oc-codex-multi-auth 6.0.0 → 6.1.1

package/dist/lib/storage/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../lib/storage/migrations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,eAAe,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;IACzD,mBAAmB,CAAC,EAAE,gBAAgB,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAMD,wBAAgB,aAAa,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAoCpE"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../lib/storage/migrations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,eAAe,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACxC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAOhD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYxD;AAED,MAAM,WAAW,gBAAgB;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;IACzD,mBAAmB,CAAC,EAAE,gBAAgB,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAMD,wBAAgB,aAAa,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAoCpE"}

package/dist/lib/storage/migrations.js

@@ -3,6 +3,43 @@
  * Extracted from storage.ts to reduce module size.
  */
 import { MODEL_FAMILIES } from "../prompts/codex.js";
+/**
+ * StorageError code emitted when a `version: 2` account file is loaded.
+ *
+ * V2 is an intermediate account schema produced by legacy 4.x plugin builds
+ * that never shipped with a documented shape nor a forward-migrator to V3.
+ * The safe behaviour is to refuse to load V2 explicitly so the user's
+ * credentials are not silently discarded; callers surface this code to the
+ * user alongside a recovery hint.
+ */
+export const UNKNOWN_V2_FORMAT_CODE = "UNKNOWN_V2_FORMAT";
+/**
+ * Diagnostic message shown when the loader refuses a V2 storage file.
+ * Pulled into a helper so storage.ts, import paths, and tests produce
+ * identical copy without drifting.
+ */
+export function buildV2RejectionMessage() {
+    return ("Unsupported account storage schema version 2; this plugin only ships " +
+        "migrations for v1 and v3. V2 files were produced by an intermediate " +
+        "4.x build that never documented its shape, so migrating blindly would " +
+        "risk silent account corruption.");
+}
+/**
+ * Recovery hint shown alongside the V2 rejection message.
+ * @param path - Absolute path of the offending storage file, or a placeholder
+ *   when the caller cannot determine the source (e.g. in-memory normalization).
+ */
+export function buildV2RecoveryHint(path) {
+    const resolvedPath = path || "<unknown>";
+    return (`The storage file at ${resolvedPath} uses account schema v2, which ` +
+        "this plugin cannot migrate automatically. To recover: " +
+        "(1) back up the file outside the .opencode directory, " +
+        "(2) remove or rename the original so the plugin can start fresh, " +
+        "(3) run `opencode auth login` to create a v3 account pool, then " +
+        "(4) if you need the old credentials, open each account manually or " +
+        "re-run login per account. If you believe this file was produced by " +
+        "the current plugin, please open an issue so V2 can be documented.");
+}
 function nowMs() {
     return Date.now();
 }

package/dist/lib/storage/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../lib/storage/migrations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAoB,MAAM,qBAAqB,CAAC;AAkEvE,SAAS,KAAK;IACb,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAoB;IACjD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,OAAO;QACN,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,mBAAmB,GAAqB,EAAE,CAAC;YACjD,IAAI,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,IAAI,OAAO,CAAC,kBAAkB,GAAG,GAAG,EAAE,CAAC;gBACxF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;oBACrC,mBAAmB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;gBAC1D,CAAC;YACF,CAAC;YACD,OAAO;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;gBAClG,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;aACtC,CAAC;QACH,CAAC,CAAC;QACF,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,mBAAmB,EAAE,MAAM,CAAC,WAAW,CACtC,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAChB;KACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../lib/storage/migrations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAoB,MAAM,qBAAqB,CAAC;AAKvE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAgB1D;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACtC,OAAO,CACN,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,iCAAiC,CACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC/C,MAAM,YAAY,GAAG,IAAI,IAAI,WAAW,CAAC;IACzC,OAAO,CACN,uBAAuB,YAAY,iCAAiC;QACpE,wDAAwD;QACxD,wDAAwD;QACxD,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE,CACnE,CAAC;AACH,CAAC;AA+DD,SAAS,KAAK;IACb,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAoB;IACjD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,OAAO;QACN,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,mBAAmB,GAAqB,EAAE,CAAC;YACjD,IAAI,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,IAAI,OAAO,CAAC,kBAAkB,GAAG,GAAG,EAAE,CAAC;gBACxF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;oBACrC,mBAAmB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;gBAC1D,CAAC;YACF,CAAC;YACD,OAAO;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;gBAClG,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;aACtC,CAAC;QACH,CAAC,CAAC;QACF,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,mBAAmB,EAAE,MAAM,CAAC,WAAW,CACtC,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAChB;KACzC,CAAC;AACH,CAAC"}

