openlimiter 1.3.1 → 1.3.3

package/dist/cli.d.ts

@@ -100,7 +100,7 @@ export interface CliDependencies {
      */
     openBrowser: (url: string) => void;
     /** An injectable delay, so a poll loop never makes a test wait in real time. */
-    sleep: (milliseconds: number) => Promise<void>;
+    sleep: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
     /**
      * Progress a long running command wants seen before it returns.
      *

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAoCL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAI3B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAGzB,KAAK,uBAAuB,EAE5B,KAAK,aAAa,EAGlB,KAAK,eAAe,EAEpB,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAsB3B,OAAO,EAWL,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAG5B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAgBL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,UAAU,CAAC;AAclB,OAAO,EAQL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,0BAA0B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,uBAAuB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IACrE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC1F;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE;;OAEG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD;;;;;;;OAOG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,gFAAgF;IAChF,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;;;;;OAQG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,4EAA4E;IAC5E,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;;;;OAOG;IACH,6BAA6B,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,iBAAiB,CAAC;CAC1E;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qEAAqE;AACrE,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,UAAU,IAAI,CAAC;AAC5B,eAAO,MAAM,YAAY,IAAI,CAAC;AAoG9B,wBAAgB,mBAAmB,IAAI,IAAI,CACzC,eAAe,EACb,sBAAsB,GACtB,eAAe,GACf,yBAAyB,GACzB,kBAAkB,GAClB,uBAAuB,GACvB,cAAc,GACd,aAAa,GACb,MAAM,GACN,kBAAkB,GAClB,+BAA+B,CAClC,CAiCA;AA0DD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CACtC;AAqED;;;;;;;;GAQG;AAEH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,eAAe,EAAE,CAU9E;AA4oDD,wBAAsB,MAAM,CAC1B,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,SAAS,GAAE,OAAO,CAAC,eAAe,CAAM,GACvC,OAAO,CAAC,SAAS,CAAC,CA4DpB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAsCL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAI3B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAGzB,KAAK,uBAAuB,EAE5B,KAAK,aAAa,EAGlB,KAAK,eAAe,EAEpB,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAsB3B,OAAO,EAWL,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAG5B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAgBL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,UAAU,CAAC;AAiBlB,OAAO,EAQL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,0BAA0B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,uBAAuB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IACrE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC1F;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE;;OAEG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD;;;;;;;OAOG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,gFAAgF;IAChF,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;;;;;OAQG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,4EAA4E;IAC5E,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;;;;OAOG;IACH,6BAA6B,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,iBAAiB,CAAC;CAC1E;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qEAAqE;AACrE,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,UAAU,IAAI,CAAC;AAC5B,eAAO,MAAM,YAAY,IAAI,CAAC;AAoG9B,wBAAgB,mBAAmB,IAAI,IAAI,CACzC,eAAe,EACb,sBAAsB,GACtB,eAAe,GACf,yBAAyB,GACzB,kBAAkB,GAClB,uBAAuB,GACvB,cAAc,GACd,aAAa,GACb,MAAM,GACN,kBAAkB,GAClB,+BAA+B,CAClC,CAiCA;AA0DD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CACtC;AAqED;;;;;;;;GAQG;AAEH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,eAAe,EAAE,CAU9E;AAyrDD,wBAAsB,MAAM,CAC1B,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,SAAS,GAAE,OAAO,CAAC,eAAe,CAAM,GACvC,OAAO,CAAC,SAAS,CAAC,CAyEpB"}

package/dist/cli.js

@@ -1,4 +1,4 @@
-import { ACQUISITION_OUTCOME_SENTENCE, CREDENTIAL_FAILURE_SENTENCE, PROVIDER_CODES, acquireRefreshLock, clearRefreshSpawnFailure, mergeAcquiredSnapshots, createFetchTransport, readRefreshSpawnFailure, antigravitySpec, buildAdvice, canonicalJson, claudeSpec, codexSpec, dedupeFailures, desktopHoldsCache, failureFromConnectorReason, freshness, geminiCliSpec, grokSpec, isProviderDue, kimiSpec, mergeSnapshots, normalizeMeters, normalizeMetersReport, openrouterSpec, readAcquisitionCredential, readAcquisitionSchedule, readSnapshotCache, readWindowsCredentialWith, resolveStateDirectory, runAcquisition, spawnDetachedRefresh, writeAcquisitionSchedule, probeAntigravity, resolveAgyExecutablePath } from "@openlimiter/core";
