to its full path." That sentence is a real remedy and it is why this was a
+ * smaller bug than #553; it is still a request to spell out a path the deck had
+ * already found for itself, because `hasClaudeInstalled()` stat'ed that exact
+ * file at boot to decide this was a Claude machine, and since #553 the quota
+ * panel beside this one runs the same binary without being told anything.
+ *
+ * SO IT READS THE SAME LIST, ON THE SAME TERMS #553 SETTLED ON. The list is
+ * `claudeCliCandidates` in claude-dir.mjs, whose other two readers are
+ * `hasClaudeInstalled()` — the boot question this module's whole surface hangs
+ * off — and `quotaClaudeBin` in quota.mjs. This is the same question at a third
+ * site, so nothing here is decided again:
+ *
+ *   - AGENTS_DECK_CLAUDE first, and it is the one thing that skips the list
+ *     entirely. It is documented in the README as "full path to the `claude`
+ *     CLI", it is what the failure message above tells people to set, and
+ *     someone who set it has already been through this once — second-guessing
+ *     them with a stat would be answering a question they have closed. An empty
+ *     value reads as unset, the way `AGENTS_DECK_CSWAP` does in cswapBin.
+ *   - Then the candidate list's own order, unchanged: PATH first on POSIX, the
+ *     two known install directories first on Windows. Preferring a different
+ *     copy would silently change which binary signs somebody in on every
+ *     machine that has two, and a `claude auth login` that suddenly runs a
+ *     different binary is a credential path, not a detail.
+ *   - The bare name is only answered with when PATH actually holds it, and
+ *     `pathLookup` is a yes/no gate rather than the path it found, so spawn's
+ *     own resolution — and, on Windows, exec.mjs's PATHEXT walk, since `claude`
+ *     there is `claude.exe` or `claude.cmd` and never the bare word — stays in
+ *     charge of the PATH case exactly as before.
+ *   - The absolute candidates are stat'ed only once PATH has come up empty, so
+ *     the common case costs one stat rather than a directory walk. Against what
+ *     follows it — a whole Claude Code process, and a browser sign-in a human
+ *     is walking through — that is not a cost worth naming.
+ *
+ * Pure, with the platform, environment, home directory and existence check all
+ * parameters, so the Windows branch is checkable from the platforms this repo
+ * is actually developed on. Exported for that test rather than for a caller
+ * (#383): the real callers are `currentIdentity` below and cswap-admin.mjs's
+ * own `claudeBin`, and both take it with no arguments, which is the real
+ * machine's answer.
+ */
+export function adminClaudeBin(platform = process.platform, env = process.env,
+                               home = homedir(), exists = existsSync) {
+  if (env.AGENTS_DECK_CLAUDE) return env.AGENTS_DECK_CLAUDE;
+  const sep = platform === "win32" ? "\\" : "/";
+  // process.env is case-insensitive on Windows; an injected plain object in a
+  // test is not, and %Path% is how the variable is actually spelled there.
+  const pathEnv = env.PATH ?? env.Path ?? env.path ?? "";
+  for (const c of claudeCliCandidates(platform, env, home)) {
+    if (c.includes(sep)) { if (exists(c)) return c; }
+    else if (pathLookup(c, platform, { pathEnv, exists })) return c;
+  }
+  // Nothing on PATH and nothing at any known install directory. The bare name
+  // is still the right last resort — POSIX `execvp` and cmd.exe's own search
+  // both deserve their turn at a layout no list here knows — and the ENOENT it
+  // produces is what failureText turns into the AGENTS_DECK_CLAUDE sentence.
+  return "claude";
+}
+
+/**
+ * Anthropic's own view of who is signed in. Null when it cannot be read.
+ *
+ * Exported for its test rather than for a caller (#383). Both callers are inside
+ * the login flow and neither can show what was parsed: `spawnLogin` keeps only
+ * `identity?.email` as the address to restore to, and `submitLoginCode` turns
+ * the whole thing into a pass/fail — a null there is the difference between a
+ * sign-in the deck accepts and one it reports as "signed in, but the claude CLI
+ * still reports nobody logged in". The success path, where the email read here
+ * is what matches the new credential to a cswap slot, is reachable only with a
+ * real signed-in CLI on the machine running the suite. See
+ * cswap-identity.test.ts.
+ */
+export async function currentIdentity() {
+  const r = await run(adminClaudeBin(), ["auth", "status", "--json"], { timeout: 20_000 });
+  if (!r.ok) return null;
+  try {
+    const j = JSON.parse(r.stdout);
+    return j?.loggedIn ? { email: j.email ?? "", orgId: j.orgId ?? "" } : null;
+  } catch {
+    return null;
+  }
+}

