orizu 0.5.50 → 0.5.51

package/dist/auth-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AA6BA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AAwBD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAmC5C;AAoHD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}
+{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AA6BA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AA4BD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAoC5C;AAoHD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}

package/dist/auth-commands.js

@@ -101,6 +101,9 @@ function resolveAuthCallbackPort() {
     }
     return parsed;
 }
+function isCredentialsFileFailure(message) {
+    return message.startsWith('ORIZU_CREDENTIALS_READ_FAILED:') || message.startsWith('ORIZU_CREDENTIALS_WRITE_FAILED:');
+}
 async function login(baseUrlOverride) {
     const target = baseUrlOverride !== undefined
         ? { baseUrl: baseUrlOverride, isDefault: false }
@@ -113,14 +116,15 @@ async function login(baseUrlOverride) {
         loginData = await authenticateAtBaseUrl(baseUrl);
         if (!loginData)
             return;
-        saveServerCredentials(baseUrl, {
-            credentialType: 'pat',
-            apiKey: loginData.apiKey,
-        });
+        const apiKey = loginData.apiKey;
+        // Waits for the lock without freezing the CLI (ORI-2421).
+        const { withCredentialsTransaction } = await import('./credentials-transaction.js');
+        await withCredentialsTransaction(async () => saveServerCredentials(baseUrl, { credentialType: 'pat', apiKey }));
     }
     catch (error) {
-        if (target.isDefault) {
-            const detail = error instanceof Error ? error.message : String(error);
+        const detail = error instanceof Error ? error.message : String(error);
+        // Reading or saving credentials.json is a disk problem, not a connection one.
+        if (target.isDefault && !isCredentialsFileFailure(detail)) {
             throw new Error(`${detail} Check connectivity to https://app.orizu.ai, then retry \`orizu login\`.`, { cause: error });
         }
         throw error;

package/dist/credentials-transaction.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A credentials transaction whose wait for the lock stays responsive. The
+ * in-process rules are credentials.ts's: one holder per process, and nested
+ * writes only from the holder's own async context.
+ */
+export declare function withCredentialsTransaction<T>(operation: () => Promise<T>, signal?: AbortSignal | null): Promise<T>;
+//# sourceMappingURL=credentials-transaction.d.ts.map

package/dist/credentials-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-transaction.d.ts","sourceRoot":"","sources":["../src/credentials-transaction.ts"],"names":[],"mappings":"AA8DA;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAC1B,OAAO,CAAC,CAAC,CAAC,CAEZ"}

package/dist/credentials-transaction.js

@@ -0,0 +1,60 @@
+// Waiting for the credentials lock without freezing the process (ORI-2421).
+// Loaded only by stored-login code (refresh, logout, login), never on the
+// ORIZU_TOKEN / ORIZU_TOKEN_FILE path, which must not load Effect.
+import { Cause, Effect, Exit } from 'effect';
+import { CREDENTIALS_LOCK_RETRY_MS, credentialsLockTimeoutError, credentialsLockTimeoutMs, releaseCredentialsLock, tryAcquireCredentialsLock, withCredentialsTransactionLockAsync, } from './credentials.js';
+/**
+ * Try the lock, sleep, try again, until ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS.
+ * Timers and stop handlers keep running while it waits, and `signal` stops
+ * the wait. A try is one synchronous step, so a stop never lands inside it.
+ * A lock a try takes is noted at once, and handed back if the run then ends
+ * any way other than returning it, wherever a stop lands.
+ */
+function acquireLock(signal) {
+    const timeoutMs = credentialsLockTimeoutMs();
+    const deadline = Date.now() + timeoutMs;
+    let taken = null;
+    const attempt = Effect.try({
+        try: () => (taken = tryAcquireCredentialsLock()),
+        catch: cause => cause instanceof Error ? cause : new Error(String(cause)),
+    });
+    const program = Effect.gen(function* () {
+        while (true) {
+            const lock = yield* attempt;
+            if (lock)
+                return lock;
+            const remainingMs = deadline - Date.now();
+            if (remainingMs <= 0)
+                return yield* Effect.fail(credentialsLockTimeoutError(timeoutMs));
+            yield* Effect.sleep(Math.min(CREDENTIALS_LOCK_RETRY_MS, remainingMs));
+        }
+    });
+    return run(program, signal, () => {
+        if (!taken)
+            return;
+        try {
+            releaseCredentialsLock(taken);
+        }
+        catch {
+            // The stop or failure is what the caller needs to see.
+        }
+    });
+}
+/** A stop by `signal` rejects with its reason, as an aborted fetch would. */
+async function run(program, signal, onNotReturned) {
+    const exit = await Effect.runPromiseExit(program, signal ? { signal } : undefined);
+    if (Exit.isSuccess(exit))
+        return exit.value;
+    onNotReturned();
+    if (signal?.aborted && Cause.hasInterruptsOnly(exit.cause))
+        throw signal.reason;
+    throw Cause.squash(exit.cause);
+}
+/**
+ * A credentials transaction whose wait for the lock stays responsive. The
+ * in-process rules are credentials.ts's: one holder per process, and nested
+ * writes only from the holder's own async context.
+ */
+export function withCredentialsTransaction(operation, signal) {
+    return withCredentialsTransactionLockAsync(operation, () => acquireLock(signal));
+}