package/dist/lib/storage/normalize.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Schema normalization, forward-compat guard, and V2 detection for account
+ * storage files.
+ *
+ * Split out of `lib/storage.ts` in RC-2. This module does not touch disk: it
+ * takes already-parsed JSON and returns a canonical `AccountStorageV3` (or
+ * throws a typed `StorageError` for schemas we can't safely read).
+ */
+import { type AccountStorageV3 } from "./migrations.js";
+/**
+ * Normalizes and validates account storage data, migrating from v1 to v3 if needed.
+ * Handles deduplication, index clamping, and per-family active index mapping.
+ * @param data - Raw storage data (unknown format)
+ * @param sourcePath - Optional origin path used for error diagnostics
+ * @returns Normalized AccountStorageV3 or null if invalid
+ * @throws StorageError (code `UNSUPPORTED_SCHEMA_VERSION`) when `data.version`
+ *   is a finite number greater than the newest format this plugin understands.
+ *   Throwing prevents a downgraded plugin from silently discarding future
+ *   schemas that still contain valid credentials.
+ */
+export declare function normalizeAccountStorage(data: unknown, sourcePath?: string): AccountStorageV3 | null;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/lib/storage/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../lib/storage/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,OAAO,EAOL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAMzB;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,MAAM,GAClB,gBAAgB,GAAG,IAAI,CAwHzB"}

