openmausbot 0.1.68 → 0.1.70

package/dist-server/server/drivers/claude.js

@@ -1376,6 +1376,7 @@ export const ClaudeDriver = {
             getAuthentication: (flowId) => login.get(flowId),
             completeAuthentication: (flowId, code) => login.complete(flowId, code),
             cancelAuthentication: () => login.cancel(),
+            signOut: () => login.signOut(),
             adapter: {
                 provider: DRIVER_KIND,
                 capabilities: {
@@ -1423,11 +1424,16 @@ export const ClaudeDriver = {
             generateText: (prompt) => generateReview(prompt),
             reviewPermission: generateReview,
             dispose: async () => {
-                for (const { stop } of active.values())
-                    stop();
-                for (const threadId of [...sessions.keys()])
-                    closeSession(threadId, "dispose");
-                listeners.clear();
+                try {
+                    await login.dispose();
+                }
+                finally {
+                    for (const { stop } of active.values())
+                        stop();
+                    for (const threadId of [...sessions.keys()])
+                        closeSession(threadId, "dispose");
+                    listeners.clear();
+                }
             },
         };
     },

package/dist-server/server/drivers/codex-device-auth.js

@@ -45,6 +45,7 @@ function loginFailure(output) {
  * output stays in bounded private memory; only a device URL/code is exposed. */
 export class CodexDeviceAuthController {
     flow = null;
+    command = null;
     disposed = false;
     options;
     constructor(options) { this.options = options; }
@@ -121,12 +122,111 @@ export class CodexDeviceAuthController {
         await this.flow?.stopping;
         if (this.flow?.terminationFailed)
             throw new Error(this.flow.status.message);
+        if (this.command && !await this.stopChild(this.command)) {
+            throw new Error("Codex could not be stopped on this server. Ask the server administrator to stop the account command before trying again.");
+        }
     }
     async dispose() {
         this.disposed = true;
         await this.cancel();
         this.flow = null;
     }
+    /** Remove the ChatGPT sign-in Codex stores for this server account so a
+     * different account can connect. A sign-in in progress is never pulled
+     * away underneath the browser completing it. */
+    async signOut() {
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing out.");
+        if (this.flow?.status.phase === "waiting")
+            throw new Error("Finish or cancel the ChatGPT sign-in in progress before signing out.");
+        await this.flow?.stopping;
+        if (this.disposed)
+            throw new Error("This provider was removed. Refresh Settings before signing out.");
+        const env = this.options.environment();
+        const home = env.HOME || env.USERPROFILE || homedir();
+        if (!isAbsolute(home) || (env.CODEX_HOME && !isAbsolute(env.CODEX_HOME))) {
+            throw new Error("Use an absolute HOME and CODEX_HOME path for this server's Codex provider before signing out.");
+        }
+        const homeKey = canonicalPath(resolve(env.CODEX_HOME || join(home, ".codex")));
+        if (authenticatingHomes.has(homeKey)) {
+            throw new Error("A ChatGPT sign-in is running for this server account. Finish or cancel it before signing out.");
+        }
+        authenticatingHomes.add(homeKey);
+        try {
+            const before = await this.exec(["login", "status"], env, home);
+            if (before.code === 1 && /^not logged in\b/im.test(before.output))
+                return;
+            if (before.code !== 0 || !/^logged in.*chatgpt\b/im.test(before.output)) {
+                throw new Error("Codex did not confirm a ChatGPT sign-in. Other authentication methods will not be removed; ask the server administrator to check the account.");
+            }
+            const logout = await this.exec(["logout"], env, home);
+            if (logout.code !== 0)
+                throw new Error("Codex could not remove the sign-in on this server. Check the server's Codex installation and try again.");
+            // The command's own report is not enough: confirm with the same status
