hammoc 1.8.4 → 1.9.0

package/packages/server/dist/services/accountStorageService.d.ts

@@ -5,7 +5,10 @@
  * accumulates its `claudeAiOauth` credential block here keyed by account email (or an
  * `account:<hash>` fallback when the email is unavailable — AC1a). Switching writes the
  * chosen account's credential back to the single-account `~/.claude/.credentials.json`
- * the CLI binary reads (it has no `--profile` flag — see Dev Notes › CLI Credential Path).
+ * the CLI binary reads (it has no `--profile` flag — see Dev Notes › CLI Credential Path),
+ * AND swaps the CLI's on-disk identity cache (`oauthAccount` in `~/.claude.json`) — the CLI
+ * reports the logged-in identity from that cache, not from the credential file, so a
+ * credential-only swap leaves every identity readout on the previous login.
  *
  * Follows the `preferencesService` JSON-file pattern (`~/.hammoc/*.json`) and the
  * `rateLimitProbeService` credential-read path. Token material never leaves this layer:
@@ -27,6 +30,7 @@ declare class AccountStorageService {
     private getDataDir;
     private getStorePath;
     private getCredentialsPath;
+    private getClaudeConfigPath;
     /** Read the store, returning an empty store when the file is absent/unreadable. */
     private readStore;
     /** Write the store as pretty JSON, then harden file permissions (AC13). */
@@ -80,14 +84,10 @@ declare class AccountStorageService {
         account: StoredAccount;
     } | null>;
     /**
-     * Switch the active account (AC9, AC10, AC11, AC12). Writes the stored credential to
-     * `~/.claude/.credentials.json` atomically (temp + rename) so concurrent CLI readers never
-     * see a partial file, then updates the active marker and `lastUsedAt`. Running CLI sessions
-     * are untouched — only NEW sessions pick up the switched credential (AC11).
-     *
-     * Expiry (AC12) is detected by `expiresAt < Date.now()` — NO custom OAuth refresh call in
-     * Phase 1 (Dev Notes › Token Refresh). When expired, the switch still completes and
-     * `reauthRequired` is true so the client can offer the BS-7 re-login flow.
+     * Switch the active account (AC9, AC10, AC11, AC12). If the stored access token is expired
+     * but a refresh token is available, automatically obtains a fresh access token via the OAuth
+     * token endpoint before writing the credential file. Falls back to reauthRequired when the
+     * refresh itself fails (e.g., refresh token revoked).
      */
     switchAccount(key: string): Promise<{
         switched: true;
@@ -105,6 +105,52 @@ declare class AccountStorageService {
      * email or no active account exists. Returns the (possibly new) active key.
      */
     backfillActiveEmail(email: string): Promise<string | null>;
+    /**
+     * Re-read the credential file and update the CURRENT active account's stored entry.
+     * The CLI binary refreshes the active token continuously (accessToken + possibly rotated
+     * refreshToken), but accounts.json still holds the snapshot from original login. This
+     * method syncs the store with the live file so the stored copy is always up-to-date
+     * before the credential file is overwritten by a switch or a new login.
+     */
+    private resnapshotActiveCredentialInStore;
+    /**
+     * Public convenience: re-snapshot the active credential AND persist immediately.
+     * Called before a login PTY overwrites the credential file with a new account.
+     */
+    resnapshotAndSave(): Promise<void>;
+    /**
+     * Exchange a refresh token for a fresh access token via the Claude OAuth endpoint.
+     * Returns the updated credential on success, or null on failure (caller falls back to
+     * reauthRequired). The returned credential preserves all original fields and only updates
+     * accessToken, expiresAt, and (if rotated) refreshToken — matching the CLI's own refresh logic.
+     */
+    private refreshCredential;
+    /**
+     * Read the CLI's cached identity block, or null when absent/unreadable. This is the value the
+     * CLI reports as the logged-in account (email/organization) on every launch — it is written at
+     * login (and on profile re-fetch), NOT derived from the credential file per launch.
+     */
+    readCliIdentity(): Promise<Record<string, unknown> | null>;
+    /**
+     * Patch ONLY the `oauthAccount` field of `~/.claude.json` (set when `identity` is given,
+     * delete when null), preserving every other field byte-for-value. Atomic write (temp +
+     * rename) so a concurrently launching CLI never reads a partial config. Best-effort:
+     * failures are logged and never block the credential switch itself. The config file is
+     * never CREATED here — a missing/corrupt file carries per-project state (trust prompts
+     * etc.) we must not fabricate, and the CLI regenerates identity on its own anyway.