package/dist/lib/storage/normalize.js

@@ -0,0 +1,114 @@
+/**
+ * Schema normalization, forward-compat guard, and V2 detection for account
+ * storage files.
+ *
+ * Split out of `lib/storage.ts` in RC-2. This module does not touch disk: it
+ * takes already-parsed JSON and returns a canonical `AccountStorageV3` (or
+ * throws a typed `StorageError` for schemas we can't safely read).
+ */
+import { createLogger } from "../logger.js";
+import { MODEL_FAMILIES } from "../prompts/codex.js";
+import { AccountStorageV2DetectionSchema } from "../schemas.js";
+import { StorageError } from "./errors.js";
+import { clampIndex, deduplicateAccountsForStorage, extractActiveKeys, findAccountIndexByIdentityKeys, isRecord, } from "./identity.js";
+import { buildV2RecoveryHint, buildV2RejectionMessage, migrateV1ToV3, UNKNOWN_V2_FORMAT_CODE, } from "./migrations.js";
+const log = createLogger("storage");
+/**
+ * Normalizes and validates account storage data, migrating from v1 to v3 if needed.
+ * Handles deduplication, index clamping, and per-family active index mapping.
+ * @param data - Raw storage data (unknown format)
+ * @param sourcePath - Optional origin path used for error diagnostics
+ * @returns Normalized AccountStorageV3 or null if invalid
+ * @throws StorageError (code `UNSUPPORTED_SCHEMA_VERSION`) when `data.version`
+ *   is a finite number greater than the newest format this plugin understands.
+ *   Throwing prevents a downgraded plugin from silently discarding future
+ *   schemas that still contain valid credentials.
+ */
+export function normalizeAccountStorage(data, sourcePath) {
+    if (!isRecord(data)) {
+        log.warn("Invalid storage format, ignoring");
+        return null;
+    }
+    const rawVersion = data.version;
+    // Forward-compat guard: a finite version above the newest supported schema
+    // signals a file written by a newer plugin build. Returning null here would
+    // make the caller treat the data as corrupt and overwrite it with an empty
+    // or downgraded payload, permanently destroying the user's accounts.
+    if (typeof rawVersion === "number" && Number.isFinite(rawVersion) && rawVersion > 3) {
+        const resolvedPath = sourcePath ?? "<unknown>";
+        const hint = `The storage file at ${resolvedPath} was written by a newer version ` +
+            `of this plugin (schema v${rawVersion}). Upgrade the plugin to a build ` +
+            `that understands schema v${rawVersion}, or back up and remove the ` +
+            `file to start fresh.`;
+        throw new StorageError(`Unsupported account storage schema version ${rawVersion}; this plugin supports up to version 3.`, "UNSUPPORTED_SCHEMA_VERSION", resolvedPath, hint);
+    }
+    // V2 files were produced by an intermediate 4.x build whose shape was never
+    // documented and for which no forward-migrator shipped. Silently treating
+    // them as "unknown version" (the previous behaviour) meant users with a V2
+    // file had their credentials discarded without any signal. Detect V2
+    // explicitly and throw a typed StorageError so the caller can surface the
+    // recovery hint to the user. Audit top-20 #8; see
+    // `lib/storage/migrations.ts:buildV2RejectionMessage` for copy.
+    if (AccountStorageV2DetectionSchema.safeParse(data).success) {
+        throw new StorageError(buildV2RejectionMessage(), UNKNOWN_V2_FORMAT_CODE, "", buildV2RecoveryHint(""));
+    }
+    if (data.version !== 1 && data.version !== 3) {
+        log.warn("Unknown storage version, ignoring", {
+            version: rawVersion,
+        });
+        return null;
+    }
+    const rawAccounts = data.accounts;
+    if (!Array.isArray(rawAccounts)) {
+        log.warn("Invalid storage format, ignoring");
+        return null;
+    }
+    const activeIndexValue = typeof data.activeIndex === "number" && Number.isFinite(data.activeIndex)
+        ? data.activeIndex
+        : 0;
+    const rawActiveIndex = clampIndex(activeIndexValue, rawAccounts.length);
+    const activeKeys = extractActiveKeys(rawAccounts, rawActiveIndex);
+    const fromVersion = data.version;
+    const baseStorage = fromVersion === 1
+        ? migrateV1ToV3(data)
+        : data;
+    const validAccounts = rawAccounts.filter((account) => isRecord(account) && typeof account.refreshToken === "string" && !!account.refreshToken.trim());
+    const deduplicatedAccounts = deduplicateAccountsForStorage(validAccounts);
+    const activeIndex = (() => {
+        if (deduplicatedAccounts.length === 0)
+            return 0;
+        if (activeKeys.length > 0) {
+            const mappedIndex = findAccountIndexByIdentityKeys(deduplicatedAccounts, activeKeys);
+            if (mappedIndex >= 0)
+                return mappedIndex;
+        }
+        return clampIndex(rawActiveIndex, deduplicatedAccounts.length);
+    })();
+    const activeIndexByFamily = {};
+    const rawFamilyIndices = isRecord(baseStorage.activeIndexByFamily)
+        ? baseStorage.activeIndexByFamily
+        : {};
+    for (const family of MODEL_FAMILIES) {
+        const rawIndexValue = rawFamilyIndices[family];
+        const rawIndex = typeof rawIndexValue === "number" && Number.isFinite(rawIndexValue)
+            ? rawIndexValue
+            : rawActiveIndex;
+        const clampedRawIndex = clampIndex(rawIndex, rawAccounts.length);
+        const familyKeys = extractActiveKeys(rawAccounts, clampedRawIndex);
+        let mappedIndex = clampIndex(rawIndex, deduplicatedAccounts.length);
+        if (familyKeys.length > 0 && deduplicatedAccounts.length > 0) {
+            const idx = findAccountIndexByIdentityKeys(deduplicatedAccounts, familyKeys);
+            if (idx >= 0) {
+                mappedIndex = idx;
+            }
+        }
+        activeIndexByFamily[family] = mappedIndex;
+    }
+    return {
+        version: 3,
+        accounts: deduplicatedAccounts,
+        activeIndex,
+        activeIndexByFamily,
+    };
+}
+//# sourceMappingURL=normalize.js.map