package/src/server/cswap-admin.mjs

@@ -14,16 +14,19 @@
 //
 // And `cswap add` takes no lock while assigning the next slot as max+1. Two
 // concurrent adds pick the same number and the second write silently drops the
-// first account's record. Nothing upstream prevents it, so every mutation here
-// goes through one mutex.
-import { AsyncLocalStorage } from "node:async_hooks";
+// first account's record. Nothing upstream prevents it, so every mutation that
+// touches the store goes through one mutex — the one in store-lock.mjs, which
+// lives outside this file precisely so that the writers in claude-accounts.mjs
+// and cswap-auto.mjs queue on the same lock rather than on one of their own.
 import { existsSync } from "node:fs";
 import { brotliCompressSync, brotliDecompressSync, constants as zlibConstants } from "node:zlib";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { looksMissing, pathLookup, run, runDetached, runInteractive } from "./exec.mjs";
-import { backupRoot, invalidateClaudeAccountsCache } from "./claude-accounts.mjs";
+import { backupRoot, invalidateClaudeAccountsCache, verdictNow } from "./claude-accounts.mjs";
+import { withStoreLock } from "./store-lock.mjs";
+import { adminClaudeBin, currentIdentity } from "./claude-identity.mjs";
 import { claudeCliCandidates } from "./claude-dir.mjs";
 import { cswapBin } from "./cswap-install.mjs";
 import { PRODUCT } from "./brand.mjs";
@@ -83,35 +86,12 @@ const SHARE_MAX_BYTES = 2 << 20;
 
 // ── serialization ────────────────────────────────────────────────────────────
 
-let _chain = Promise.resolve();
-
-// Whether the code running right now is itself the mutation holding the lock.
-// Async context rather than a plain boolean, which could not tell that apart
-// from another request that merely arrived while the lock was held — and would
-// wave that one through, which is the opposite of a mutex.
-const _holder = new AsyncLocalStorage();
-
-/**
- * One store mutation at a time.
- *
- * Not defence against another process — that would need claude-swap's own file
- * lock, which `add` does not take either. This is defence against ourselves:
- * two browser tabs, or a double-click, are enough to race a slot assignment.
- *
- * Re-entrant, because a mutation that reaches for the lock from inside one
- * would otherwise wait for itself forever: the chain cannot advance past the
- * outer link until it settles, and the outer link is blocked on this call. It
- * already has exclusive access, so it simply runs.
- */
-export function withStoreLock(fn) {
-  if (_holder.getStore()) return Promise.resolve().then(fn);
-  const held = () => _holder.run(true, fn);
-  const next = _chain.then(held, held);
-  // Keep the chain alive even when a link rejects, or every later mutation
-  // inherits the failure.
-  _chain = next.then(() => {}, () => {});
-  return next;
-}
+// Re-exported rather than defined here, and rather than left here for this
+// module's own callers to import from wherever. It IS the same function — one
+// module instance, one chain — and the tests that reach for it through this
+// module keep working, but the definition sits in store-lock.mjs so that the
+// writers outside this file can queue on it too. See #1039.
+export { withStoreLock };
 
 // ── shared helpers ───────────────────────────────────────────────────────────
 
@@ -124,74 +104,19 @@ export function withStoreLock(fn) {
 // the resolver. Reported from Windows on 2026-08-14.
 