package/dist/credentials.d.ts

@@ -1,5 +1,23 @@
 import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
 export declare function getConfigDir(): string;
+export declare const CREDENTIALS_LOCK_RETRY_MS = 20;
+export interface HeldCredentialsLock {
+    path: string;
+    metadata: string;
+    depth: number;
+    asyncOwner?: symbol;
+    released: Promise<void>;
+    resolveReleased: () => void;
+}
+export declare function credentialsLockTimeoutMs(): number;
+export declare function credentialsLockTimeoutError(timeoutMs: number): Error;
+/**
+ * One try at the cross-process lock. Returns null when another owner holds
+ * it. The waits between tries belong to the caller: a blocking one below for
+ * synchronous writers, an Effect sleep in credentials-transaction.ts.
+ */
+export declare function tryAcquireCredentialsLock(): HeldCredentialsLock | null;
+export declare function releaseCredentialsLock(lock: HeldCredentialsLock): void;
 /**
  * Runs a synchronous credentials transaction under the one process-wide and
  * cross-process lock. Exported so real-process fixtures can hold the production
@@ -11,7 +29,7 @@ export declare function withCredentialsTransactionLock<T>(operation: () => T): T
  * synchronous credential writes are admitted only from this transaction's
  * async execution context; unrelated same-process work must wait or fail.
  */
-export declare function withCredentialsTransactionLockAsync<T>(operation: () => Promise<T>): Promise<T>;
+export declare function withCredentialsTransactionLockAsync<T>(operation: () => Promise<T>, acquire?: () => HeldCredentialsLock | Promise<HeldCredentialsLock>): Promise<T>;
 export declare function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null;
 export declare function getServerCredentials(baseUrl: string): ServerCredentials | null;
 export declare function saveServerCredentials(baseUrl: string, credentials: ServerCredentials): void;

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAMnB,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AA0HD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AA0BD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAuB9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAS3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAmBD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAMhD;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyCxE;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYzE;AAED,wBAAgB,oBAAoB,SAKnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAYnB,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAQD,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAU3C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,eAAe,EAAE,MAAM,IAAI,CAAA;CAC5B;AAsBD,wBAAgB,wBAAwB,IAAI,MAAM,CAMjD;AAED,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,GAAG,IAAI,CA6CtE;AAcD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAWtE;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAaD;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAG3B,OAAO,GAAE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAA0B,GACzF,OAAO,CAAC,CAAC,CAAC,CAyCZ;AAsHD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AA0BD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAuB9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAS3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAmBD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAMhD;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyCxE;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYzE;AAED,wBAAgB,oBAAoB,SAKnC"}