package/dist/lib/storage/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../lib/storage/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAoB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,UAAU,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,8BAA8B,EAC9B,QAAQ,GACT,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,sBAAsB,GAIvB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAIpC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAa,EACb,UAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAI,IAA8B,CAAC,OAAO,CAAC;IAE3D,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,YAAY,GAAG,UAAU,IAAI,WAAW,CAAC;QAC/C,MAAM,IAAI,GACR,uBAAuB,YAAY,kCAAkC;YACrE,2BAA2B,UAAU,mCAAmC;YACxE,4BAA4B,UAAU,8BAA8B;YACpE,sBAAsB,CAAC;QACzB,MAAM,IAAI,YAAY,CACpB,8CAA8C,UAAU,yCAAyC,EACjG,4BAA4B,EAC5B,YAAY,EACZ,IAAI,CACL,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,kDAAkD;IAClD,gEAAgE;IAChE,IAAI,+BAA+B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,uBAAuB,EAAE,EACzB,sBAAsB,EACtB,EAAE,EACF,mBAAmB,CAAC,EAAE,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC5C,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;QACvE,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,CAAC,CAAC;IAER,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAuC,CAAC;IACjE,MAAM,WAAW,GACf,WAAW,KAAK,CAAC;QACf,CAAC,CAAC,aAAa,CAAC,IAAmC,CAAC;QACpD,CAAC,CAAE,IAAoC,CAAC;IAE5C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CACtC,CAAC,OAAO,EAAgC,EAAE,CACxC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CACjG,CAAC;IAEF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,aAAa,CAAC,CAAC;IAE1E,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;QACxB,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEhD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,8BAA8B,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;YACrF,IAAI,WAAW,IAAI,CAAC;gBAAE,OAAO,WAAW,CAAC;QAC3C,CAAC;QAED,OAAO,UAAU,CAAC,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,mBAAmB,GAAyC,EAAE,CAAC;IACrE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,WAAW,CAAC,mBAAmB,CAAC;QAChE,CAAC,CAAE,WAAW,CAAC,mBAA+C;QAC9D,CAAC,CAAC,EAAE,CAAC;IAEP,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,QAAQ,GACZ,OAAO,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YACjE,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,cAAc,CAAC;QAErB,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAEnE,IAAI,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,8BAA8B,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;YAC7E,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,WAAW,GAAG,GAAG,CAAC;YACpB,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,oBAAoB;QAC9B,WAAW;QACX,mBAAmB;KACpB,CAAC;AACJ,CAAC"}

package/dist/lib/storage/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../lib/storage/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/D;AAgBD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAQhE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB/D;AAcD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAoBpD"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../lib/storage/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/D;AAgBD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAQhE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB/D;AAcD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAyBpD"}

package/dist/lib/storage/paths.js

@@ -6,6 +6,7 @@ import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { homedir, tmpdir } from "node:os";
+import { StorageError } from "../errors.js";
 const PROJECT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".opencode"];
 const PROJECTS_DIR = "projects";
 const PROJECT_KEY_HASH_LENGTH = 12;
@@ -85,7 +86,7 @@ export function resolvePath(filePath) {
     if (!isWithinDirectory(home, resolved) &&
         !isWithinDirectory(cwd, resolved) &&
         !isWithinDirectory(tmp, resolved)) {
-        throw new Error(`Access denied: path must be within home directory, project directory, or temp directory`);
+        throw new StorageError(`Access denied: path must be within home directory, project directory, or temp directory`, "PATH_ACCESS_DENIED", resolved, "The requested path is outside the allowed roots (home, project, temp). Pick a path inside one of those directories.");
     }
     return resolved;
 }

