orizu 0.5.49 → 0.5.51

package/src/auth-commands.ts

@@ -11,20 +11,18 @@ import {
   resolveLogoutTarget,
   assertSecureTokenTransport,
   authedFetch,
-  credentialRequestRedirectPolicy,
 } from './http.js'
 import {
+  clearUnreadableServerCredentials,
   hasResolvableAuth,
   rememberProcessSecret,
   saveServerCredentials,
   getServerCredentials,
-  clearServerCredentials,
   resolveAuthTokenForBaseUrl,
 } from './credentials.js'
 import { printJson, printLine, printLoginProgress } from './cli-console-output.js'
 import { shouldUseHeadlessLogin, waitForHeadlessAuthorization } from './headless-login.js'
 import { renderCliAuthBrowserPage } from './cli-auth-browser-page.js'
-import { describeLogoutHttpFailure, describeLogoutTransportFailure } from './logout-diagnostic.js'
 import { resolveProjectSelection } from './account-directory.js'
 
 import type { LoginResponse } from './types.js'
@@ -144,6 +142,10 @@ interface AuthenticatedLoginResponse extends LoginResponse {
   apiKey: string
 }
 
+function isCredentialsFileFailure(message: string): boolean {
+  return message.startsWith('ORIZU_CREDENTIALS_READ_FAILED:') || message.startsWith('ORIZU_CREDENTIALS_WRITE_FAILED:')
+}
+
 async function login(baseUrlOverride?: string) {
   const target = baseUrlOverride !== undefined
     ? { baseUrl: baseUrlOverride, isDefault: false }
@@ -155,13 +157,14 @@ async function login(baseUrlOverride?: string) {
   try {
     loginData = await authenticateAtBaseUrl(baseUrl)
     if (!loginData) return
-    saveServerCredentials(baseUrl, {
-      credentialType: 'pat',
-      apiKey: loginData.apiKey,
-    })
+    const apiKey = loginData.apiKey
+    // Waits for the lock without freezing the CLI (ORI-2421).
+    const { withCredentialsTransaction } = await import('./credentials-transaction.js')
+    await withCredentialsTransaction(async () => saveServerCredentials(baseUrl, { credentialType: 'pat', apiKey }))
   } catch (error) {
-    if (target.isDefault) {
-      const detail = error instanceof Error ? error.message : String(error)
+    const detail = error instanceof Error ? error.message : String(error)
+    // Reading or saving credentials.json is a disk problem, not a connection one.
+    if (target.isDefault && !isCredentialsFileFailure(detail)) {
       throw new Error(
         `${detail} Check connectivity to https://app.orizu.ai, then retry \`orizu login\`.`,
         { cause: error }
@@ -312,6 +315,15 @@ async function logout(baseUrlOverride?: string) {
   const { baseUrl, credentialBaseUrl } = resolveLogoutTarget(baseUrlOverride)
   const credentials = getServerCredentials(credentialBaseUrl)
   if (!credentials) {
+    // A saved sign-in this CLI cannot read is removed: it may be a pasted token (ORI-2675).
+    if (clearUnreadableServerCredentials(credentialBaseUrl)) {
+      if (hasJsonFlag()) {
+        printJson({ status: 'removed-unreadable', server: baseUrl })
+        return
+      }
+      printLine(`Removed the saved sign-in for ${sanitizeTerminalText(baseUrl)}, which this CLI could not read.`)
+      return
+    }
     if (hasJsonFlag()) {
       printJson({ status: 'already-logged-out', server: baseUrl })
       return
@@ -319,34 +331,18 @@ async function logout(baseUrlOverride?: string) {
     printLine(`Already logged out for ${sanitizeTerminalText(baseUrl)}.`)
     return
   }
-  const authorizationToken = 'accessToken' in credentials
-    ? credentials.accessToken
-    : credentials.apiKey
-  const logoutSecrets = [
-    authorizationToken,
-    ...('refreshToken' in credentials ? [credentials.refreshToken] : []),
-  ]
-  let remoteLogoutError: string | null = null
-  try {
-    assertSecureTokenTransport(baseUrl)
-    const response = await fetch(`${baseUrl}/api/cli/auth/logout`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Authorization: `Bearer ${authorizationToken}`,
-      },
-      body: 'refreshToken' in credentials
-        ? JSON.stringify({ refreshToken: credentials.refreshToken })
-        : undefined,
-      ...credentialRequestRedirectPolicy(),
-    })
-    if (!response.ok) {
-      remoteLogoutError = await describeLogoutHttpFailure(response, logoutSecrets)
+  const { storedLogout } = await import('./stored-session-requests.js')
+  const { remoteError: remoteLogoutError, localCredentialCleared } = await storedLogout(baseUrl, credentialBaseUrl, credentials)
+  // Another login saved for this server while logout was out is kept.
+  if (!localCredentialCleared && getServerCredentials(credentialBaseUrl)) {
+    if (hasJsonFlag()) {
+      printJson({ status: 'changed', server: baseUrl, remoteLogoutError })
+      process.exitCode = 1
+      return
     }
-  } catch (error) {
-    remoteLogoutError = describeLogoutTransportFailure(error, logoutSecrets)
+    if (remoteLogoutError) console.warn(`Warning: remote logout failed: ${remoteLogoutError}`)
+    throw new Error(`ORIZU_CREDENTIALS_CHANGED: another login was saved for ${sanitizeTerminalText(baseUrl)} during logout; it was kept. Run orizu logout again to remove it.`)
   }
-  clearServerCredentials(credentialBaseUrl)
   if (hasJsonFlag()) {
     printJson({ status: 'logged-out', server: baseUrl, remoteLogoutError })
     return