+import { ACQUISITION_OUTCOME_SENTENCE, ACQUISITION_PROVIDERS, registerManagedCodexAccount, CREDENTIAL_FAILURE_SENTENCE, PROVIDER_CODES, acquireRefreshLock, clearRefreshSpawnFailure, mergeAcquiredSnapshots, createFetchTransport, readRefreshSpawnFailure, antigravitySpec, buildAdvice, canonicalJson, claudeSpec, codexSpec, dedupeFailures, desktopHoldsCache, failureFromConnectorReason, freshness, geminiCliSpec, grokSpec, isProviderDue, kimiSpec, mergeSnapshots, normalizeMeters, normalizeMetersReport, openrouterSpec, readAcquisitionCredential, readAcquisitionSchedule, readSnapshotCache, readWindowsCredentialWith, resolveStateDirectory, runAcquisition, spawnDetachedRefresh, writeAcquisitionSchedule, probeAntigravity, resolveAgyExecutablePath } from "@openlimiter/core";
 import { antigravityFixture, claudeFixture, codexFixture, grokFixture, kimiFixture, connectors, manualFixture, opencodeFixture, openrouterFixture, parseAntigravityCodeAssistPayload, parseAntigravityPayload, parseClaudePayload, parseCodexPayload, parseGeminiCliPayload, parseGrokPayload, parseKimiPayload, parseManualPayload, parseOpencodePayload, parseOpenrouterPayload } from "@openlimiter/connectors";
 import { AGENT_COMPATIBILITY, agentContextFromCache, agentContextSpillFromCache, agentVersionCompatibility, changeAgentHook, detectAgentInstallation, readAgentHookStatus, runAgentHook, validateAgentExecutableStamp, writeAgentContextSnapshot, loadHostedContextTrust, renderClaudeStatusline } from "@openlimiter/adapters";
 import { execFile, spawn } from "node:child_process";
@@ -11,9 +11,9 @@ import { failureLine, failureLines, renderTable, supportsColor } from "./render.
 import { isStatuslineHost, renderStatuslineLayout, statuslineColor } from "./statusline.js";
 import { TERMINAL_HOST_NAMES, installHost, terminalHide, terminalShow, terminalStatusTable, uninstallHost } from "./terminal.js";
 import { createFetchHubTransport, hubConfigured } from "./hub.js";
-import { REVOKED_SENTENCE, ensureFreshSession, isAborted, runDeviceLogin } from "./hub-auth.js";
-import { runSync } from "./hub-sync.js";
-import { deleteSession, readSession, writeSession } from "./session.js";
+import { DELIVERY_UNCONFIRMED_SENTENCE, REVOKED_SENTENCE, ensureFreshSession, isAborted, runDeviceLogin } from "./hub-auth.js";
+import { runSync, syncIsDue, recordSyncAttempt } from "./hub-sync.js";
+import { deleteSession, readSession, StorageDiagnosticError, writeSession, withSessionLock } from "./session.js";
 import { DeviceLoginError, LOGIN_TIMEOUT_MILLISECONDS, SystemDeviceLoginRunner, managedCodexHome, startCodexDeviceLogin, versionIsSupported as codexVersionIsSupported } from "./codex-device-login.js";
 /** Exit codes. Enumerated so a script can tell these cases apart. */
 export const EXIT_OK = 0;
@@ -137,7 +137,7 @@ export function runtimeDependencies() {
         emit: (line) => {
             process.stdout.write(line + "\n");
         },
-        codexDeviceLoginRunnerFactory: (executable) => new SystemDeviceLoginRunner(executable)
+        codexDeviceLoginRunnerFactory: (executable) => new SystemDeviceLoginRunner(executable, process.platform)
     };
 }
 function succeed(stdout) {
@@ -305,6 +305,7 @@ function credentialReader(dependencies) {
                 };
         }
         return await readAcquisitionCredential(provider, {
+            ...(dependencies.stateDirectory === undefined ? {} : { stateDirectory: dependencies.stateDirectory }),
             platform: dependencies.platform,
             environment: dependencies.environment,
             homeDirectory: dependencies.homeDirectory,
@@ -459,6 +460,8 @@ const ACQUISITION_HEADER = "PROVIDER DETECTED STATUS NEXT NOTE";
 async function refreshCommand(dependencies, now) {
     const lock = await acquireRefreshLock(dependencies.stateDirectory);
     if (!lock.ok) {
+        if (lock.reason === "unavailable")
+            return fail(EXIT_FAILURE, "openlimiter refresh: the refresh did not complete.");
         return succeed([
             ACQUISITION_HEADER,
             "SKIPPED another refresh is already running on this machine"
@@ -473,7 +476,10 @@ async function refreshCommand(dependencies, now) {
          * lock where the answer cannot change underneath it.