package/dist/credentials.js

@@ -9,6 +9,11 @@ import { canonicalServerUrl, normalizeBaseUrl } from './global-flags.js';
 function isNodeError(error) {
     return error instanceof Error;
 }
+// The system's short error code (EACCES, EPERM), never the message: messages
+// from fs calls carry paths, and this one goes to the terminal.
+function errorCode(error) {
+    return isNodeError(error) && typeof error.code === 'string' ? error.code : 'unknown error';
+}
 export function getConfigDir() {
     if (process.env.ORIZU_CONFIG_DIR) {
         return process.env.ORIZU_CONFIG_DIR;
@@ -20,7 +25,7 @@ function getCredentialsPath() {
 }
 const DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS = 2_000;
 const MAX_CREDENTIALS_LOCK_TIMEOUT_MS = 10_000;
-const CREDENTIALS_LOCK_RETRY_MS = 20;
+export const CREDENTIALS_LOCK_RETRY_MS = 20;
 let heldCredentialsLock = null;
 const credentialsTransactionOwner = new AsyncLocalStorage();
 function getCredentialsLockPath() {
@@ -38,58 +43,74 @@ function readLockDuration(name, fallback, maximum = Number.MAX_SAFE_INTEGER) {
 function sleepSync(milliseconds) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
 }
-function acquireCredentialsLock() {
+export function credentialsLockTimeoutMs() {
+    return readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+}
+export function credentialsLockTimeoutError(timeoutMs) {
+    return new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
+}
+/**
+ * One try at the cross-process lock. Returns null when another owner holds
+ * it. The waits between tries belong to the caller: a blocking one below for
+ * synchronous writers, an Effect sleep in credentials-transaction.ts.
+ */
+export function tryAcquireCredentialsLock() {
     const dir = getConfigDir();
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     chmodSync(dir, 0o700);
     const lockPath = getCredentialsLockPath();
-    const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
-    const deadline = Date.now() + timeoutMs;
-    while (true) {
-        const metadata = JSON.stringify({
-            version: 1,
-            pid: process.pid,
-            hostname: hostname(),
-            createdAt: Date.now(),
-            instanceId: randomBytes(16).toString('hex'),
-        });
-        const tempPath = join(dir, `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+    const metadata = JSON.stringify({
+        version: 1,
+        pid: process.pid,
+        hostname: hostname(),
+        createdAt: Date.now(),
+        instanceId: randomBytes(16).toString('hex'),
+    });
+    const tempPath = join(dir, `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+    try {
+        const fd = openSync(tempPath, 'wx', 0o600);
         try {
-            const fd = openSync(tempPath, 'wx', 0o600);
-            try {
-                writeFileSync(fd, metadata, 'utf8');
-                fsyncSync(fd);
-                chmodSync(tempPath, 0o600);
-            }
-            finally {
-                closeSync(fd);
-            }
-            try {
-                // link(2) publishes the already-complete inode without replacing an
-                // existing owner. No contender ever unlinks the canonical lock.
-                linkSync(tempPath, lockPath);
-            }
-            catch (error) {
-                if (!(isNodeError(error) && error.code === 'EEXIST'))
-                    throw error;
-                if (Date.now() >= deadline) {
-                    throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
-                }
-                sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())));
-                continue;
-            }
-            let resolveReleased = () => { };
-            const released = new Promise(resolve => { resolveReleased = resolve; });
-            return { path: lockPath, metadata, depth: 1, released, resolveReleased };
+            writeFileSync(fd, metadata, 'utf8');
+            fsyncSync(fd);
+            chmodSync(tempPath, 0o600);
         }
         finally {
-            // The unique owner-only preparation link is never retained, whether
-            // publication succeeds, loses to an owner, or fails unexpectedly.
-            rmSync(tempPath, { force: true });
+            closeSync(fd);
+        }
+        try {
+            // link(2) publishes the already-complete inode without replacing an
+            // existing owner. No contender ever unlinks the canonical lock.
+            linkSync(tempPath, lockPath);
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === 'EEXIST')
+                return null;
+            throw error;
         }
+        let resolveReleased = () => { };
+        const released = new Promise(resolve => { resolveReleased = resolve; });
+        return { path: lockPath, metadata, depth: 1, released, resolveReleased };
+    }
+    finally {
+        // The unique owner-only preparation link is never retained, whether
+        // publication succeeds, loses to an owner, or fails unexpectedly.
+        rmSync(tempPath, { force: true });
     }
 }
-function releaseCredentialsLock(lock) {
+/** Blocks the process between tries; only for synchronous writers. */
+function acquireCredentialsLock() {
+    const timeoutMs = credentialsLockTimeoutMs();
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        const lock = tryAcquireCredentialsLock();
+        if (lock)
+            return lock;
+        if (Date.now() >= deadline)
+            throw credentialsLockTimeoutError(timeoutMs);
+        sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())));