package/src/credentials-transaction.ts

@@ -0,0 +1,73 @@
+// Waiting for the credentials lock without freezing the process (ORI-2421).
+// Loaded only by stored-login code (refresh, logout, login), never on the
+// ORIZU_TOKEN / ORIZU_TOKEN_FILE path, which must not load Effect.
+import { Cause, Effect, Exit } from 'effect'
+
+import {
+  CREDENTIALS_LOCK_RETRY_MS,
+  credentialsLockTimeoutError,
+  credentialsLockTimeoutMs,
+  type HeldCredentialsLock,
+  releaseCredentialsLock,
+  tryAcquireCredentialsLock,
+  withCredentialsTransactionLockAsync,
+} from './credentials.js'
+
+/**
+ * Try the lock, sleep, try again, until ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS.
+ * Timers and stop handlers keep running while it waits, and `signal` stops
+ * the wait. A try is one synchronous step, so a stop never lands inside it.
+ * A lock a try takes is noted at once, and handed back if the run then ends
+ * any way other than returning it, wherever a stop lands.
+ */
+function acquireLock(signal: AbortSignal | null | undefined): Promise<HeldCredentialsLock> {
+  const timeoutMs = credentialsLockTimeoutMs()
+  const deadline = Date.now() + timeoutMs
+  let taken: HeldCredentialsLock | null = null
+  const attempt = Effect.try({
+    try: () => (taken = tryAcquireCredentialsLock()),
+    catch: cause => cause instanceof Error ? cause : new Error(String(cause)),
+  })
+  const program = Effect.gen(function*() {
+    while (true) {
+      const lock = yield* attempt
+      if (lock) return lock
+      const remainingMs = deadline - Date.now()
+      if (remainingMs <= 0) return yield* Effect.fail(credentialsLockTimeoutError(timeoutMs))
+      yield* Effect.sleep(Math.min(CREDENTIALS_LOCK_RETRY_MS, remainingMs))
+    }
+  })
+  return run(program, signal, () => {
+    if (!taken) return
+    try {
+      releaseCredentialsLock(taken)
+    } catch {
+      // The stop or failure is what the caller needs to see.
+    }
+  })
+}
+
+/** A stop by `signal` rejects with its reason, as an aborted fetch would. */
+async function run<A>(
+  program: Effect.Effect<A, Error>,
+  signal: AbortSignal | null | undefined,
+  onNotReturned: () => void
+): Promise<A> {
+  const exit = await Effect.runPromiseExit(program, signal ? { signal } : undefined)
+  if (Exit.isSuccess(exit)) return exit.value
+  onNotReturned()
+  if (signal?.aborted && Cause.hasInterruptsOnly(exit.cause)) throw signal.reason
+  throw Cause.squash(exit.cause)
+}
+
+/**
+ * A credentials transaction whose wait for the lock stays responsive. The
+ * in-process rules are credentials.ts's: one holder per process, and nested
+ * writes only from the holder's own async context.
+ */
+export function withCredentialsTransaction<T>(
+  operation: () => Promise<T>,
+  signal?: AbortSignal | null
+): Promise<T> {
+  return withCredentialsTransactionLockAsync(operation, () => acquireLock(signal))
+}