 /**
- * Which `claude` the account surface runs: the configured one, else the first
- * candidate this machine actually has, else the bare name.
- *
- * WHY THIS IS NOT `AGENTS_DECK_CLAUDE ?? "claude"` ANY MORE (#570). That was
- * the whole of this module's resolution, and it feeds every child the accounts
- * panel starts — `claude auth status --json` for `currentIdentity`, and the
- * `claude auth login` whose output the sign-in dialog reads a link out of. On a
- * machine whose `claude` is at `~/.local/bin/claude` but whose deck was started
- * from something that never sourced a shell rc — a LaunchAgent, a systemd user
- * unit, pm2, a desktop shortcut — the bare name is an ENOENT, so the login
- * child is dead within milliseconds, the flow reports `no_url`, and the dialog
- * shows "the claude CLI could not be run: not on PATH. Set AGENTS_DECK_CLAUDE
- * to its full path." That sentence is a real remedy and it is why this was a
- * smaller bug than #553; it is still a request to spell out a path the deck had
- * already found for itself, because `hasClaudeInstalled()` stat'ed that exact
- * file at boot to decide this was a Claude machine, and since #553 the quota
- * panel beside this one runs the same binary without being told anything.
- *
- * SO IT READS THE SAME LIST, ON THE SAME TERMS #553 SETTLED ON. The list is
- * `claudeCliCandidates` in claude-dir.mjs, whose other two readers are
- * `hasClaudeInstalled()` — the boot question this module's whole surface hangs
- * off — and `quotaClaudeBin` in quota.mjs. This is the same question at a third
- * site, so nothing here is decided again:
- *
- *   - AGENTS_DECK_CLAUDE first, and it is the one thing that skips the list
- *     entirely. It is documented in the README as "full path to the `claude`
- *     CLI", it is what the failure message above tells people to set, and
- *     someone who set it has already been through this once — second-guessing
- *     them with a stat would be answering a question they have closed. An empty
- *     value reads as unset, the way `AGENTS_DECK_CSWAP` does in cswapBin.
- *   - Then the candidate list's own order, unchanged: PATH first on POSIX, the
- *     two known install directories first on Windows. Preferring a different
- *     copy would silently change which binary signs somebody in on every
- *     machine that has two, and a `claude auth login` that suddenly runs a
- *     different binary is a credential path, not a detail.
- *   - The bare name is only answered with when PATH actually holds it, and
- *     `pathLookup` is a yes/no gate rather than the path it found, so spawn's
- *     own resolution — and, on Windows, exec.mjs's PATHEXT walk, since `claude`
- *     there is `claude.exe` or `claude.cmd` and never the bare word — stays in
- *     charge of the PATH case exactly as before.
- *   - The absolute candidates are stat'ed only once PATH has come up empty, so
- *     the common case costs one stat rather than a directory walk. Against what
- *     follows it — a whole Claude Code process, and a browser sign-in a human
- *     is walking through — that is not a cost worth naming.
- *
- * Pure, with the platform, environment, home directory and existence check all
- * parameters, so the Windows branch is checkable from the platforms this repo
- * is actually developed on. Exported for that test rather than for a caller
- * (#383): `claudeBin` below is the only one, and it hands back the real
- * machine's answer.
+ * Which `claude` the account surface runs, and who it says is signed in.
+ *
+ * Both moved to claude-identity.mjs and are re-exported here, which is where
+ * every caller and every test already reaches for them. The move is not
+ * cosmetic: `currentIdentity` was the one thing claude-accounts.mjs imported
+ * from this file, and that import was the single edge closing the only static
+ * import cycle in src/server. Two concurrent dynamic imports entering that
+ * cycle were each handed the other module's half-built namespace — no exports
+ * on it at all — which is how the boot's stale-copy repair came to be wired to
+ * `undefined` on CI while every test passed. claude-identity.mjs imports only
+ * leaves, so it can be reached from either side without closing anything.
  */
-export function adminClaudeBin(platform = process.platform, env = process.env,
-                               home = homedir(), exists = existsSync) {
-  if (env.AGENTS_DECK_CLAUDE) return env.AGENTS_DECK_CLAUDE;
-  const sep = platform === "win32" ? "\\" : "/";
-  // process.env is case-insensitive on Windows; an injected plain object in a
-  // test is not, and %Path% is how the variable is actually spelled there.
-  const pathEnv = env.PATH ?? env.Path ?? env.path ?? "";
-  for (const c of claudeCliCandidates(platform, env, home)) {
-    if (c.includes(sep)) { if (exists(c)) return c; }
-    else if (pathLookup(c, platform, { pathEnv, exists })) return c;
-  }
-  // Nothing on PATH and nothing at any known install directory. The bare name
-  // is still the right last resort — POSIX `execvp` and cmd.exe's own search
-  // both deserve their turn at a layout no list here knows — and the ENOENT it
-  // produces is what failureText turns into the AGENTS_DECK_CLAUDE sentence.
-  return "claude";
-}
+export { adminClaudeBin, currentIdentity };
 