+     */
+    writeCliIdentity(identity: Record<string, unknown> | null): Promise<boolean>;
+    /** Drop the CLI identity cache (logout: no login should be reported afterwards). */
+    clearCliIdentity(): Promise<void>;
+    /**
+     * Re-assert the ACTIVE account's identity into the CLI cache. Used as self-healing when a
+     * stale identity readout is detected (e.g. a CLI child that outlived a switch flushed its
+     * in-memory config back over our patch). Falls back to dropping the cache when the active
+     * account has no captured identity, so the CLI regenerates it from the live token.
+     */
+    reassertActiveCliIdentity(): Promise<void>;
+    /** Whether an active credential file with a usable token exists on disk. */
+    hasActiveCredential(): Promise<boolean>;
     /** Read & parse `~/.claude/.credentials.json` into a credential block, or null. */
     private readActiveCredential;
     /**

package/packages/server/dist/services/accountStorageService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accountStorageService.d.ts","sourceRoot":"","sources":["../../src/services/accountStorageService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,KAAK,EAEV,aAAa,EACb,cAAc,EACd,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAKxB,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAID,cAAM,qBAAqB;IACzB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,kBAAkB;IAI1B,mFAAmF;YACrE,SAAS;IAcvB,2EAA2E;YAC7D,UAAU;IAQxB;;;;;OAKG;YACW,qBAAqB;IAYnC,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA2BxB,iFAAiF;IACjF,OAAO,CAAC,WAAW;IAMnB,2EAA2E;IAC3E,OAAO,CAAC,SAAS;IAajB,2EAA2E;IACrE,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAO/C,2FAA2F;IACrF,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5C,uFAAuF;IACjF,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD;;;;;OAKG;IACG,aAAa,CACjB,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;IAmBnD;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAA;KAAE,CAAC;IAShG;;;;;;OAMG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,GAAG,IAAI,CAAC;IAa5G;;;;;;;;;OASG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CACrC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,GACnE;QAAE,QAAQ,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAC3C;IAiBD;;;;;;OAMG;IACG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBhE,mFAAmF;YACrE,oBAAoB;IAYlC;;;;OAIG;YACW,yBAAyB;CAgBxC;AAED,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}
+{"version":3,"file":"accountStorageService.d.ts","sourceRoot":"","sources":["../../src/services/accountStorageService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EAEV,aAAa,EACb,cAAc,EACd,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAUxB,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAID,cAAM,qBAAqB;IACzB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,mBAAmB;IAI3B,mFAAmF;YACrE,SAAS;IAcvB,2EAA2E;YAC7D,UAAU;IAQxB;;;;;OAKG;YACW,qBAAqB;IAYnC,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA+BxB,iFAAiF;IACjF,OAAO,CAAC,WAAW;IAMnB,2EAA2E;IAC3E,OAAO,CAAC,SAAS;IAajB,2EAA2E;IACrE,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAO/C,2FAA2F;IACrF,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5C,uFAAuF;IACjF,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD;;;;;OAKG;IACG,aAAa,CACjB,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;IAmBnD;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAA;KAAE,CAAC;IAShG;;;;;;OAMG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,GAAG,IAAI,CAAC;IA+B5G;;;;;OAKG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CACrC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,GACnE;QAAE,QAAQ,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAC3C;IAgDD;;;;;;OAMG;IACG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoBhE;;;;;;OAMG;YACW,iCAAiC;IAwB/C;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQxC;;;;;OAKG;YACW,iBAAiB;IA2D/B;;;;OAIG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAchE;;;;;;;OAOG;IACG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BlF,oFAAoF;IAC9E,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC;;;;;OAKG;IACG,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhD,4EAA4E;IACtE,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC;IAM7C,mFAAmF;YACrE,oBAAoB;IAYlC;;;;OAIG;YACW,yBAAyB;CAgBxC;AAED,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}

package/packages/server/dist/services/accountStorageService.js

@@ -5,7 +5,10 @@
  * accumulates its `claudeAiOauth` credential block here keyed by account email (or an
  * `account:<hash>` fallback when the email is unavailable — AC1a). Switching writes the
  * chosen account's credential back to the single-account `~/.claude/.credentials.json`
- * the CLI binary reads (it has no `--profile` flag — see Dev Notes › CLI Credential Path).