package/src/credentials.ts

@@ -29,6 +29,12 @@ function isNodeError(error: unknown): error is NodeJS.ErrnoException {
   return error instanceof Error
 }
 
+// The system's short error code (EACCES, EPERM), never the message: messages
+// from fs calls carry paths, and this one goes to the terminal.
+function errorCode(error: unknown): string {
+  return isNodeError(error) && typeof error.code === 'string' ? error.code : 'unknown error'
+}
+
 export function getConfigDir(): string {
   if (process.env.ORIZU_CONFIG_DIR) {
     return process.env.ORIZU_CONFIG_DIR
@@ -42,7 +48,7 @@ function getCredentialsPath(): string {
 
 const DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS = 2_000
 const MAX_CREDENTIALS_LOCK_TIMEOUT_MS = 10_000
-const CREDENTIALS_LOCK_RETRY_MS = 20
+export const CREDENTIALS_LOCK_RETRY_MS = 20
 
 interface CredentialsLockMetadata {
   version: 1
@@ -52,7 +58,7 @@ interface CredentialsLockMetadata {
   instanceId: string
 }
 
-interface HeldCredentialsLock {
+export interface HeldCredentialsLock {
   path: string
   metadata: string
   depth: number
@@ -81,69 +87,85 @@ function sleepSync(milliseconds: number): void {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds)
 }
 
-function acquireCredentialsLock(): HeldCredentialsLock {
+export function credentialsLockTimeoutMs(): number {
+  return readLockDuration(
+    'ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS',
+    DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS,
+    MAX_CREDENTIALS_LOCK_TIMEOUT_MS
+  )
+}
+
+export function credentialsLockTimeoutError(timeoutMs: number): Error {
+  return new Error(
+    `ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`
+  )
+}
+
+/**
+ * One try at the cross-process lock. Returns null when another owner holds
+ * it. The waits between tries belong to the caller: a blocking one below for
+ * synchronous writers, an Effect sleep in credentials-transaction.ts.
+ */
+export function tryAcquireCredentialsLock(): HeldCredentialsLock | null {
   const dir = getConfigDir()
   mkdirSync(dir, { recursive: true, mode: 0o700 })
   chmodSync(dir, 0o700)
 
   const lockPath = getCredentialsLockPath()
-  const timeoutMs = readLockDuration(
-    'ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS',
-    DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS,
-    MAX_CREDENTIALS_LOCK_TIMEOUT_MS
+  const metadata = JSON.stringify({
+    version: 1,
+    pid: process.pid,
+    hostname: hostname(),
+    createdAt: Date.now(),
+    instanceId: randomBytes(16).toString('hex'),
+  } satisfies CredentialsLockMetadata)
+  const tempPath = join(
+    dir,
+    `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`
   )
-  const deadline = Date.now() + timeoutMs
 