          */
         const settled = await readSnapshotCache(dependencies.stateDirectory);
-        if (desktopHoldsCache(settled.ok ? settled.snapshots : [], now)) {
+        const providers = await readProvidersConfig(dependencies.stateDirectory);
+        const specs = acquisitionSpecs(providers).filter((spec) => !desktopHoldsCache(settled.ok ? settled.snapshots.filter((row) => row.provider === spec.provider) : [], now));
+        if (specs.length === 0) {
+            await triggerSyncAfterRefresh(dependencies, now);
             return succeed([
                 ACQUISITION_HEADER,
                 "SKIPPED the desktop app refreshed this cache inside the last interval"
@@ -481,9 +487,8 @@ async function refreshCommand(dependencies, now) {
         }
         /* A round that got this far is proof a refresh can start on this machine. */
         await clearRefreshSpawnFailure(dependencies.stateDirectory);
-        const providers = await readProvidersConfig(dependencies.stateDirectory);
         const schedule = await readAcquisitionSchedule(dependencies.stateDirectory);
-        const result = await runAcquisition(acquisitionSpecs(providers), {
+        const result = await runAcquisition(specs, {
             transport: dependencies.acquisitionTransport,
             now,
             schedule,
@@ -561,8 +566,10 @@ async function refreshCommand(dependencies, now) {
  */
 async function startRefreshBehind(dependencies, snapshots, now) {
     try {
+        const directory = dependencies.stateDirectory ?? resolveStateDirectory();
+        const syncDue = await readSession(directory) !== null && await syncIsDue(directory, now);
         await spawnDetachedRefresh({
-            snapshots,
+            snapshots: syncDue ? [] : snapshots,
             now,
             ...(dependencies.stateDirectory === undefined
                 ? {}
@@ -1242,13 +1249,20 @@ const terminalUsage = [
 /** The provider ids this machine has a login or a key for, right now. */
 async function detectedProviderIds(dependencies) {
     const environment = await environmentWithLocalMarkers(dependencies.environment, dependencies.stateDirectory);
-    return connectors
+    const detected = new Set(connectors
         .filter((connector) => connector.detect(environment))
-        .map((connector) => connector.id);
+        .map((connector) => connector.id));
+    const reader = credentialReader(dependencies);
+    for (const provider of ACQUISITION_PROVIDERS) {
+        if ((await reader(provider)).ok)
+            detected.add(provider.toLowerCase());
+    }
+    return [...detected];
 }
 function terminalContext(dependencies, detected) {
     return {
         homeDirectory: dependencies.homeDirectory,
+        environment: dependencies.environment,
         ...(dependencies.stateDirectory === undefined
             ? {}
             : { stateDirectory: dependencies.stateDirectory }),
@@ -1332,6 +1346,14 @@ async function terminalCommand(dependencies, argumentsList) {
     return fail(EXIT_USAGE, terminalUsage);
 }
 /* ------------------------------------------------------------------- hub */
+async function persistLoginSession(dependencies, session) {
+    const directory = dependencies.stateDirectory ?? resolveStateDirectory();
+    await withSessionLock(directory, async () => await writeSession(session, {
+        directory,
+        platform: dependencies.platform,
+        ...(dependencies.windowsAclRunner === undefined ? {} : { windowsAclRunner: dependencies.windowsAclRunner })
+    }));
+}
 /**
  * Sign in to the hub through the device code flow.
  *
@@ -1349,31 +1371,36 @@ async function loginCommand(dependencies, argumentsList) {
         emit: dependencies.emit,
         ...(dependencies.interruptSignal === undefined ? {} : { interruptSignal: dependencies.interruptSignal }),
         openBrowser: dependencies.openBrowser,
-        open: argumentsList.includes("--open")
+        open: argumentsList.includes("--open"),
+        storeSession: async (session) => await persistLoginSession(dependencies, session)
     });
     if (outcome.kind === "signed_in") {
-        await writeSession(outcome.session, {
-            ...(dependencies.stateDirectory === undefined ? {} : { directory: dependencies.stateDirectory }),
-            platform: dependencies.platform,
-            ...(dependencies.windowsAclRunner === undefined ? {} : { windowsAclRunner: dependencies.windowsAclRunner })
-        });
+        if (!outcome.deliveryConfirmed)
+            return succeed(DELIVERY_UNCONFIRMED_SENTENCE);
         return succeed("Signed in as " + outcome.session.accountLabel + ".");
     }
     if (outcome.kind === "cancelled")
         return fail(EXIT_FAILURE, "openlimiter login: cancelled.");
-    if (outcome.kind === "denied")
-        return fail(EXIT_FAILURE, "openlimiter login: the sign in was denied.");
+    if (outcome.kind === "denied") {
+        return fail(EXIT_FAILURE, outcome.message === undefined
+            ? "openlimiter login: the sign in was denied."