 async function claudeBin() {
   return adminClaudeBin();
@@ -230,29 +155,6 @@ export function newSlot(before, after) {
   return fresh.length === 1 ? fresh[0] : null;
 }
 
-/**
- * Anthropic's own view of who is signed in. Null when it cannot be read.
- *
- * Exported for its test rather than for a caller (#383). Both callers are inside
- * the login flow and neither can show what was parsed: `spawnLogin` keeps only
- * `identity?.email` as the address to restore to, and `submitLoginCode` turns
- * the whole thing into a pass/fail — a null there is the difference between a
- * sign-in the deck accepts and one it reports as "signed in, but the claude CLI
- * still reports nobody logged in". The success path, where the email read here
- * is what matches the new credential to a cswap slot, is reachable only with a
- * real signed-in CLI on the machine running the suite. See
- * cswap-identity.test.ts.
- */
-export async function currentIdentity() {
-  const r = await run(await claudeBin(), ["auth", "status", "--json"], { timeout: 20_000 });
-  if (!r.ok) return null;
-  try {
-    const j = JSON.parse(r.stdout);
-    return j?.loggedIn ? { email: j.email ?? "", orgId: j.orgId ?? "" } : null;
-  } catch {
-    return null;
-  }
-}
 
 // ── login ────────────────────────────────────────────────────────────────────
 
@@ -328,8 +230,27 @@ let _starting = null;
 
 export function loginState() {
   if (!_login) return { state: "idle" };
-  const { state, url, error, account, expiresAt } = _login;
-  return { state, url: url ?? null, error: error ?? null, account: account ?? null, expiresAt: expiresAt ?? null };
+  const { state, url, error, account, expiresAt, restore } = _login;
+  return {
+    state, url: url ?? null, error: error ?? null, account: account ?? null, expiresAt: expiresAt ?? null,
+    // The sign-in's OTHER outcome, and the one it used to drop (#951). `true`
+    // until a restore has actually been attempted, because every state before
+    // that — awaiting_url, awaiting_code, registering — has moved nothing that
+    // needs putting back, and a dialog polling this must not flash a warning
+    // through the middle of an ordinary sign-in.
+    ...restoreFields(restore),
+  };
+}
+
+/** The restore verdict, in the two fields a caller reads. Written once here so
+ *  the login route, the cancel result and the dialog's type cannot drift. */
+function restoreFields(restore) {
+  return {
+    restored: restore ? restore.restored : true,
+    activeAccount: restore && !restore.restored
+      ? { num: restore.activeNum, email: restore.activeEmail }
+      : null,
+  };
 }
 
 /**
@@ -628,7 +549,11 @@ async function registerSignedIn(flow, identity) {
     if (!add.ok) {
       flow.state = "failed";
       flow.error = addFailureText(add);
-      await restoreActive(flow.previousActive);
+      // Kept even on the branch that already failed: `cswap add` can fail
+      // having written a slot and moved the machine onto it, so this is the
+      // branch where the live login is MOST likely to have ended up somewhere
+      // the user did not choose.
+      flow.restore = await restoreActive(flow.previousActive);
       return { ok: false, reason: "add_failed", ...loginState() };
     }
 