+            // check that decides whether bots may run on this account.
+            const status = await this.exec(["login", "status"], env, home);
+            if (status.code !== 1 || !/^not logged in\b/im.test(status.output)) {
+                throw new Error("Codex still reports a sign-in on this server. Update Codex and check its login status before trying again.");
+            }
+        }
+        finally {
+            // If the OS cannot stop a command, it may still change credentials.
+            // Keep the home reserved until that exact child actually exits.
+            const child = this.command;
+            if (child && child.exitCode === null && child.signalCode === null) {
+                child.once("close", () => authenticatingHomes.delete(homeKey));
+            }
+            else
+                authenticatingHomes.delete(homeKey);
+        }
+    }
+    /** One bounded, non-interactive Codex command. Its output stays here;
+     * callers see an exit code and a status-line match, never the text. */
+    exec(args, env, cwd) {
+        return new Promise((resolveExec, rejectExec) => {
+            if (this.disposed) {
+                rejectExec(new Error("This provider was removed. Refresh Settings before signing out."));
+                return;
+            }
+            let child;
+            try {
+                child = spawnCli(this.options.cli, args, { env: { ...env, NO_COLOR: "1" }, cwd, stdio: ["pipe", "pipe", "pipe"] });
+            }
+            catch {
+                rejectExec(new Error("Codex could not start on this server. Install or update the configured Codex CLI, then try again."));
+                return;
+            }
+            this.command = child;
+            child.stdin.end();
+            let output = "";
+            const receive = (chunk) => {
+                if (output.length < MAX_OUTPUT)
+                    output += chunk.toString("utf8").slice(0, MAX_OUTPUT - output.length);
+            };
+            child.stdout.on("data", receive);
+            child.stderr.on("data", receive);
+            // A hung CLI must not hold the credential-home lock forever.
+            const timer = setTimeout(() => {
+                void this.stopChild(child).catch(() => false).then((stopped) => {
+                    if (!stopped)
+                        rejectExec(new Error("Codex could not be stopped on this server. Ask the server administrator to stop the account command before trying again."));
+                });
+            }, this.options.startupTimeoutMs ?? 30_000);
+            timer.unref();
+            child.once("error", (error) => {
+                clearTimeout(timer);
+                rejectExec(new Error(error.code === "ENOENT"
+                    ? "Codex is not installed on this server. Run npm install -g @openai/codex@latest on the server, then try again."
+                    : "Codex could not start on this server. Check the configured CLI path and its executable permissions."));
+            });
+            child.once("close", (code) => {
+                clearTimeout(timer);
+                if (this.command === child)
+                    this.command = null;
+                resolveExec({ code, output: stripVTControlCharacters(output) });
+            });
+        });
+    }
     run(flow, args, env, cwd, done, parsePrompt = false) {
         if (flow.status.phase !== "waiting")
             return;
@@ -188,7 +288,7 @@ export class CodexDeviceAuthController {
             else
                 flow.reject(new Error(message ?? "ChatGPT sign-in did not finish."));
         }
-        flow.stopping = this.stopChild(flow).catch(() => false).then((stopped) => {
+        flow.stopping = this.stopChild(flow.child).catch(() => false).then((stopped) => {
             const release = () => authenticatingHomes.delete(flow.homeKey);
             if (stopped) {
                 release();
@@ -206,8 +306,7 @@ export class CodexDeviceAuthController {
         if (phase === "succeeded")
             void this.options.onAuthenticated?.().catch(() => { });
     }
-    async stopChild(flow) {
-        const child = flow.child;
+    async stopChild(child) {
         if (!child || await killCliTree(child, this.options.terminateTimeoutMs ?? 1500))
             return true;
         // A broken CLI may ignore SIGTERM. Do not leave a stale device flow able