+            : "openlimiter login: " + outcome.message);
+    }
     if (outcome.kind === "expired") {
         return fail(EXIT_FAILURE, outcome.message ?? "openlimiter login: the code expired before it was approved.");
     }
     if (outcome.kind === "not_configured") {
         return fail(EXIT_FAILURE, "openlimiter login: the hub is not configured on this build.");
     }
+    if (outcome.kind === "storage_error") {
+        return fail(EXIT_FAILURE, "openlimiter login: " + outcome.message);
+    }
     return fail(EXIT_FAILURE, "openlimiter login: " + outcome.message + ".");
 }
 /** Forget the stored session. Nothing on the hub is asked to do anything. */
 async function logoutCommand(dependencies) {
-    await deleteSession(dependencies.stateDirectory);
+    const directory = dependencies.stateDirectory ?? resolveStateDirectory();
+    await withSessionLock(directory, async () => await deleteSession(directory));
     return succeed("Signed out.");
 }
 /** Print who is signed in, or say plainly that nobody is. */
@@ -1400,11 +1427,15 @@ async function persistRenewedSession(dependencies, session) {
  * being treated as an ordinary network failure.
  */
 async function syncCommand(dependencies, now) {
+    return await withSessionLock(dependencies.stateDirectory ?? resolveStateDirectory(), async () => await syncCommandLocked(dependencies, now));
+}
+async function syncCommandLocked(dependencies, now) {
     const directory = dependencies.stateDirectory ?? resolveStateDirectory();
     const session = await readSession(directory);
     if (session === null) {
         return fail(EXIT_FAILURE, "openlimiter sync: not signed in, run openlimiter login.");
     }
+    await recordSyncAttempt(directory, now);
     const renewal = await ensureFreshSession(session, now, dependencies.environment, dependencies.hubTransport);
     if (renewal.kind === "revoked") {
         await deleteSession(directory);
@@ -1424,7 +1455,8 @@ async function syncCommand(dependencies, now) {
         now,
         token: active.token,
         deviceId: active.deviceId,
-        snapshots
+        snapshots,
+        sessionLockHeld: true
     });
     if (result.kind === "accepted") {
         return succeed("Synced: accepted, tier " + (result.tier ?? "free") + ", rows " + String(result.rows) + ".");
@@ -1438,6 +1470,9 @@ async function syncCommand(dependencies, now) {
     if (result.kind === "rejected") {
         return fail(EXIT_FAILURE, "openlimiter sync: the hub rejected the upload.");
     }
+    if (result.kind === "sequence_mismatch") {
+        return fail(EXIT_FAILURE, "openlimiter sync: the hub returned a sequence mismatch.");
+    }
     return fail(EXIT_FAILURE, "openlimiter sync: the hub could not be reached, try again.");
 }
 /**
@@ -1453,32 +1488,7 @@ async function syncCommand(dependencies, now) {
  */
 async function triggerSyncAfterRefresh(dependencies, now) {
     try {
-        const directory = dependencies.stateDirectory ?? resolveStateDirectory();
-        const session = await readSession(directory);
-        if (session === null)
-            return;
-        const renewal = await ensureFreshSession(session, now, dependencies.environment, dependencies.hubTransport);
-        if (renewal.kind === "revoked") {
-            await deleteSession(directory);
-            return;
-        }
-        if (renewal.kind === "error")
-            return;
-        if (renewal.kind === "renewed")
-            await persistRenewedSession(dependencies, renewal.session);
-        const active = renewal.session;
-        const snapshots = await cachedSnapshots(dependencies.stateDirectory);
-        const outcome = await runSync({
-            directory,
-            environment: dependencies.environment,
-            transport: dependencies.hubTransport,
-            now,
-            token: active.token,
-            deviceId: active.deviceId,
-            snapshots
-        });
-        if (outcome.kind === "revoked")
-            await deleteSession(directory);
+        await syncCommand(dependencies, now);
     }
     catch {
         /* A refresh that could not sync still refreshed. */
@@ -1493,18 +1503,23 @@ async function promptOrSkip(dependencies, question) {
 /** Step one: sign in, or say plainly why this machine did not. */
 async function setupSignInStep(dependencies) {
     const lines = ["1. Sign in", SETUP_SIGN_IN_PROMPT];