+ * the CLI binary reads (it has no `--profile` flag — see Dev Notes › CLI Credential Path),
+ * AND swaps the CLI's on-disk identity cache (`oauthAccount` in `~/.claude.json`) — the CLI
+ * reports the logged-in identity from that cache, not from the credential file, so a
+ * credential-only swap leaves every identity readout on the previous login.
  *
  * Follows the `preferencesService` JSON-file pattern (`~/.hammoc/*.json`) and the
  * `rateLimitProbeService` credential-read path. Token material never leaves this layer:
@@ -22,6 +25,10 @@ import { createHash } from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { createLogger } from '../utils/logger.js';
 const log = createLogger('accountStorageService');
+// Claude Code OAuth constants (extracted from the bundled SDK binary).
+const OAUTH_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+const OAUTH_REFRESH_TIMEOUT_MS = 10_000;
 const EMPTY_STORE = { activeKey: null, accounts: {} };
 class AccountStorageService {
     getDataDir() {
@@ -33,6 +40,9 @@ class AccountStorageService {
     getCredentialsPath() {
         return path.join(os.homedir(), '.claude', '.credentials.json');
     }
+    getClaudeConfigPath() {
+        return path.join(os.homedir(), '.claude.json');
+    }
     /** Read the store, returning an empty store when the file is absent/unreadable. */
     async readStore() {
         try {
@@ -84,7 +94,11 @@ class AccountStorageService {
                 return;
             }
             try {
-                const child = spawn('icacls', [filePath, '/inheritance:r', '/grant:r', `${user}:F`], {
+                // Use the absolute path: the server's PATH may not include System32, so a bare `icacls`
+                // spawn fails with ENOENT and silently skips the hardening (observed on this host).
+                const systemRoot = process.env.SystemRoot || process.env.windir || 'C:\\Windows';
+                const icaclsPath = path.join(systemRoot, 'System32', 'icacls.exe');
+                const child = spawn(icaclsPath, [filePath, '/inheritance:r', '/grant:r', `${user}:F`], {
                     windowsHide: true,
                 });
                 child.on('error', (err) => {
@@ -189,30 +203,74 @@ class AccountStorageService {
         const tier = credential.claudeAiOauth?.subscriptionType ?? null;
         const result = await this.upsertAccount(credential, { email, tier });
         await this.setActiveKey(result.key);
+        // The login PTY also rewrote the CLI's identity cache (`oauthAccount` in `~/.claude.json`).
+        // Capture it alongside the credential — a later switch back to this account must restore it,
+        // or the CLI keeps reporting the identity of whoever logged in last. Only attach when the
+        // cached identity provably belongs to this login (emailAddress match): the config write and
+        // the credential write are separate steps in the CLI, so an unmatched value could still be
+        // the previous account's.
+        if (email) {
+            const identity = await this.readCliIdentity();
+            if (identity && identity.emailAddress === email) {
+                const store = await this.readStore();
+                const entry = store.accounts[result.key];
+                if (entry) {
+                    entry.identity = identity;
+                    await this.writeStore(store);
+                    result.account.identity = identity;
+                }
+            }
+        }
         log.info(`captured credential for account key=${result.key} (tier=${tier ?? 'unknown'})`);
         return result;
     }
     /**
-     * Switch the active account (AC9, AC10, AC11, AC12). Writes the stored credential to
-     * `~/.claude/.credentials.json` atomically (temp + rename) so concurrent CLI readers never
-     * see a partial file, then updates the active marker and `lastUsedAt`. Running CLI sessions
-     * are untouched — only NEW sessions pick up the switched credential (AC11).
-     *
-     * Expiry (AC12) is detected by `expiresAt < Date.now()` — NO custom OAuth refresh call in
-     * Phase 1 (Dev Notes › Token Refresh). When expired, the switch still completes and
-     * `reauthRequired` is true so the client can offer the BS-7 re-login flow.
+     * Switch the active account (AC9, AC10, AC11, AC12). If the stored access token is expired
+     * but a refresh token is available, automatically obtains a fresh access token via the OAuth
+     * token endpoint before writing the credential file. Falls back to reauthRequired when the
+     * refresh itself fails (e.g., refresh token revoked).
      */
     async switchAccount(key) {
         const store = await this.readStore();
         const account = store.accounts[key];
         if (!account)
             return { switched: false, reason: 'not-found' };
+        // Before overwriting the credential file, snapshot the CURRENT active credential back into
+        // the store. The CLI binary continuously refreshes the active token (new accessToken +
+        // potentially rotated refreshToken), but accounts.json still holds the copy from the
+        // original login. Without this, switching away from A and then back writes the stale original
+        // token — whose refreshToken may have been rotated and revoked.