package/dist-server/server/drivers/codex-identity.js

@@ -0,0 +1,115 @@
+// Let Codex resolve its effective account, including keyring credentials.
+// Reading auth.json directly can label an API-key or keyring login with an
+// old file's email. Only the protocol's display email leaves this helper.
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { killCliTree, spawnCli } from "../procs.js";
+const MAX_OUTPUT = 16_384;
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** Where this environment's Codex keeps its credentials, or null when the
+ * configured home is not absolute (the login controller refuses those too). */
+export function codexHome(env) {
+    if (env.CODEX_HOME)
+        return isAbsolute(env.CODEX_HOME) ? resolve(env.CODEX_HOME) : null;
+    const home = env.HOME || env.USERPROFILE || homedir();
+    return isAbsolute(home) ? join(home, ".codex") : null;
+}
+/** Read-only account metadata. Unsupported CLIs and uncertain responses stay
+ * unnamed; never fall back to a potentially inactive credential file. */
+export async function codexAccountEmail(cli, env, timeoutMs = 3_000) {
+    const cwd = env.HOME || env.USERPROFILE || homedir();
+    if (!isAbsolute(cwd) || !codexHome(env))
+        return null;
+    return new Promise((resolveEmail) => {
+        let child;
+        try {
+            child = spawnCli(cli, ["app-server"], { cwd, env, stdio: ["pipe", "pipe", "pipe"] });
+        }
+        catch {
+            resolveEmail(null);
+            return;
+        }
+        let finishing = false;
+        let buffer = "";
+        let outputBytes = 0;
+        let initialized = false;
+        const finish = async (email) => {
+            if (finishing)
+                return;
+            finishing = true;
+            clearTimeout(timer);
+            let stopped = await killCliTree(child, 1_000);
+            if (!stopped && child.pid) {
+                try {
+                    if (process.platform === "win32")
+                        child.kill("SIGKILL");
+                    else
+                        process.kill(-child.pid, "SIGKILL");
+                }
+                catch {
+                    try {
+                        child.kill("SIGKILL");
+                    }
+                    catch { /* already gone */ }
+                }
+                stopped = await killCliTree(child, 1_000);
+            }
+            resolveEmail(stopped ? email : null);
+        };
+        const timer = setTimeout(() => { void finish(null); }, timeoutMs);
+        timer.unref();
+        const send = (message) => {
+            try {
+                child.stdin.write(`${JSON.stringify(message)}\n`);
+            }
+            catch {
+                void finish(null);
+            }
+        };
+        child.stdin.on("error", () => { void finish(null); });
+        child.stderr.resume(); // Do not retain or log raw CLI errors or credentials.
+        child.on("error", () => { void finish(null); });
+        child.on("close", () => { void finish(null); });
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            if (finishing)
+                return;
+            outputBytes += Buffer.byteLength(chunk);
+            if (outputBytes > MAX_OUTPUT) {
+                void finish(null);
+                return;
+            }
+            buffer += chunk;
+            let newline;
+            while (!finishing && (newline = buffer.indexOf("\n")) !== -1) {
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                if (!line.trim())
+                    continue;
+                let message;
+                try {
+                    message = JSON.parse(line);
+                }
+                catch {
+                    void finish(null);
+                    return;
+                }
+                if (!initialized && message?.id === 1) {
+                    if (message.error || !message.result) {
+                        void finish(null);
+                        return;
+                    }
+                    initialized = true;
+                    send({ method: "initialized", params: {} });
+                    send({ id: 2, method: "account/read", params: { refreshToken: false } });
+                }
+                else if (initialized && message?.id === 2) {
+                    const account = message.error ? null : message.result?.account;
+                    const email = account?.type === "chatgpt" ? account.email : null;
+                    void finish(typeof email === "string" && email.length <= 254 && EMAIL.test(email) && !/[\p{Cc}\p{Cf}]/u.test(email) ? email : null);
+                }
+            }
+        });
+        send({ id: 1, method: "initialize", params: { clientInfo: { name: "openmausbot", version: "1" } } });
+    });
+}

package/dist-server/server/drivers/codex.js

@@ -24,6 +24,7 @@ import { classifyError, computeBackoff, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { appendNative } from "./native.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
+import { codexAccountEmail } from "./codex-identity.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 const ASTRA_MODEL_ID = "gpt-6-astra";
@@ -1093,11 +1094,15 @@ export const CodexDriver = {
             const authenticated = await new Promise((resolve) => {
                 execCli(config.cli, ["login", "status"], { timeout: 8000, env }, (err, stdout, stderr) => resolve(!err && /^logged in\b/im.test(`${stdout}\n${stderr ?? ""}`)));
             });
+            // Display identity only, so Settings can say whose ChatGPT account the
+            // bots run on; the status command above stays the authority on sign-in.
+            const email = authenticated ? await codexAccountEmail(config.cli, env) : null;
             // childEnv drops OPENAI_API_KEY on purpose — turns run on the ChatGPT login
             return {
                 state: "available",
                 version,
                 authenticated,
+                ...(email ? { account: { email } } : {}),
                 update: codexAstraUpdate(version, models, config.cli),
                 billing: "subscription",
             };
@@ -1114,6 +1119,7 @@ export const CodexDriver = {
             startAuthentication: () => authentication.start(),
             getAuthentication: (flowId) => authentication.get(flowId),
             cancelAuthentication: () => authentication.cancel(),
+            signOut: () => authentication.signOut(),
             snapshot,
             adapter: {
                 provider: DRIVER_KIND,