+    }
+}
+export function releaseCredentialsLock(lock) {
     let currentMetadata;
     try {
         currentMetadata = readFileSync(lock.path, 'utf8');
@@ -129,17 +150,30 @@ export function withCredentialsTransactionLock(operation) {
     }
     const lock = acquireCredentialsLock();
     heldCredentialsLock = lock;
+    let failed = false;
     try {
         return operation();
     }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
     finally {
         heldCredentialsLock = null;
-        try {
-            releaseCredentialsLock(lock);
-        }
-        finally {
-            lock.resolveReleased();
-        }
+        endTransaction(lock, failed);
+    }
+}
+/** Release the lock if it is still ours. A release error never hides the transaction's own error. */
+function endTransaction(lock, failed) {
+    try {
+        releaseCredentialsLock(lock);
+    }
+    catch (releaseError) {
+        if (!failed)
+            throw releaseError;
+    }
+    finally {
+        lock.resolveReleased();
     }
 }
 /**
@@ -147,7 +181,10 @@ export function withCredentialsTransactionLock(operation) {
  * synchronous credential writes are admitted only from this transaction's
  * async execution context; unrelated same-process work must wait or fail.
  */
-export async function withCredentialsTransactionLockAsync(operation) {
+export async function withCredentialsTransactionLockAsync(operation, 
+// How to wait for the cross-process lock. The default blocks the process
+// between tries; stored-login commands pass credentials-transaction.ts's.
+acquire = acquireCredentialsLock) {
     const lockPath = getCredentialsLockPath();
     const currentOwner = credentialsTransactionOwner.getStore();
     if (heldCredentialsLock) {
@@ -163,7 +200,7 @@ export async function withCredentialsTransactionLockAsync(operation) {
                 heldCredentialsLock.depth -= 1;
             }
         }
-        const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+        const timeoutMs = credentialsLockTimeoutMs();
         let timer;
         const didRelease = await Promise.race([
             heldCredentialsLock.released.then(() => true),
@@ -171,26 +208,25 @@ export async function withCredentialsTransactionLockAsync(operation) {
         ]);
         if (timer)
             clearTimeout(timer);
-        if (!didRelease) {
-            throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
-        }
-        return await withCredentialsTransactionLockAsync(operation);
+        if (!didRelease)
+            throw credentialsLockTimeoutError(timeoutMs);
+        return await withCredentialsTransactionLockAsync(operation, acquire);
     }
-    const lock = acquireCredentialsLock();
+    const lock = await acquire();
     const owner = Symbol('credentials-transaction-owner');
     lock.asyncOwner = owner;
     heldCredentialsLock = lock;
+    let failed = false;
     try {
         return await credentialsTransactionOwner.run(owner, operation);
     }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
     finally {
         heldCredentialsLock = null;
-        try {
-            releaseCredentialsLock(lock);
-        }
-        finally {
-            lock.resolveReleased();
-        }
+        endTransaction(lock, failed);
     }
 }
 function assertCredentialsLockHeld() {
@@ -244,18 +280,24 @@ function writeCredentials(config) {
     const tempPath = join(dir, `.credentials.json.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
     const payload = JSON.stringify(config, null, 2) + '\n';
     try {
-        const fd = openSync(tempPath, 'wx', 0o600);
         try {
-            writeFileSync(fd, payload, 'utf-8');
-            fsyncSync(fd);
+            const fd = openSync(tempPath, 'wx', 0o600);
+            try {
+                writeFileSync(fd, payload, 'utf-8');
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            chmodSync(tempPath, 0o600);
+            // Never delete the destination to emulate replacement. If this platform
+            // cannot atomically replace it, preserve the old file and surface the error.
+            renameSync(tempPath, path);
         }
-        finally {
-            closeSync(fd);
+        catch (error) {
+            // Until the rename succeeds the saved file is untouched.
+            throw new Error(`ORIZU_CREDENTIALS_WRITE_FAILED: could not save sign-ins to ${path} (${errorCode(error)}). The saved file is unchanged.`, { cause: error });
         }
-        chmodSync(tempPath, 0o600);
-        // Never delete the destination to emulate replacement. If this platform
-        // cannot atomically replace it, preserve the old file and surface the error.
-        renameSync(tempPath, path);
         chmodSync(path, 0o600);
     }
     finally {
@@ -271,12 +313,15 @@ function createEmptyCredentialsConfig() {
         servers: {},
     };
 }
+// A missing file, invalid JSON or an unknown format start empty (the "log in
+// again" recovery). A file that exists but cannot be read is never replaced:
+// that would delete every other saved sign-in.
 function loadCredentialsConfigForWrite() {
     try {
         return loadCredentialsConfig() || createEmptyCredentialsConfig();
     }
-    catch {
-        return createEmptyCredentialsConfig();
+    catch (error) {
+        throw new Error(`ORIZU_CREDENTIALS_READ_FAILED: could not read ${getCredentialsPath()} (${errorCode(error)}). Saved sign-ins were not changed. Move it aside, then run \`orizu login\` again.`, { cause: error });
     }
 }
 export function loadCredentialsConfig() {