+    lines.forEach(dependencies.emit);
+    const add = (line) => {
+        lines.push(line);
+        dependencies.emit(line);
+    };
     const existing = await readSession(dependencies.stateDirectory);
     if (existing !== null) {
-        lines.push("Already signed in as " + existing.accountLabel + ".");
+        add("Already signed in as " + existing.accountLabel + ".");
         return lines;
     }
     if (!hubConfigured(dependencies.environment)) {
-        lines.push("Skipped: the hub is not configured on this build.");
+        add("Skipped: the hub is not configured on this build.");
         return lines;
     }
     const proceed = await promptOrSkip(dependencies, "Enter to sign in, S to skip: ");
     if (!proceed) {
-        lines.push("Skipped.");
+        add("Skipped.");
         return lines;
     }
     const outcome = await runDeviceLogin({
@@ -1514,21 +1529,22 @@ async function setupSignInStep(dependencies) {
         emit: dependencies.emit,
         ...(dependencies.interruptSignal === undefined ? {} : { interruptSignal: dependencies.interruptSignal }),
         openBrowser: dependencies.openBrowser,
-        open: false
+        open: false,
+        storeSession: async (session) => await persistLoginSession(dependencies, session)
     });
     if (outcome.kind === "signed_in") {
-        await writeSession(outcome.session, {
-            ...(dependencies.stateDirectory === undefined ? {} : { directory: dependencies.stateDirectory }),
-            platform: dependencies.platform,
-            ...(dependencies.windowsAclRunner === undefined ? {} : { windowsAclRunner: dependencies.windowsAclRunner })
-        });
-        lines.push("Signed in as " + outcome.session.accountLabel + ".");
+        add(outcome.deliveryConfirmed
+            ? "Signed in as " + outcome.session.accountLabel + "."
+            : DELIVERY_UNCONFIRMED_SENTENCE);
     }
     else if (outcome.kind === "cancelled") {
-        lines.push("Cancelled.");
+        add("Cancelled.");
+    }
+    else if (outcome.kind === "storage_error") {
+        add(outcome.message);
     }
     else {
-        lines.push("Could not sign in this time. Run openlimiter login later.");
+        add("Could not sign in this time. Run openlimiter login later.");
     }
     return lines;
 }
@@ -1610,8 +1626,13 @@ async function runCodexDeviceSignIn(dependencies, installed) {
             return "Codex: sign in cancelled.";
         }
         const state = await session.state(Date.now());
-        if (state.kind === "complete")
+        if (state.kind === "complete") {
+            if (!(await registerManagedCodexAccount(stateDirectory, sessionId, dependencies.now())) ||
+                !(await credentialReader(dependencies)("CODEX")).ok) {
+                return "Codex: " + codexFailureSentence("storage") + ".";
+            }
             return "Codex: signed in.";
+        }
         if (state.kind === "cancelled")
             return "Codex: sign in cancelled.";
         if (state.kind === "timed_out")
@@ -1629,17 +1650,24 @@ async function runCodexDeviceSignIn(dependencies, installed) {
 /** Step two: detect installed agent CLIs and their logins, one row each. */
 async function setupConnectStep(dependencies) {
     const lines = ["2. Connect"];
+    dependencies.emit(lines[0]);
+    const add = (line) => {
+        lines.push(line);
+        dependencies.emit(line);
+    };
     const environment = await environmentWithLocalMarkers(dependencies.environment, dependencies.stateDirectory);
     const readCredential = credentialReader(dependencies);
     let codexInstalled = null;
     let codexNeedsSignIn = false;
     for (const agent of CONNECT_AGENT_IDS) {
-        const installed = await detectAgentInstallation(agent, {
-            environment,
-            platform: dependencies.platform
-        });
+        const installed = Object.prototype.hasOwnProperty.call(dependencies.detectedAgentInstallations, agent)
+            ? dependencies.detectedAgentInstallations[agent] ?? null
+            : await detectAgentInstallation(agent, {
+                environment,
+                platform: dependencies.platform
+            });
         const state = await connectRowState(agent, installed, readCredential);
-        lines.push(agent + ": " + CONNECT_ROW_LABEL[state]);
+        add(agent + ": " + CONNECT_ROW_LABEL[state]);