+        await this.resnapshotActiveCredentialInStore(store);
+        const expiresAt = account.credential.claudeAiOauth?.expiresAt;
+        const expired = typeof expiresAt === 'number' && expiresAt < Date.now();
+        let reauthRequired = false;
+        if (expired) {
+            const refreshed = await this.refreshCredential(account.credential);
+            if (refreshed) {
+                account.credential = refreshed;
+                account.tier = refreshed.claudeAiOauth?.subscriptionType ?? account.tier;
+                log.info(`refreshed expired token for account key=${key}`);
+            }
+            else {
+                reauthRequired = true;
+            }
+        }
         await this.writeCredentialFileAtomic(account.credential);
+        // Swap the CLI's identity cache together with the credential. The CLI reports "who is
+        // logged in" from `oauthAccount` in `~/.claude.json` (verified: a fresh bootstrap after a
+        // credential-only swap still returns the previous login), so leaving it behind makes every
+        // subsequent identity readout — settings card refresh, session-context email — show the old
+        // account. With no captured identity, drop the field: the CLI re-fetches the profile from
+        // the API on its next launch and rewrites the cache for the live token (verified).
+        if (account.identity) {
+            await this.writeCliIdentity(account.identity);
+        }
+        else {
+            await this.writeCliIdentity(null);
+        }
         account.lastUsedAt = Date.now();
         store.activeKey = key;
         await this.writeStore(store);
-        const expiresAt = account.credential.claudeAiOauth?.expiresAt;
-        const reauthRequired = typeof expiresAt === 'number' && expiresAt < Date.now();
         return { switched: true, reauthRequired, account };
     }
     /**
@@ -243,6 +301,180 @@ class AccountStorageService {
         log.info(`back-filled email for account: ${oldKey} → ${email}`);
         return store.activeKey;
     }
+    /**
+     * Re-read the credential file and update the CURRENT active account's stored entry.
+     * The CLI binary refreshes the active token continuously (accessToken + possibly rotated
+     * refreshToken), but accounts.json still holds the snapshot from original login. This
+     * method syncs the store with the live file so the stored copy is always up-to-date
+     * before the credential file is overwritten by a switch or a new login.
+     */
+    async resnapshotActiveCredentialInStore(store) {
+        const currentKey = store.activeKey;
+        if (!currentKey)
+            return;
+        const currentAccount = store.accounts[currentKey];
+        if (!currentAccount)
+            return;
+        const live = await this.readActiveCredential();
+        if (!live)
+            return;
+        currentAccount.credential = live;
+        const tier = live.claudeAiOauth?.subscriptionType;
+        if (tier)
+            currentAccount.tier = tier;
+        // Also re-snapshot the CLI identity cache when it belongs to this account. This is how
+        // legacy entries (captured before the identity field existed) converge: once the CLI has
+        // regenerated `oauthAccount` for this account, switching away stores it, and every later
+        // switch back can restore it directly instead of relying on regeneration.
+        const identity = await this.readCliIdentity();
+        if (identity && currentAccount.email && identity.emailAddress === currentAccount.email) {
+            currentAccount.identity = identity;
+        }
+        // No writeStore here — the caller (switchAccount) writes after updating the target too.
+    }
+    /**
+     * Public convenience: re-snapshot the active credential AND persist immediately.
+     * Called before a login PTY overwrites the credential file with a new account.
+     */
+    async resnapshotAndSave() {
+        const store = await this.readStore();
+        await this.resnapshotActiveCredentialInStore(store);
+        await this.writeStore(store);
+    }
+    // ── OAuth token refresh ──
+    /**
+     * Exchange a refresh token for a fresh access token via the Claude OAuth endpoint.
+     * Returns the updated credential on success, or null on failure (caller falls back to
+     * reauthRequired). The returned credential preserves all original fields and only updates
+     * accessToken, expiresAt, and (if rotated) refreshToken — matching the CLI's own refresh logic.