@@ -638,7 +563,11 @@ async function registerSignedIn(flow, identity) {
     // credentials in place. That is a success with a different sentence.
     const num = slot ?? Object.keys(after.emails).find(k => after.emails[k] === identity.email) ?? null;
 
-    await restoreActive(flow.previousActive);
+    // Assigned, not discarded. `done` is still the right state — the account
+    // WAS added — but it is `done` with a qualification whenever this says the
+    // machine did not go back, and the dialog renders that qualification
+    // instead of "The account you were using is still active".
+    flow.restore = await restoreActive(flow.previousActive);
     invalidateClaudeAccountsCache();
     // Collect straight away, so the new row shows numbers instead of "never
     // collected" until the next poll — the same nudge seedFirstAccount uses.
@@ -720,21 +649,66 @@ export async function cancelLogin() {
   return withStoreLock(async () => {
     // The login may have completed before the cancel arrived, in which case the
     // live credentials already moved and putting them back is the point.
-    await restoreActive(flow.previousActive);
+    const restore = await restoreActive(flow.previousActive);
     invalidateClaudeAccountsCache();
     // A newer sign-in can have started while this waited its turn; clearing the
     // slot then would drop a live flow's handle instead of this dead one's.
     if (flow === _login) _login = null;
-    return { ok: true, ...loginState() };
+    // The verdict goes on the RESULT, not through loginState(): the line above
+    // has just cleared `_login`, so loginState() is `{state:"idle"}` here and
+    // would carry nothing. Escape is a real way to end up with the credentials
+    // moved — the sign-in may have completed before the cancel arrived, which
+    // is why this calls restoreActive at all — so the answer has to survive.
+    // …and LAST, so that on the rare path where a newer sign-in has already
+    // taken `_login`, this cancel still answers about the account IT moved
+    // rather than about the fresh flow's untouched one.
+    return { ok: true, ...loginState(), ...restoreFields(restore) };
   });
 }
 
-/** Put the account that was active before the login back in front. */
+/** Nothing to put back, or it is already back: the shape every caller reads. */
+const RESTORED = Object.freeze({ restored: true, activeNum: null, activeEmail: null, detail: null });
+
+/**
+ * Put the account that was active before the login back in front — and ANSWER
+ * whether it went back (#951).
+ *
+ * This used to return `undefined` on every path, under a `.catch(() => {})`
+ * that could not fire. `run` is resolve-only (exec.mjs), so a non-zero exit, a
+ * timeout and a binary that is not there all arrive as `{ok:false, …}` rather
+ * than as a rejection; the catch was guarding against an exception that does
+ * not exist, and the result it was attached to was not assigned to anything.
+ * So a `cswap switch` that failed — a dead refresh token for the old slot is
+ * the ordinary way, and `authTrouble` exists to name that state — left every
+ * caller walking on to `flow.state = "done"` with no way to tell.
+ *
+ * What that costs is not a missing log line. `cswap add` moves
+ * activeAccountNumber AND ~/.claude/.credentials.json onto the account it just
+ * created, so a restore that silently fails leaves every Claude Code session on
+ * the machine running as the account that was just added — the precise outcome
+ * `previousActive` is captured to prevent, reported to the user as an
+ * unqualified success.
+ *
+ * THE VERDICT COMES OFF THE STORE, NOT OFF THE EXIT STATUS. `newSlot` settles
+ * the neighbouring question the same way and says why: the store is the fact.
+ * A `cswap switch` that moved the account and then exited non-zero is not
+ * something to warn about, and exit 0 with nothing moved is — and only a
+ * re-read can tell those apart.
+ */
 async function restoreActive(num) {
-  if (num == null) return;
+  if (num == null) return RESTORED;
   const after = await readStore();
-  if (String(after.activeNum) === String(num)) return;
-  await run(await cswapBin(), ["switch", String(num)], { timeout: 30_000 }).catch(() => {});
+  if (String(after.activeNum) === String(num)) return RESTORED;
+  const r = await run(await cswapBin(), ["switch", String(num)], { timeout: 30_000 });
+  const now = await readStore();
+  if (String(now.activeNum) === String(num)) return RESTORED;
+  const active = now.activeNum == null ? null : String(now.activeNum);
+  return {
+    restored: false,
+    activeNum: active,
+    activeEmail: active == null ? null : (now.emails[active] ?? ""),
+    detail: failureText(r, "cswap switch", "the account could not be switched back"),
+  };
 }
 