-  while (true) {
-    const metadata = JSON.stringify({
-      version: 1,
-      pid: process.pid,
-      hostname: hostname(),
-      createdAt: Date.now(),
-      instanceId: randomBytes(16).toString('hex'),
-    } satisfies CredentialsLockMetadata)
-    const tempPath = join(
-      dir,
-      `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`
-    )
+  try {
+    const fd = openSync(tempPath, 'wx', 0o600)
+    try {
+      writeFileSync(fd, metadata, 'utf8')
+      fsyncSync(fd)
+      chmodSync(tempPath, 0o600)
+    } finally {
+      closeSync(fd)
+    }
 
     try {
-      const fd = openSync(tempPath, 'wx', 0o600)
-      try {
-        writeFileSync(fd, metadata, 'utf8')
-        fsyncSync(fd)
-        chmodSync(tempPath, 0o600)
-      } finally {
-        closeSync(fd)
-      }
+      // link(2) publishes the already-complete inode without replacing an
+      // existing owner. No contender ever unlinks the canonical lock.
+      linkSync(tempPath, lockPath)
+    } catch (error) {
+      if (isNodeError(error) && error.code === 'EEXIST') return null
+      throw error
+    }
 
-      try {
-        // link(2) publishes the already-complete inode without replacing an
-        // existing owner. No contender ever unlinks the canonical lock.
-        linkSync(tempPath, lockPath)
-      } catch (error) {
-        if (!(isNodeError(error) && error.code === 'EEXIST')) throw error
-        if (Date.now() >= deadline) {
-          throw new Error(
-            `ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`
-          )
-        }
-        sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())))
-        continue
-      }
+    let resolveReleased = () => {}
+    const released = new Promise<void>(resolve => { resolveReleased = resolve })
+    return { path: lockPath, metadata, depth: 1, released, resolveReleased }
+  } finally {
+    // The unique owner-only preparation link is never retained, whether
+    // publication succeeds, loses to an owner, or fails unexpectedly.
+    rmSync(tempPath, { force: true })
+  }
+}
 
-      let resolveReleased = () => {}
-      const released = new Promise<void>(resolve => { resolveReleased = resolve })
-      return { path: lockPath, metadata, depth: 1, released, resolveReleased }
-    } finally {
-      // The unique owner-only preparation link is never retained, whether
-      // publication succeeds, loses to an owner, or fails unexpectedly.
-      rmSync(tempPath, { force: true })
-    }
+/** Blocks the process between tries; only for synchronous writers. */
+function acquireCredentialsLock(): HeldCredentialsLock {
+  const timeoutMs = credentialsLockTimeoutMs()
+  const deadline = Date.now() + timeoutMs
+  while (true) {
+    const lock = tryAcquireCredentialsLock()
+    if (lock) return lock
+    if (Date.now() >= deadline) throw credentialsLockTimeoutError(timeoutMs)
+    sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())))
   }
 }
 
-function releaseCredentialsLock(lock: HeldCredentialsLock): void {
+export function releaseCredentialsLock(lock: HeldCredentialsLock): void {
   let currentMetadata: string
   try {
     currentMetadata = readFileSync(lock.path, 'utf8')
@@ -183,15 +205,26 @@ export function withCredentialsTransactionLock<T>(operation: () => T): T {
 
   const lock = acquireCredentialsLock()
   heldCredentialsLock = lock
+  let failed = false
   try {
     return operation()
+  } catch (error) {
+    failed = true
+    throw error
   } finally {
     heldCredentialsLock = null
-    try {
-      releaseCredentialsLock(lock)
-    } finally {
-      lock.resolveReleased()
-    }
+    endTransaction(lock, failed)
+  }
+}
+
+/** Release the lock if it is still ours. A release error never hides the transaction's own error. */
+function endTransaction(lock: HeldCredentialsLock, failed: boolean): void {
+  try {
+    releaseCredentialsLock(lock)
+  } catch (releaseError) {
+    if (!failed) throw releaseError
+  } finally {
+    lock.resolveReleased()
   }
 }
 