+     */
+    async refreshCredential(credential) {
+        const oauth = credential.claudeAiOauth;
+        const refreshToken = oauth?.refreshToken;
+        if (!refreshToken) {
+            log.warn('refreshCredential: no refresh_token available');
+            return null;
+        }
+        try {
+            const res = await fetch(OAUTH_TOKEN_URL, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'anthropic-beta': 'oauth-2025-04-20',
+                },
+                body: JSON.stringify({
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                    client_id: OAUTH_CLIENT_ID,
+                }),
+                signal: AbortSignal.timeout(OAUTH_REFRESH_TIMEOUT_MS),
+            });
+            if (!res.ok) {
+                const body = await res.text().catch(() => '');
+                log.warn(`refreshCredential: token endpoint returned ${res.status}: ${body.slice(0, 200)}`);
+                return null;
+            }
+            const data = await res.json();
+            if (!data.access_token) {
+                log.warn('refreshCredential: response missing access_token');
+                return null;
+            }
+            const expiresAt = typeof data.expires_in === 'number'
+                ? Date.now() + data.expires_in * 1000
+                : undefined;
+            return {
+                claudeAiOauth: {
+                    ...oauth,
+                    accessToken: data.access_token,
+                    refreshToken: data.refresh_token || refreshToken,
+                    ...(expiresAt !== undefined ? { expiresAt } : {}),
+                },
+            };
+        }
+        catch (err) {
+            log.warn(`refreshCredential: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+    }
+    // ── CLI identity cache I/O (`oauthAccount` in `~/.claude.json`) ──
+    /**
+     * Read the CLI's cached identity block, or null when absent/unreadable. This is the value the
+     * CLI reports as the logged-in account (email/organization) on every launch — it is written at
+     * login (and on profile re-fetch), NOT derived from the credential file per launch.
+     */
+    async readCliIdentity() {
+        try {
+            const raw = await fs.readFile(this.getClaudeConfigPath(), 'utf-8');
+            const config = JSON.parse(raw);
+            const identity = config.oauthAccount;
+            if (identity && typeof identity === 'object' && !Array.isArray(identity)) {
+                return identity;
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Patch ONLY the `oauthAccount` field of `~/.claude.json` (set when `identity` is given,
+     * delete when null), preserving every other field byte-for-value. Atomic write (temp +
+     * rename) so a concurrently launching CLI never reads a partial config. Best-effort:
+     * failures are logged and never block the credential switch itself. The config file is
+     * never CREATED here — a missing/corrupt file carries per-project state (trust prompts
+     * etc.) we must not fabricate, and the CLI regenerates identity on its own anyway.
+     */
+    async writeCliIdentity(identity) {
+        const configPath = this.getClaudeConfigPath();
+        try {
+            const raw = await fs.readFile(configPath, 'utf-8');
+            const config = JSON.parse(raw);
+            if (identity) {
+                config.oauthAccount = identity;
+            }
+            else {
+                delete config.oauthAccount;
+            }
+            const tmp = `${configPath}.tmp-${process.pid}`;
+            await fs.writeFile(tmp, JSON.stringify(config, null, 2), 'utf-8');
+            try {
+                await fs.rename(tmp, configPath);
+            }
+            catch (err) {
+                await fs.rm(tmp, { force: true }).catch(() => { });
+                throw err;
+            }
+            log.info(identity
+                ? `CLI identity cache set to ${String(identity.emailAddress ?? '(no email)')}`
+                : 'CLI identity cache dropped (CLI will re-derive from the live token)');
+            return true;
+        }
+        catch (err) {
+            log.warn(`writeCliIdentity failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
+    /** Drop the CLI identity cache (logout: no login should be reported afterwards). */
+    async clearCliIdentity() {
+        await this.writeCliIdentity(null);
+    }
+    /**
+     * Re-assert the ACTIVE account's identity into the CLI cache. Used as self-healing when a
+     * stale identity readout is detected (e.g. a CLI child that outlived a switch flushed its
+     * in-memory config back over our patch). Falls back to dropping the cache when the active
+     * account has no captured identity, so the CLI regenerates it from the live token.