package/dist-server/server/engine-install.js

@@ -0,0 +1,137 @@
+// Install an engine's command-line app from Settings, on the machine that
+// runs this server, as this process's own user, into a directory the app
+// owns. No sudo, no shell, no terminal: the package name comes from the
+// driver's own install descriptor and never from a request, npm runs with
+// a fixed argument list, and the binary is found on the engines' PATH
+// afterwards because that directory is registered ahead of everything else.
+import { existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+import { DATA_DIR, stripWorkspaceCredentialEnv } from "./config.js";
+import { augmentedPath, findCliCandidates, registerPathDir, resetPathCache } from "./env-path.js";
+import { killCliTree, spawnCli } from "./procs.js";
+const MAX_OUTPUT = 64 * 1024;
+const DEFAULT_TIMEOUT_MS = 10 * 60_000;
+/** npm's global prefix for engines the app installs itself. */
+export function enginesPrefix(baseDir = DATA_DIR) {
+    return join(baseDir, "tools", "npm");
+}
+/** Where that prefix puts executables: `bin/` on POSIX, the prefix itself on Windows. */
+export function enginesBinDir(baseDir = DATA_DIR, platform = process.platform) {
+    return platform === "win32" ? enginesPrefix(baseDir) : join(enginesPrefix(baseDir), "bin");
+}
+/** Called once at boot: engines installed here win over any other copy on PATH. */
+export function registerEnginesBinDir(baseDir = DATA_DIR) {
+    registerPathDir(enginesBinDir(baseDir));
+}
+/** The npm package a driver's own install one-liner names, when it is one. */
+export function npmPackageOf(install) {
+    const line = install?.command?.linux ?? install?.command?.darwin ?? install?.command?.win32;
+    const match = line ? /^npm install -g ((?:@[\w.-]+\/)?[\w.-]+)$/.exec(line.trim()) : null;
+    return match ? match[1] : null;
+}
+export function npmAvailable() {
+    return findCliCandidates("npm").length > 0;
+}
+/** What Settings may install for this engine on this machine, or null. A
+ * managed engine keeps its own verified download; anything else needs a
+ * plain npm package and npm on PATH. */
+export function serverInstallFor(install, npmPresent = npmAvailable()) {
+    if (!install || install.managed)
+        return null;
+    const pkg = npmPackageOf(install);
+    return pkg && npmPresent ? { package: pkg } : null;
+}
+const running = new Map();
+/** Install or update one npm engine. Concurrent clicks share one npm run. */
+export function installNpmEngine(pkg, options = {}) {
+    const key = `${options.baseDir ?? DATA_DIR} ${pkg}`;
+    const existing = running.get(key);
+    if (existing)
+        return existing;
+    const run = installOnce(pkg, options).finally(() => running.delete(key));
+    running.set(key, run);
+    return run;
+}
+async function installOnce(pkg, options) {
+    const prefix = enginesPrefix(options.baseDir);
+    mkdirSync(prefix, { recursive: true });
+    const env = {
+        ...(options.env ?? process.env),
+        PATH: options.path ?? augmentedPath(),
+        NO_COLOR: "1",
+        npm_config_update_notifier: "false",
+        npm_config_fund: "false",
+        npm_config_audit: "false",
+    };
+    // Workspace credentials (xai/box/voice keys) are not npm's to see.
+    stripWorkspaceCredentialEnv(env);
+    // npm 11 skips a dependency's install script unless the package is named
+    // here; the engines that need one (Claude Code) are exactly these.
+    const args = ["install", "-g", "--prefix", prefix, "--loglevel=error", `--allow-scripts=${pkg}`, `${pkg}@latest`];
+    const result = await runNpm(args, env, prefix, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    if (result.code !== 0) {
+        throw new Error(`npm could not install ${pkg} on this server.${tail(result.output)}`);
+    }
+    // Whatever the boot registration did, the directory we just filled must
+    // be on the engines' PATH from here on.
+    registerPathDir(enginesBinDir(options.baseDir));
+    resetPathCache();
+    if (options.cli) {
+        const binDir = enginesBinDir(options.baseDir);
+        if (!findCliCandidates(options.cli).some((path) => path.startsWith(binDir))) {
+            throw new Error(`${pkg} installed, but it did not provide a \`${options.cli}\` command. Check the package name in this engine's install descriptor.`);
+        }
+    }
+}
+function tail(output) {
+    const clean = stripVTControlCharacters(output).trim();
+    if (!clean)
+        return "";
+    const lines = clean.split(/\r?\n/).filter((line) => line.trim()).slice(-6);
+    return `\n${lines.join("\n").slice(-600)}`;
+}
+function runNpm(args, env, cwd, timeoutMs) {
+    return new Promise((resolveRun, rejectRun) => {
+        let child;
+        try {
+            child = spawnCli("npm", args, { env, cwd, stdio: ["pipe", "pipe", "pipe"] });
+        }
+        catch {
+            rejectRun(new Error("npm could not start on this server. Install Node.js with npm for the user running OpenMausBot, then try again."));
+            return;
+        }
+        child.stdin.end();
+        let output = "";
+        const receive = (chunk) => {
+            if (output.length < MAX_OUTPUT)
+                output += chunk.toString("utf8").slice(0, MAX_OUTPUT - output.length);
+        };
+        child.stdout.on("data", receive);
+        child.stderr.on("data", receive);
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            void killCliTree(child);
+        }, timeoutMs);
+        timer.unref();
+        child.once("error", (error) => {
+            clearTimeout(timer);
+            rejectRun(new Error(error.code === "ENOENT"
+                ? "npm is not installed on this server. Install Node.js with npm for the user running OpenMausBot, then try again."
+                : "npm could not start on this server. Check that Node.js is installed for the user running OpenMausBot."));
+        });
+        child.once("close", (code) => {
+            clearTimeout(timer);
+            if (timedOut) {
+                rejectRun(new Error("The install took too long and was stopped. Check the server's network connection and try again."));
+                return;
+            }
+            resolveRun({ code, output });
+        });
+    });
+}
+/** True once something has been installed here, for status pages. */
+export function enginesInstalled(baseDir = DATA_DIR) {
+    return existsSync(enginesBinDir(baseDir));
+}