@@ -201,7 +234,10 @@ export function withCredentialsTransactionLock<T>(operation: () => T): T {
  * async execution context; unrelated same-process work must wait or fail.
  */
 export async function withCredentialsTransactionLockAsync<T>(
-  operation: () => Promise<T>
+  operation: () => Promise<T>,
+  // How to wait for the cross-process lock. The default blocks the process
+  // between tries; stored-login commands pass credentials-transaction.ts's.
+  acquire: () => HeldCredentialsLock | Promise<HeldCredentialsLock> = acquireCredentialsLock
 ): Promise<T> {
   const lockPath = getCredentialsLockPath()
   const currentOwner = credentialsTransactionOwner.getStore()
@@ -218,38 +254,30 @@ export async function withCredentialsTransactionLockAsync<T>(
       }
     }
 
-    const timeoutMs = readLockDuration(
-      'ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS',
-      DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS,
-      MAX_CREDENTIALS_LOCK_TIMEOUT_MS
-    )
+    const timeoutMs = credentialsLockTimeoutMs()
     let timer: ReturnType<typeof setTimeout> | undefined
     const didRelease = await Promise.race([
       heldCredentialsLock.released.then(() => true),
       new Promise<false>(resolve => { timer = setTimeout(() => resolve(false), timeoutMs) }),
     ])
     if (timer) clearTimeout(timer)
-    if (!didRelease) {
-      throw new Error(
-        `ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`
-      )
-    }
-    return await withCredentialsTransactionLockAsync(operation)
+    if (!didRelease) throw credentialsLockTimeoutError(timeoutMs)
+    return await withCredentialsTransactionLockAsync(operation, acquire)
   }
 
-  const lock = acquireCredentialsLock()
+  const lock = await acquire()
   const owner = Symbol('credentials-transaction-owner')
   lock.asyncOwner = owner
   heldCredentialsLock = lock
+  let failed = false
   try {
     return await credentialsTransactionOwner.run(owner, operation)
+  } catch (error) {
+    failed = true
+    throw error
   } finally {
     heldCredentialsLock = null
-    try {
-      releaseCredentialsLock(lock)
-    } finally {
-      lock.resolveReleased()
-    }
+    endTransaction(lock, failed)
   }
 }
 
@@ -319,18 +347,26 @@ function writeCredentials(config: StoredCredentialsV2 | StoredCredentialsV3) {
   const payload = JSON.stringify(config, null, 2) + '\n'
 
   try {
-    const fd = openSync(tempPath, 'wx', 0o600)
     try {
-      writeFileSync(fd, payload, 'utf-8')
-      fsyncSync(fd)
-    } finally {
-      closeSync(fd)
-    }
+      const fd = openSync(tempPath, 'wx', 0o600)
+      try {
+        writeFileSync(fd, payload, 'utf-8')
+        fsyncSync(fd)
+      } finally {
+        closeSync(fd)
+      }
 
-    chmodSync(tempPath, 0o600)
-    // Never delete the destination to emulate replacement. If this platform
-    // cannot atomically replace it, preserve the old file and surface the error.
-    renameSync(tempPath, path)
+      chmodSync(tempPath, 0o600)
+      // Never delete the destination to emulate replacement. If this platform
+      // cannot atomically replace it, preserve the old file and surface the error.
+      renameSync(tempPath, path)
+    } catch (error) {
+      // Until the rename succeeds the saved file is untouched.
+      throw new Error(
+        `ORIZU_CREDENTIALS_WRITE_FAILED: could not save sign-ins to ${path} (${errorCode(error)}). The saved file is unchanged.`,
+        { cause: error }
+      )
+    }
     chmodSync(path, 0o600)
   } finally {
     // On success rename has already removed this path; on every error this
@@ -347,11 +383,17 @@ function createEmptyCredentialsConfig(): StoredCredentialsV3 {
   }
 }
 