+     */
+    async reassertActiveCliIdentity() {
+        const store = await this.readStore();
+        const active = store.activeKey ? store.accounts[store.activeKey] : null;
+        if (!active)
+            return;
+        await this.writeCliIdentity(active.identity ?? null);
+    }
+    /** Whether an active credential file with a usable token exists on disk. */
+    async hasActiveCredential() {
+        return (await this.readActiveCredential()) !== null;
+    }
     // ── Credential file I/O ──
     /** Read & parse `~/.claude/.credentials.json` into a credential block, or null. */
     async readActiveCredential() {

package/packages/server/dist/services/accountStorageService.js.map

@@ -1 +1 @@
-{"version":3,"file":"accountStorageService.js","sourceRoot":"","sources":["../../src/services/accountStorageService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAO3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAUlD,MAAM,WAAW,GAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAErE,MAAM,qBAAqB;IACjB,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC;IAEO,kBAAkB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjE,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YACpD,0EAA0E;YAC1E,OAAO;gBACL,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;gBACzE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aACxF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,UAAU,CAAC,KAAoB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,yBAAyB,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,gBAAgB,CAAC,QAAgB;QACvC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;gBACtE,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE;oBACnF,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACxB,GAAG,CAAC,IAAI,CAAC,+BAA+B,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpE,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBACxB,IAAI,IAAI,KAAK,CAAC;wBAAE,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,QAAQ,QAAQ,EAAE,CAAC,CAAC;oBAC5E,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,2BAA2B,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrG,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,WAAW,CAAC,UAAiC;QACnD,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,EAAE,WAAW,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,WAAW,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2EAA2E;IACnE,SAAS,CAAC,GAAW,EAAE,OAAsB,EAAE,SAAwB;QAC7E,OAAO;YACL,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,GAAG,KAAK,SAAS;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,mBAAmB;IAEnB,2EAA2E;IAC3E,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAC3D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,YAAY;QAChB,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,YAAY,CAAC,GAAkB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,UAAiC,EACjC,IAAuB;QAEvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;SACpD,CAAC;QACF,uFAAuF;QACvF,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;QAC9B,KAAK,QAAQ,CAAC,CAAC,2CAA2C;QAC1D,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAAoB;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,EAAE,gBAAgB,IAAI,IAAI,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAI7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAE9D,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEzD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC;QAC9D,MAAM,cAAc,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE/E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,8CAA8C;QAE5F,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,OAAO,OAAO,CAAC,kBAAkB,CAAC;QAClC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;YAChC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IAED,4BAA4B;IAE5B,mFAAmF;IAC3E,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CAAC,UAAiC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,uFAAuF;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"accountStorageService.js","sourceRoot":"","sources":["../../src/services/accountStorageService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAO3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAElD,uEAAuE;AACvE,MAAM,eAAe,GAAG,4CAA4C,CAAC;AACrE,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAC/D,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAUxC,MAAM,WAAW,GAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAErE,MAAM,qBAAqB;IACjB,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC;IAEO,kBAAkB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjE,CAAC;IAEO,mBAAmB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACjD,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;YACpD,0EAA0E;YAC1E,OAAO;gBACL,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;gBACzE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aACxF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,UAAU,CAAC,KAAoB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,yBAAyB,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,gBAAgB,CAAC,QAAgB;QACvC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;gBACtE,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,wFAAwF;gBACxF,oFAAoF;gBACpF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;gBACjF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE;oBACrF,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACxB,GAAG,CAAC,IAAI,CAAC,+BAA+B,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpE,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBACxB,IAAI,IAAI,KAAK,CAAC;wBAAE,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,QAAQ,QAAQ,EAAE,CAAC,CAAC;oBAC5E,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,2BAA2B,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrG,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,WAAW,CAAC,UAAiC;QACnD,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,EAAE,WAAW,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,WAAW,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2EAA2E;IACnE,SAAS,CAAC,GAAW,EAAE,OAAsB,EAAE,SAAwB;QAC7E,OAAO;YACL,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,GAAG,KAAK,SAAS;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,mBAAmB;IAEnB,2EAA2E;IAC3E,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAC3D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,YAAY;QAChB,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,YAAY,CAAC,GAAkB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,UAAiC,EACjC,IAAuB;QAEvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;SACpD,CAAC;QACF,uFAAuF;QACvF,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;QAC9B,KAAK,QAAQ,CAAC,CAAC,2CAA2C;QAC1D,