package/dist-server/server/env-path.js

@@ -80,6 +80,16 @@ let loginShellPath = null;
  * and without resetting it a rescan would rebuild the cache without those
  * entries and never re-probe — "check again" would permanently lose
  * anything only the login shell's rc file knows about. */
+// Directories the app manages itself (its own npm prefix for engines it
+// installs from Settings). They go ahead of everything else so an engine
+// installed there wins over an older copy elsewhere on PATH.
+const registeredDirs = [];
+export function registerPathDir(dir) {
+    if (registeredDirs.includes(dir))
+        return;
+    registeredDirs.unshift(dir);
+    resetPathCache();
+}
 export function resetPathCache() {
     cached = null;
     probed = false;
@@ -88,6 +98,7 @@ export function resetPathCache() {
 export function augmentedPath() {
     if (cached === null) {
         cached = mergePaths([
+            ...registeredDirs.filter((d) => existsSync(d)),
             ...(process.env.OMB_EXTRA_PATH ? process.env.OMB_EXTRA_PATH.split(delimiter) : []),
             ...(process.env.PATH ? process.env.PATH.split(delimiter) : []),
             // Keep the last successful login-shell result while a rescan starts a
@@ -131,6 +142,7 @@ export function resetPathCacheForTests() {
     cached = null;
     probed = false;
     loginShellPath = null;
+    registeredDirs.length = 0;
 }
 /** Every `name` binary on the augmented PATH as absolute paths, in PATH
  * order (first = what a bare name would run). Used by the Engines panel's