+// A missing file, invalid JSON or an unknown format start empty (the "log in
+// again" recovery). A file that exists but cannot be read is never replaced:
+// that would delete every other saved sign-in.
 function loadCredentialsConfigForWrite(): StoredCredentialsV2 | StoredCredentialsV3 {
   try {
     return loadCredentialsConfig() || createEmptyCredentialsConfig()
-  } catch {
-    return createEmptyCredentialsConfig()
+  } catch (error) {
+    throw new Error(
+      `ORIZU_CREDENTIALS_READ_FAILED: could not read ${getCredentialsPath()} (${errorCode(error)}). Saved sign-ins were not changed. Move it aside, then run \`orizu login\` again.`,
+      { cause: error }
+    )
   }
 }
 
@@ -387,6 +429,30 @@ export function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentials
   return null
 }
 
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0
+}
+
+/**
+ * A saved sign-in this CLI can use: a session (it has an access token) or an
+ * API key. Plain code, not Effect Schema: this file is loaded by every
+ * command, including hosted sessions signed with ORIZU_TOKEN, which must never
+ * load Effect.
+ */
+function isServerCredentials(value: unknown): value is ServerCredentials {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
+  const entry = value as Record<string, unknown>
+  if ('accessToken' in entry) {
+    return isNonEmptyString(entry.accessToken)
+      && isNonEmptyString(entry.refreshToken)
+      && typeof entry.expiresAt === 'number'
+      && Number.isFinite(entry.expiresAt)
+  }
+  return isNonEmptyString(entry.apiKey)
+}
+
+const warnedUnreadableServers = new Set<string>()
+
 export function getServerCredentials(baseUrl: string): ServerCredentials | null {
   const config = loadCredentialsConfig()
   if (!config) {
@@ -397,7 +463,19 @@ export function getServerCredentials(baseUrl: string): ServerCredentials | null
     return null
   }
 
-  return config.servers[baseUrl] || null
+  const entry: unknown = config.servers[baseUrl]
+  if (entry === null || entry === undefined) return null
+  if (!isServerCredentials(entry)) {
+    // Never the value: a hand-edited file may hold a token here (ORI-2675).
+    if (!warnedUnreadableServers.has(baseUrl)) {
+      warnedUnreadableServers.add(baseUrl)
+      console.warn(
+        `Warning: the saved sign-in for ${baseUrl} is not in a format this CLI understands. Run \`orizu login --server ${baseUrl}\` to replace it, or \`orizu logout --server ${baseUrl}\` to remove it.`
+      )
+    }
+    return null
+  }
+  return entry
 }
 
 export function saveServerCredentials(baseUrl: string, credentials: ServerCredentials) {
@@ -433,6 +511,8 @@ export function updateServerCredentials(baseUrl: string, credentials: ServerCred
 }
 
 export function credentialsEqual(left: ServerCredentials, right: ServerCredentials): boolean {
+  // Entries read straight from the file may be malformed; those never match.
+  if (!isServerCredentials(left) || !isServerCredentials(right)) return false
   if ('apiKey' in left || 'apiKey' in right) {
     return 'apiKey' in left && 'apiKey' in right && left.apiKey === right.apiKey
   }
@@ -457,9 +537,29 @@ export function updateServerCredentialsIfCurrent(
   })
 }
 