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAAoB;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,EAAE,gBAAgB,IAAI,IAAI,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,4FAA4F;QAC5F,2FAA2F;QAC3F,0BAA0B;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;oBAC1B,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAC7B,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAI7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAE9D,2FAA2F;QAC3F,uFAAuF;QACvF,qFAAqF;QACrF,8FAA8F;QAC9F,gEAAgE;QAChE,MAAM,IAAI,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC;QAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC;QAC9D,MAAM,OAAO,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxE,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACnE,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC/B,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,aAAa,EAAE,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;gBACzE,GAAG,CAAC,IAAI,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEzD,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,4FAA4F;QAC5F,0FAA0F;QAC1F,mFAAmF;QACnF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,8CAA8C;QAE5F,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,OAAO,OAAO,CAAC,kBAAkB,CAAC;QAClC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;YAChC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iCAAiC,CAAC,KAAoB;QAClE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,cAAc,CAAC,UAAU,GAAG,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC;QAClD,IAAI,IAAI;YAAE,cAAc,CAAC,IAAI,GAAG,IAAI,CAAC;QAErC,uFAAuF;QACvF,yFAAyF;QACzF,yFAAyF;QACzF,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,IAAI,QAAQ,IAAI,cAAc,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC;YACvF,cAAc,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACrC,CAAC;QACD,wFAAwF;IAC1F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,4BAA4B;IAE5B;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,UAAiC;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC;QACvC,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAC;QACzC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,kBAAkB;iBACrC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,YAAY;oBAC3B,SAAS,EAAE,eAAe;iBAC3B,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;aACtD,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAI1B,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;gBACnD,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,SAAS,CAAC;YAEd,OAAO;gBACL,aAAa,EAAE;oBACb,GAAG,KAAK;oBACR,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;oBAChD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,oEAAoE;IAEpE;;;;OAIG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC;YACrC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzE,OAAO,QAAmC,CAAC;YAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,QAAwC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,CAAC,YAAY,CAAC;YAC7B,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAClD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,QAAQ;gBACf,CAAC,CAAC,6BAA6B,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,YAAY,CAAC,EAAE;gBAC9E,CAAC,CAAC,qEAAqE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,gBAAgB;QACpB,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,yBAAyB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,mBAAmB;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC,KAAK,IAAI,CAAC;IACtD,CAAC;IAED,4BAA4B;IAE5B,mFAAmF;IAC3E,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CAAC,UAAiC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,uFAAuF;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/packages/server/dist/services/chatEngine.d.ts

@@ -12,9 +12,14 @@ import type { BackgroundTaskTracker } from '../utils/backgroundTaskTracker.js';
  *
  * This interface intentionally contains only the members the two call sites actually
  * invoke on the engine instance (verified by grep, see Story 32.2 "외부 표면
- * enumeration"). Abort is *not* a member: cancellation flows through
- * `ChatOptions.abortController` (an engine-independent signal), so no `interrupt()`
- * is needed here.
+ * enumeration"). A hard *abort* (kill the whole turn/process) flows through
+ * `ChatOptions.abortController` (an engine-independent signal) — the CLI engine wires
+ * it to a PTY Ctrl+C. Story 38.3 adds an OPTIONAL, engine-specific `interrupt()`
+ * (stop only the current turn's generation, keep the persistent session alive) and
+ * `close()` (explicit session teardown). These are OPTIONAL: only the SDK engine — whose
+ * persistent stream (Epic 38) keeps a control channel open across the result — exposes
+ * them; the CLI engine cancels via the abortController signal instead, so it does not
+ * implement them and callers must feature-detect (`engine.interrupt?.()`).
  *
  * It lives server-side (not in `@hammoc/shared`) because `canUseTool` is typed with
  * the SDK's `CanUseTool`; shared must stay SDK-independent. The server already
@@ -26,6 +31,16 @@ import type { BackgroundTaskTracker } from '../utils/backgroundTaskTracker.js';
 export interface ChatEngine {
     /** Warning message from a non-fatal rewind failure; read by the caller after a send. */
     rewindWarning: string | null;
+    /**
+     * Whether the LAST turn ended via tracker-hold grace EXPIRY (SDK engine's
+     * dual-gate turn boundary, 2026-07-12). The expiry path abandons a parked read
+     * on the engine's shared session iterator — a resident engine kept alive past
+     * that would deliver the NEXT turn's first message to the dead read (message
+     * theft) and could run a late follow-up invisibly. The residency
+     * reconciliation reads this after a send and evicts the engine when set.
+     * Optional: the CLI engine never sets it (no shared-iterator turns).
+     */
+    lastTurnTrackerHoldExpired?: boolean;
     /**
      * Send a message and stream events back through the provided callbacks.
      * Cancellation is delivered via `options.abortController`.
@@ -61,10 +76,51 @@ export interface ChatEngine {
     backgroundTracker?: BackgroundTaskTracker, 
     /** Notification when CLI engine syncs permission mode (EnterPlanMode in sync mode). */
     onPermissionModeSync?: (mode: PermissionMode) => void): Promise<ChatResponse>;
+    /**
+     * Story 38.3 — turn-only interrupt: stop the CURRENT turn's generation but keep
+     * the persistent session/generator alive (a subsequent send resumes on the same
+     * stream). SDK engine only; the CLI engine omits this and cancels via the
+     * abortController signal, so callers MUST feature-detect (`engine.interrupt?.()`).