package/dist/stored-session-requests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stored-session-requests.d.ts","sourceRoot":"","sources":["../src/stored-session-requests.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAA4B,MAAM,YAAY,CAAA;AA6MxE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,iBAAiB,CAAA;IAC9B,YAAY,EAAE,OAAO,CAAA;IACrB,2GAA2G;IAC3G,oBAAoB,EAAE,MAAM,CAAA;IAC5B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,iGAAiG;IACjG,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,IAAI,CAAA;CACvD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,EACjB,cAAc,CAAC,EAAE,MAAM,IAAI,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAiCnB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,sBAAsB,EAAE,OAAO,CAAA;CAChC;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,iBAAiB,EAC9B,YAAY,CAAC,EAAE,WAAW,GAAG,IAAI,GAChC,OAAO,CAAC,YAAY,CAAC,CA4BvB"}
+{"version":3,"file":"stored-session-requests.d.ts","sourceRoot":"","sources":["../src/stored-session-requests.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAA4B,MAAM,YAAY,CAAA;AA+MxE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,iBAAiB,CAAA;IAC9B,YAAY,EAAE,OAAO,CAAA;IACrB,2GAA2G;IAC3G,oBAAoB,EAAE,MAAM,CAAA;IAC5B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,iGAAiG;IACjG,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,IAAI,CAAA;CACvD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,EACjB,cAAc,CAAC,EAAE,MAAM,IAAI,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAiCnB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,sBAAsB,EAAE,OAAO,CAAA;CAChC;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,iBAAiB,EAC9B,YAAY,CAAC,EAAE,WAAW,GAAG,IAAI,GAChC,OAAO,CAAC,YAAY,CAAC,CA6BvB"}