+function isServerAddress(value: unknown): value is string {
+  if (typeof value !== 'string') return false
+  try {
+    normalizeBaseUrl(value)
+    return true
+  } catch {
+    return false
+  }
+}
+
+// Never the value: the "Invalid server URL" error would print it (ORI-2675).
+// No fallback to the default server either: with an app.orizu.ai sign-in
+// saved, that would run the command as a different account.
+function unreadableActiveServerError(): Error {
+  return new Error('The saved server in credentials.json isn\'t a valid address. Run `orizu login --server <url>`.')
+}
+
 export function getActiveBaseUrl(): string | null {
   const config = loadCredentialsConfig()
-  return config?.activeBaseUrl || null
+  const active: unknown = config?.activeBaseUrl
+  if (active === null || active === undefined || active === '') return null
+  if (isServerAddress(active)) return active
+  throw unreadableActiveServerError()
 }
 
 /** Resolve the selected server and move a retired production credential atomically. */
@@ -476,7 +576,11 @@ export function resolveCredentialServer(selected?: string): string | null {
   return withCredentialsTransactionLock(() => {
     const config = loadCredentialsConfig()
     // Another process may have selected a different server while we waited.
-    const currentSource = selected ?? config?.activeBaseUrl
+    const storedSource: unknown = config?.activeBaseUrl
+    if (!selected && storedSource !== null && storedSource !== undefined && storedSource !== '' && !isServerAddress(storedSource)) {
+      throw unreadableActiveServerError()
+    }
+    const currentSource = selected ?? (isServerAddress(storedSource) ? storedSource : null)
     if (!currentSource) return null
     const currentTarget = canonicalServerUrl(currentSource)
     if (!config || normalizeBaseUrl(currentSource) === currentTarget) return currentTarget
@@ -645,6 +749,24 @@ export function clearServerCredentials(baseUrl: string): boolean {
   })
 }
 
+/**
+ * Remove a saved sign-in this CLI cannot read (it may be a pasted token).
+ * Returns false when there is none, or when it has become readable since.
+ */
+export function clearUnreadableServerCredentials(baseUrl: string): boolean {
+  return withCredentialsTransactionLock(() => {
+    const config = loadCredentialsConfig()
+    if (!config || !Object.hasOwn(config.servers, baseUrl)) return false
+    const entry: unknown = config.servers[baseUrl]
+    if (entry === null || entry === undefined || isServerCredentials(entry)) return false
+
+    delete config.servers[baseUrl]
+    if (config.activeBaseUrl === baseUrl) config.activeBaseUrl = null
+    writeCredentials(config)
+    return true
+  })
+}
+
 export function clearCredentialsFile() {
   return withCredentialsTransactionLock(() => {
     const path = getCredentialsPath()

package/src/dataset-transfer-upload.ts

@@ -52,6 +52,12 @@ function isAuthContextChange(cause: unknown) {
   return cause instanceof Error && cause.message.startsWith('ORIZU_AUTH_CONTEXT_CHANGED:')
 }
 
+// authedFetch sets this when the server answered 401 and the sign-in refresh
+// then failed, so the request was not sent again: nothing was written.
+function isRequestRejected(cause: unknown) {
+  return cause instanceof Error && (cause as { requestRejected?: unknown }).requestRejected === true
+}
+
 // Only the existing authentication client's rejected-token refresh may replay a
 // request. No transient/transport retries belong around these non-idempotent writes.
 function post<T>(path: string, body: unknown, context: string, prefix: string, timeoutMs: number): Effect.Effect<T, DatasetWriteFailure> {
@@ -69,7 +75,7 @@ function post<T>(path: string, body: unknown, context: string, prefix: string, t
         return await parseJsonResponse<T>(response, context)
       },
       catch: cause => cause instanceof DatasetWriteFailure ? cause : new DatasetWriteFailure(
-        cause instanceof Error ? cause.message : String(cause), requestStarted && !isAuthContextChange(cause) ? 'unknown' : 'rejected', { cause },
+        cause instanceof Error ? cause.message : String(cause), requestStarted && !isAuthContextChange(cause) && !isRequestRejected(cause) ? 'unknown' : 'rejected', { cause },
       ),
     }).pipe(Effect.timeoutOrElse({
       duration: timeoutMs,