+     * The interrupted turn ends with an error result rather than a thrown abort.
+     */
+    interrupt?(): Promise<void>;
+    /**
+     * Story 38.3 — explicit session teardown (the "abort" verb): end the prompt queue
+     * and close the persistent query. SDK engine only; idempotent. The CLI engine omits
+     * this (its teardown runs off the abortController signal). Higher-level session
+     * lifecycle (idle residency, resume/fork) is Story 38.5.
+     */
+    close?(): Promise<void>;
     /** Update the permission mode mid-conversation (propagates to the live query). */
     setPermissionMode(mode: PermissionMode): Promise<void>;
+    /**
+     * Story 38.4 — runtime model switch: change the model used for subsequent
+     * responses on the LIVE persistent query, without recreating it (no ~3s
+     * process restart). OPTIONAL, same pattern as `interrupt?()`/`close?()`: only
+     * the SDK engine — whose persistent stream keeps the control channel open —
+     * implements it (probe-confirmed GO: the next turn answers with the new
+     * model). The CLI engine omits it (model changes ride the next spawn payload),
+     * so callers MUST feature-detect (`engine.setModel?.()`). No-op before the
+     * first send (the model is then picked up from the creation options instead).
+     */
+    setModel?(model: string | undefined): Promise<void>;
     /** Read the current permission mode (used by permission-gating call-site logic). */
     getPermissionMode(): PermissionMode;
+    /**
+     * Story 38.5 (Task 2) — opt this engine into cross-turn process residency. When
+     * set, the engine does NOT tear its persistent stream down at turn end; the
+     * residency registry owns its lifecycle (idle timeout / LRU eviction / crash
+     * cleanup). OPTIONAL, SDK-engine-only (same feature-detect pattern as
+     * `interrupt?()`/`close?()`/`setModel?()`); the CLI engine omits it.
+     */
+    setResident?(resident: boolean): void;
+    /**
+     * Story 38.5 (Task 2) — whether a persistent query is currently live. The
+     * residency registry reads this to detect an engine that was torn down out of
+     * band (crash / external close) so it can evict the dead entry and let the next
+     * send resume from JSONL. OPTIONAL, SDK-engine-only.
+     */
+    isLive?(): boolean;
     /**
      * Standalone file rewind (no message send): rewind project files to the
      * checkpoint at `messageUuid` for `sessionId`. `dryRun` previews without writing.

package/packages/server/dist/services/chatEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chatEngine.d.ts","sourceRoot":"","sources":["../../src/services/chatEngine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;;;;;OASG;IACH,wBAAwB,CACtB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,eAAe,EAC1B,OAAO,CAAC,EAAE,WAAW,EACrB,UAAU,CAAC,EAAE,UAAU,EACvB,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,EAC5C,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI;IACzG;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,KAAK,IAAI;IACxE;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IACvC,qGAAqG;IACrG,qBAAqB,CAAC,EAAE,MAAM;IAC9B,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,qBAAqB;IACzC,uFAAuF;IACvF,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GACpD,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB,kFAAkF;IAClF,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,oFAAoF;IACpF,iBAAiB,IAAI,cAAc,CAAC;IAEpC;;;;;;OAMG;IACH,WAAW,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/G"}
+{"version":3,"file":"chatEngine.d.ts","sourceRoot":"","sources":["../../src/services/chatEngine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC;;;;;;;;;OASG;IACH,wBAAwB,CACtB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,eAAe,EAC1B,OAAO,CAAC,EAAE,WAAW,EACrB,UAAU,CAAC,EAAE,UAAU,EACvB,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,EAC5C,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI;IACzG;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,KAAK,IAAI;IACxE;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IACvC,qGAAqG;IACrG,qBAAqB,CAAC,EAAE,MAAM;IAC9B,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,qBAAqB;IACzC,uFAAuF;IACvF,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GACpD,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;OAKG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB,kFAAkF;IAClF,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;;;;;;OASG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD,oFAAoF;IACpF,iBAAiB,IAAI,cAAc,CAAC;IAEpC;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IAEtC;;;;;OAKG;IACH,MAAM,CAAC,IAAI,OAAO,CAAC;IAEnB;;;;;;OAMG;IACH,WAAW,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/G"}