         if (agent === "codex") {
             codexInstalled = installed;
             codexNeedsSignIn = state === "sign_in";
@@ -1648,7 +1676,7 @@ async function setupConnectStep(dependencies) {
     if (codexNeedsSignIn && codexInstalled !== null) {
         const proceed = await promptOrSkip(dependencies, "Codex has no login yet. Sign in now? Enter to start, S to skip: ");
         if (proceed)
-            lines.push(await runCodexDeviceSignIn(dependencies, codexInstalled));
+            add(await runCodexDeviceSignIn(dependencies, codexInstalled));
     }
     else {
         await promptOrSkip(dependencies, "Enter to accept: ");
@@ -1664,31 +1692,52 @@ const CONNECT_AGENT_IDS = [
     "kimi",
     "opencode"
 ];
-/** Step three: the existing terminal checklist, unchanged. */
+/** Step three: show the checklist and install each host the person selects. */
 async function setupShowBarsStep(dependencies) {
     const result = await terminalCommand(dependencies, ["terminal"]);
-    return ["3. Show bars in", result.stdout];
+    const lines = ["3. Show bars in", result.stdout];
+    lines.forEach(dependencies.emit);
+    for (const host of TERMINAL_HOST_NAMES) {
+        if (await promptOrSkip(dependencies, host + ": Enter to install, S to skip: ")) {
+            const installed = await terminalCommand(dependencies, ["terminal", "install", host]);
+            lines.push(installed.stdout || installed.stderr);
+            dependencies.emit(lines[lines.length - 1]);
+        }
+    }
+    return lines;
 }
 /**
  * The three step first run: sign in, connect, show bars in, then the bars
  * themselves, once.
  */
 async function setupCommand(dependencies, now) {
-    const sections = [];
-    sections.push(...(await setupSignInStep(dependencies)));
-    sections.push(...(await setupConnectStep(dependencies)));
-    sections.push(...(await setupShowBarsStep(dependencies)));
+    await setupSignInStep(dependencies);
+    await setupConnectStep(dependencies);
+    const collected = await refreshCommand(dependencies, now);
+    if (collected.exitCode !== 0 && collected.stderr !== "")
+        dependencies.emit(collected.stderr);
+    await setupShowBarsStep(dependencies);
     const snapshots = await cachedSnapshots(dependencies.stateDirectory);
-    sections.push(renderTable(snapshots, now, dependencies.colorOutput));
-    return succeed(sections.join(NEWLINE));
+    dependencies.emit(renderTable(snapshots, now, dependencies.colorOutput));
+    return succeed("");
 }
 export async function runCli(argumentsList, overrides = {}) {
-    const dependencies = { ...defaults(), ...overrides };
+    const setupOutput = [];
+    const hasOutputSink = overrides.emit !== undefined;
+    const dependencies = {
+        ...defaults(),
+        ...overrides,
+        ...(hasOutputSink ? {} : { emit: (line) => setupOutput.push(line) })
+    };
     const command = argumentsList[0] ?? "setup";
     const now = dependencies.now();
     try {
-        if (command === "setup")
-            return await setupCommand(dependencies, now);
+        if (command === "setup") {
+            const result = await setupCommand(dependencies, now);
+            if (hasOutputSink || setupOutput.length === 0)
+                return result;
+            return { ...result, stdout: [setupOutput.join(NEWLINE), result.stdout].filter(Boolean).join(NEWLINE) };
+        }
         if (command === "login")
             return await loginCommand(dependencies, argumentsList);
         if (command === "logout")
@@ -1736,7 +1785,7 @@ export async function runCli(argumentsList, overrides = {}) {
         }
         return fail(EXIT_USAGE, "openlimiter: unknown command.", help);
     }
-    catch {
+    catch (error) {
         /*
          * The hook and statusline paths are invoked by another tool. They report
          * nothing rather than breaking their host. Every other command surfaces the
@@ -1751,6 +1800,9 @@ export async function runCli(argumentsList, overrides = {}) {
         if (command === "statusline") {
             return { exitCode: EXIT_OK, stdout: "OpenLimiter UNKNOWN", stderr: "" };
         }
+        if (error instanceof StorageDiagnosticError) {
+            return fail(EXIT_FAILURE, error.message);
+        }
         return fail(EXIT_FAILURE, "openlimiter: the command did not complete.");
     }
 }