package/dist/lib/storage/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../lib/storage/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;AACxG,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,MAAM,UAAU,YAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACtD,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,oBAAoB,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE;QACpC,CAAC,CAAC,oBAAoB,CAAC;AACzB,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,SAAS,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACvD,MAAM,cAAc,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC5D,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3D,OAAO,OAAO,EAAE,CAAC;QAChB,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM;QACP,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,UAAkB;IAC7D,MAAM,cAAc,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC3C,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACP,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IACC,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAClC,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC;QACjC,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAChC,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../lib/storage/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;AACxG,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,MAAM,UAAU,YAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACtD,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,oBAAoB,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE;QACpC,CAAC,CAAC,oBAAoB,CAAC;AACzB,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,SAAS,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACvD,MAAM,cAAc,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC5D,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3D,OAAO,OAAO,EAAE,CAAC;QAChB,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM;QACP,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,UAAkB;IAC7D,MAAM,cAAc,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACvD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC3C,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACP,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IACC,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAClC,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC;QACjC,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAChC,CAAC;QACF,MAAM,IAAI,YAAY,CACrB,yFAAyF,EACzF,oBAAoB,EACpB,QAAQ,EACR,qHAAqH,CACrH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/lib/storage/state.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Module-scoped storage state and the single shared mutex that serializes
+ * every read-modify-write against the accounts files.
+ *
+ * Split out of `lib/storage.ts` in RC-2 so the identity helpers, normalize,
+ * load/save, flagged, and export-import modules can all share the same
+ * resolved path and the same lock without creating circular imports.
+ *
+ * Invariants this module preserves:
+ *   - `currentStoragePath` is either `null` (use global fallback) or an
+ *     absolute path to a project-scoped accounts file.
+ *   - `currentProjectRoot` is only non-null when `currentStoragePath` is
+ *     project-scoped; `setStoragePathDirect` deliberately clears it so
+ *     ad-hoc overrides (tests, one-off CLI paths) never look like a real
+ *     project.
+ *   - `withStorageLock` chains every critical section through a single
+ *     promise so nothing can interleave between a load and its paired save.
+ */
+/**
+ * Serializes storage I/O to keep account file reads/writes lock-step and avoid
+ * cross-request races during migration/seeding flows.
+ */
+export declare function withStorageLock<T>(fn: () => Promise<T>): Promise<T>;
+export declare function setStoragePath(projectPath: string | null): void;
+export declare function setStoragePathDirect(path: string | null): void;
+/**
+ * Returns the file path for the account storage JSON file.
+ * @returns Absolute path to the accounts.json file
+ */
+export declare function getStoragePath(): string;
+export declare function getCurrentStoragePath(): string | null;
+export declare function getCurrentLegacyProjectStoragePath(): string | null;
+export declare function getCurrentProjectRoot(): string | null;
+/**
+ * Returns the project storage key (e.g. `my-project-abc123def456`) that the
+ * active project storage path is rooted under, or `null` when no per-project
+ * root is active (global storage is in use). Used by the opt-in keychain
+ * backend as the account identifier so each project's credentials live
+ * under a distinct (service, account) pair in the OS keychain.
+ *
+ * When `setStoragePathDirect` overrode the path to something outside the
+ * standard per-project layout (tests, custom CLI override), we fall back to
+ * `null` because there is no meaningful project identity to key off.
+ */
+export declare function getCurrentProjectStorageKey(): string | null;
+//# sourceMappingURL=state.d.ts.map

package/dist/lib/storage/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../lib/storage/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOnE;AAMD,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAkB/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAI9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAKvC;AAMD,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAErD;AAED,wBAAgB,kCAAkC,IAAI,MAAM,GAAG,IAAI,CAElE;AAED,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAErD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAG3D"}