package/dist-server/server/harness/registry.js

@@ -5,6 +5,12 @@
 // compatible — do not remove it); dispose tears an instance down without
 // touching its siblings.
 import { findCliCandidates } from "../env-path.js";
+import { installNpmEngine, npmAvailable, serverInstallFor } from "../engine-install.js";
+/** The driver's install descriptor plus what this machine can do about it. */
+function withServerInstall(install, npmPresent) {
+    const server = install ? serverInstallFor(install, npmPresent) : null;
+    return server ? { ...install, server } : install;
+}
 /** The `cli` field off a driver's default config, when it has one — the
  * placeholder an override input shows when nothing is set. */
 function cliDefaultOf(driver) {
@@ -30,7 +36,14 @@ export class ProviderRegistry {
      * from their own config; this map only reports what was configured */
     cliByInstance = new Map();
     driversByKind;
-    constructor(drivers) {
+    /** Where Settings-driven npm installs go; the data directory by default. */
+    enginesBaseDir;
+    /** Whether npm is on this machine; injectable because the PATH scan also
+     * looks in standard install locations, which tests cannot empty. */
+    npmPresent;
+    constructor(drivers, options = {}) {
+        this.enginesBaseDir = options.enginesBaseDir;
+        this.npmPresent = options.npmAvailable ?? npmAvailable;
         this.driversByKind = new Map(drivers.map((d) => [d.driverKind, d]));
     }
     async load(configs) {
@@ -113,11 +126,22 @@ export class ProviderRegistry {
         await instance.refreshModels?.();
         return true;
     }
+    /** A driver's own installer (a managed download) first; otherwise the
+     * app's npm prefix, when the driver's install one-liner is an npm package
+     * and npm is on PATH. False means Settings has nothing to offer here. */
     async installRuntime(instanceId) {
-        const instance = this.get(instanceId);
-        if (!instance?.installRuntime)
+        const entry = this.byId.get(instanceId);
+        if (!entry)
+            return false;
+        if (entry.live?.installRuntime) {
+            await entry.live.installRuntime();
+            return true;
+        }
+        const driver = this.driversByKind.get(entry.shadow?.driverKind ?? entry.live.driverKind);
+        const server = serverInstallFor(driver?.install, this.npmPresent());
+        if (!server)
             return false;
-        await instance.installRuntime();
+        await installNpmEngine(server.package, { baseDir: this.enginesBaseDir, cli: cliDefaultOf(driver) });
         return true;
     }
     async startAuthentication(instanceId) {
@@ -158,6 +182,7 @@ export class ProviderRegistry {
             candidatesByName.set(name, found);
             return found;
         };
+        const npmPresent = this.npmPresent();
         return Promise.all(this.entries().map(async (entry) => {
             const driver = this.driversByKind.get(entry.shadow?.driverKind ?? entry.live.driverKind);
             if (entry.shadow) {
@@ -170,7 +195,7 @@ export class ProviderRegistry {
                     capabilities: { computerMcp: false, agentsMcp: false, localComputerMcp: false },
                     // an unknown driver has no driver record, hence no install path
                     access: driver?.metadata.access ?? "subscription",
-                    install: driver?.install,
+                    install: withServerInstall(driver?.install, npmPresent),
                     cli: entry.shadow.cli,
                     cliDefault: cliDefaultOf(driver),
                     // a shadow is exactly the "your CLI is broken, pick another"
@@ -205,7 +230,7 @@ export class ProviderRegistry {
                     approvalReview: inst.reviewPermission !== undefined,
                 },
                 access: driver?.metadata.access ?? "subscription",
-                install: driver?.install,
+                install: withServerInstall(driver?.install, npmPresent),
                 authentication: inst.startAuthentication
                     ? {
                         method: inst.getAuthentication && inst.completeAuthentication
@@ -213,6 +238,8 @@ export class ProviderRegistry {
                             : inst.getAuthentication
                                 ? "device-code" // a code to enter at the provider's page (Codex)
                                 : "browser", // a link and a callback URL (managed engines)
+                        // the browser may remove the stored sign-in to switch accounts
+                        signOut: inst.signOut !== undefined,
                     }
                     : undefined,
                 cli: this.cliByInstance.get(inst.instanceId),