 // ── share / import ───────────────────────────────────────────────────────────
@@ -1194,6 +1168,59 @@ export async function importAccount(blob, { force = false, only = null } = {}) {
   });
 }
 
+/**
+ * Put a peer's copy of one account into a slot that holds nothing — and decide
+ * that the slot holds nothing INSIDE the lock that then writes to it.
+ *
+ * THE PROMISE THIS KEEPS, and why it needed moving (#1040). A plain `cswap
+ * import` never touches a slot that is present: it adds what is missing and
+ * replaces only a row claude-swap has quarantined as refresh-token-dead, and is
+ * "never triggered by the live store's `no credentials` state". So the one case
+ * pairing exists for — an account this machine has no login for at all — was
+ * the one case a plain import would not repair, and repairing it means
+ * `--force`, which overwrites whatever is there.
+ *
+ * What makes that safe is the verdict: claude-swap, asked about THIS machine's
+ * store, saying the slot holds no credentials. Nothing a peer sends can make a
+ * slot say that. The verdict was already being asked for fresh rather than read
+ * from the ten-minute cache, under a comment that names the exact reason —
+ * "somebody who signed in two minutes ago still reads as `no_credentials`
+ * there, and acting on that would replace the login they had just created".
+ *
+ * But the freshness fix only shortened the window; it did not close it, because
+ * the read was outside the mutex and the write takes it. The queue in between
+ * is long: `registerSignedIn` holds the lock for `cswap add` (60 s), `cswap
+ * list` (60 s) and `restoreActive`'s `cswap switch` (30 s), so a forced import
+ * could sit for up to two and a half minutes holding a verdict taken before any
+ * of it — and then run, replacing the login that had just been created with a
+ * peer's older blob. Which is the sentence that comment wrote out.
+ *
+ * Re-reading inside the lock makes the check and the write one critical
+ * section, so the promise holds by construction rather than by timing.
+ * `importAccount` takes the same lock again and the lock is re-entrant, so the
+ * whole decision is one uninterrupted hold.
+ *
+ * Narrowed to the one account with `only`: a forced import of a whole bundle
+ * would rewrite every matching credential on this machine, and a fresh token
+ * replaced by a stale one is not recoverable from here.
+ */
+export async function fillEmptySlot(blob, { email, org } = {}) {
+  return withStoreLock(async () => {
+    // FIRST STATEMENT INSIDE THE LOCK. Anything awaited before this re-opens
+    // the window it exists to close.
+    const now = await verdictNow(email, org ?? "");
+    if (now !== "no_credentials") return { ok: false, why: "claude-swap kept the slot it already has" };
+
+    const forced = await importAccount(blob, { force: true, only: { email, org: org ?? "" } });
+    if (!forced?.ok) return { ok: false, why: forced?.reason ?? "import refused" };
+    // `added` counts `imported` alone, and a forced replace is `healed` — see
+    // landed, which is the difference between a repair and a repair reported as
+    // a failure.
+    if (!landed(forced.results)) return { ok: false, why: "claude-swap kept the slot it already has" };
+    return { ok: true, filled: true };
+  });
+}
+
 // ── the small edits ──────────────────────────────────────────────────────────
 
 // The exact question `cswap remove` asks. There is no --yes flag: assume_yes is