package/dist/lib/storage/state.js

@@ -0,0 +1,100 @@
+/**
+ * Module-scoped storage state and the single shared mutex that serializes
+ * every read-modify-write against the accounts files.
+ *
+ * Split out of `lib/storage.ts` in RC-2 so the identity helpers, normalize,
+ * load/save, flagged, and export-import modules can all share the same
+ * resolved path and the same lock without creating circular imports.
+ *
+ * Invariants this module preserves:
+ *   - `currentStoragePath` is either `null` (use global fallback) or an
+ *     absolute path to a project-scoped accounts file.
+ *   - `currentProjectRoot` is only non-null when `currentStoragePath` is
+ *     project-scoped; `setStoragePathDirect` deliberately clears it so
+ *     ad-hoc overrides (tests, one-off CLI paths) never look like a real
+ *     project.
+ *   - `withStorageLock` chains every critical section through a single
+ *     promise so nothing can interleave between a load and its paired save.
+ */
+import { join } from "node:path";
+import { ACCOUNTS_FILE_NAME, LEGACY_ACCOUNTS_FILE_NAME } from "../constants.js";
+import { findProjectRoot, getConfigDir, getProjectConfigDir, getProjectGlobalConfigDir, getProjectStorageKey, } from "./paths.js";
+let storageMutex = Promise.resolve();
+/**
+ * Serializes storage I/O to keep account file reads/writes lock-step and avoid
+ * cross-request races during migration/seeding flows.
+ */
+export function withStorageLock(fn) {
+    const previousMutex = storageMutex;
+    let releaseLock;
+    storageMutex = new Promise((resolve) => {
+        releaseLock = resolve;
+    });
+    return previousMutex.then(fn).finally(() => releaseLock());
+}
+let currentStoragePath = null;
+let currentLegacyProjectStoragePath = null;
+let currentProjectRoot = null;
+export function setStoragePath(projectPath) {
+    if (!projectPath) {
+        currentStoragePath = null;
+        currentLegacyProjectStoragePath = null;
+        currentProjectRoot = null;
+        return;
+    }
+    const projectRoot = findProjectRoot(projectPath);
+    if (projectRoot) {
+        currentProjectRoot = projectRoot;
+        currentStoragePath = join(getProjectGlobalConfigDir(projectRoot), ACCOUNTS_FILE_NAME);
+        currentLegacyProjectStoragePath = join(getProjectConfigDir(projectRoot), LEGACY_ACCOUNTS_FILE_NAME);
+    }
+    else {
+        currentStoragePath = null;
+        currentLegacyProjectStoragePath = null;
+        currentProjectRoot = null;
+    }
+}
+export function setStoragePathDirect(path) {
+    currentStoragePath = path;
+    currentLegacyProjectStoragePath = null;
+    currentProjectRoot = null;
+}
+/**
+ * Returns the file path for the account storage JSON file.
+ * @returns Absolute path to the accounts.json file
+ */
+export function getStoragePath() {
+    if (currentStoragePath) {
+        return currentStoragePath;
+    }
+    return join(getConfigDir(), ACCOUNTS_FILE_NAME);
+}
+// Internal accessors used by sibling storage modules. Not re-exported from the
+// top-level barrel: callers outside `lib/storage/` should use the public
+// `setStoragePath` / `getStoragePath` APIs.
+export function getCurrentStoragePath() {
+    return currentStoragePath;
+}
+export function getCurrentLegacyProjectStoragePath() {
+    return currentLegacyProjectStoragePath;
+}
+export function getCurrentProjectRoot() {
+    return currentProjectRoot;
+}
+/**
+ * Returns the project storage key (e.g. `my-project-abc123def456`) that the
+ * active project storage path is rooted under, or `null` when no per-project
+ * root is active (global storage is in use). Used by the opt-in keychain
+ * backend as the account identifier so each project's credentials live
+ * under a distinct (service, account) pair in the OS keychain.
+ *
+ * When `setStoragePathDirect` overrode the path to something outside the
+ * standard per-project layout (tests, custom CLI override), we fall back to
+ * `null` because there is no meaningful project identity to key off.
+ */
+export function getCurrentProjectStorageKey() {
+    if (!currentProjectRoot)
+        return null;
+    return getProjectStorageKey(currentProjectRoot);
+}
+//# sourceMappingURL=state.js.map

package/dist/lib/storage/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../lib/storage/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,IAAI,YAAY,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAI,EAAoB;IACrD,MAAM,aAAa,GAAG,YAAY,CAAC;IACnC,IAAI,WAAuB,CAAC;IAC5B,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,WAAW,GAAG,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAC7C,IAAI,+BAA+B,GAAkB,IAAI,CAAC;AAC1D,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C,MAAM,UAAU,cAAc,CAAC,WAA0B;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,kBAAkB,GAAG,IAAI,CAAC;QAC1B,+BAA+B,GAAG,IAAI,CAAC;QACvC,kBAAkB,GAAG,IAAI,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,kBAAkB,GAAG,WAAW,CAAC;QACjC,kBAAkB,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACtF,+BAA+B,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,kBAAkB,GAAG,IAAI,CAAC;QAC1B,+BAA+B,GAAG,IAAI,CAAC;QACvC,kBAAkB,GAAG,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,kBAAkB,GAAG,IAAI,CAAC;IAC1B,+BAA+B,GAAG,IAAI,CAAC;IACvC,kBAAkB,GAAG,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,yEAAyE;AACzE,4CAA4C;AAE5C,MAAM,UAAU,qBAAqB;IACnC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;AAClD,CAAC"}

package/dist/lib/storage/worktree-lock.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Multi-worktree collision detection for per-project account storage.
+ *
+ * Problem: when multiple OpenCode sessions (tabs, IDE windows, detached
+ * worktrees, or CI runs) point at the same per-project accounts file, their
+ * writes can interleave and lose rotation updates, health-score changes, or
+ * rate-limit state. The in-process `withStorageLock` mutex solves intra-process
+ * races but cannot see another Node process mutating the same file.
+ *
+ * Strategy: sidecar lock file at `<storage>.lock`. Every `loadAccounts` /
+ * `saveAccounts` call verifies ownership:
+ *
+ *   - No lock on disk -> write our own, proceed.
+ *   - Lock owned by us (same pid + hostname) -> refresh `lastActive`, proceed.
+ *   - Foreign lock with dead owner (same host, pid gone) -> take over.
+ *   - Foreign lock stale (`lastActive` older than STALE_THRESHOLD_MS) -> take
+ *     over. Required because a prior process that SIGKILL'd never released
+ *     its lock, so "dead pid" detection alone leaks locks on long-lived hosts.
+ *   - Foreign lock live -> surface a WARNING to the logger identifying both
+ *     worktrees and proceed anyway. The locking contract here is advisory
+ *     (Phase 4 F2 audit recommendation): blocking would strand the user when
+ *     two legitimate sessions share a project, so we prefer visibility over
+ *     enforcement.
+ *
+ * Cross-host note: we cannot probe a PID on a different machine, so a lock
+ * written from another hostname is always treated as live until its
+ * `lastActive` timestamp ages past STALE_THRESHOLD_MS. This is conservative
+ * but matches the audit requirement to "not block" — the worst case is a
+ * warning the user can dismiss.
+ *
+ * See `docs/audits/08-feature-recommendations.md` and
+ * `docs/audits/13-phased-roadmap.md#phase-4-f2` for background.
+ */
+/**
+ * Time after which a lock whose owner never refreshed it is considered
+ * abandoned, regardless of PID liveness. One hour matches the roadmap spec
+ * and is long enough to avoid stealing a lock from a session that is merely
+ * idle between saves.
+ */
+export declare const STALE_THRESHOLD_MS: number;
+/**
+ * Persisted lock-file payload. Written as pretty-printed JSON so a human
+ * inspecting the file can immediately tell which worktree holds the lock.
+ */
+export interface WorktreeLockInfo {
+    pid: number;
+    hostname: string;
+    cwd: string;
+    startedAt: string;
+    lastActive: string;
+}
+export interface AcquireLockResult {
+    /** True when we now own the lock on disk. */
+    acquired: boolean;
+    /** Populated only when a foreign live lock was detected. */
+    foreign?: WorktreeLockInfo;
+}
+/**
+ * Checks ownership of the worktree lock and acquires it when possible.
+ *
+ * Contract:
+ *   - Never throws on lock I/O errors *other than* propagating read/write
+ *     failures the caller needs to know about (disk full, EACCES).
+ *   - Always returns a discriminated result: either `acquired: true` (we
+ *     now own or refreshed the lock) or `acquired: false` with `foreign`
+ *     populated (another live worktree owns it; caller should warn).
+ *   - Never blocks. This is advisory locking by design.
+ */
+export declare function acquireOrDetectLock(storagePath: string): Promise<AcquireLockResult>;
+export declare function releaseLock(storagePath: string): Promise<void>;
+/**
+ * Test-only reset hook. Vitest reuses a single Node process across files,
+ * so `ownedLockPaths` state would leak between suites and confuse the
+ * "no lock on disk" acquire branch. Not re-exported from the barrel.
+ */
+export declare function __resetWorktreeLockForTests(): void;
+/** Test-only: inspect owned paths without exposing the internal Set. */
+export declare function __getOwnedLockPathsForTests(): readonly string[];
+//# sourceMappingURL=worktree-lock.d.ts.map

package/dist/lib/storage/worktree-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-lock.d.ts","sourceRoot":"","sources":["../../../lib/storage/worktree-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AASH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IACjC,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAqID;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACxC,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAyBD,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAGlD;AAED,wEAAwE;AACxE,wBAAgB,2BAA2B,IAAI,SAAS,MAAM,EAAE,CAE/D"}