package/dist/stored-session-requests.js

@@ -1,5 +1,6 @@
 import { Cause, Effect, Exit, Result, Schema } from 'effect';
-import { clearServerCredentialsIfCurrent, credentialsEqual, getServerCredentials, rememberResolvedBearer, updateServerCredentialsIfCurrent, withCredentialsTransactionLockAsync, } from './credentials.js';
+import { clearServerCredentialsIfCurrent, credentialsEqual, getServerCredentials, rememberResolvedBearer, updateServerCredentialsIfCurrent, } from './credentials.js';
+import { withCredentialsTransaction } from './credentials-transaction.js';
 import { assertSecureTokenTransport, credentialRequestRedirectPolicy } from './http.js';
 import { describeLogoutHttpFailure, describeLogoutTransportFailure } from './logout-diagnostic.js';
 // Requests signed with a stored login (`orizu login`): the sign-in refresh, the
@@ -156,7 +157,9 @@ async function refreshStoredCredentialsIfCurrent(baseUrl, expected, callerSignal
     const stop = lockStopWindow(callerSignal);
     stop.listen();
     try {
-        return await withCredentialsTransactionLockAsync(async () => {
+        // A stop or the caller's cancel also ends the wait for the lock.
+        const waitSignal = callerSignal ? AbortSignal.any([callerSignal, stop.signal]) : stop.signal;
+        return await withCredentialsTransaction(async () => {
             const current = getServerCredentials(baseUrl);
             if (!current || !credentialsEqual(current, expected)) {
                 return { status: 'changed', credentials: current };
@@ -167,7 +170,7 @@ async function refreshStoredCredentialsIfCurrent(baseUrl, expected, callerSignal
                 return { status: 'changed', credentials: getServerCredentials(baseUrl) };
             }
             return { status: 'refreshed', credentials: refreshed };
-        });
+        }, waitSignal);
     }
     finally {
         stop.unlisten();
@@ -259,6 +262,7 @@ export async function storedLogout(baseUrl, credentialKey, credentials, callerSi
     catch (error) {
         remoteError = describeLogoutTransportFailure(error, secrets);
     }
-    const localCredentialCleared = clearServerCredentialsIfCurrent(credentialKey, credentials);
+    // Not stopped by the caller's cancel: a cancelled logout still removes the login, as before.
+    const localCredentialCleared = await withCredentialsTransaction(async () => clearServerCredentialsIfCurrent(credentialKey, credentials));
     return { remoteError, localCredentialCleared };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.50",
+  "version": "0.5.51",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",

package/src/auth-commands.ts

@@ -142,6 +142,10 @@ interface AuthenticatedLoginResponse extends LoginResponse {
   apiKey: string
 }
 
+function isCredentialsFileFailure(message: string): boolean {
+  return message.startsWith('ORIZU_CREDENTIALS_READ_FAILED:') || message.startsWith('ORIZU_CREDENTIALS_WRITE_FAILED:')
+}
+
 async function login(baseUrlOverride?: string) {
   const target = baseUrlOverride !== undefined
     ? { baseUrl: baseUrlOverride, isDefault: false }
@@ -153,13 +157,14 @@ async function login(baseUrlOverride?: string) {
   try {
     loginData = await authenticateAtBaseUrl(baseUrl)
     if (!loginData) return
-    saveServerCredentials(baseUrl, {
-      credentialType: 'pat',
-      apiKey: loginData.apiKey,
-    })
+    const apiKey = loginData.apiKey
+    // Waits for the lock without freezing the CLI (ORI-2421).
+    const { withCredentialsTransaction } = await import('./credentials-transaction.js')
+    await withCredentialsTransaction(async () => saveServerCredentials(baseUrl, { credentialType: 'pat', apiKey }))
   } catch (error) {
-    if (target.isDefault) {
-      const detail = error instanceof Error ? error.message : String(error)
+    const detail = error instanceof Error ? error.message : String(error)
+    // Reading or saving credentials.json is a disk problem, not a connection one.
+    if (target.isDefault && !isCredentialsFileFailure(detail)) {
       throw new Error(
         `${detail} Check connectivity to https://app.orizu.ai, then retry \`orizu login\`.`,
         { cause: error }

package/src/credentials-transaction.ts

@@ -0,0 +1,73 @@
+// Waiting for the credentials lock without freezing the process (ORI-2421).
+// Loaded only by stored-login code (refresh, logout, login), never on the
+// ORIZU_TOKEN / ORIZU_TOKEN_FILE path, which must not load Effect.
+import { Cause, Effect, Exit } from 'effect'
+
+import {
+  CREDENTIALS_LOCK_RETRY_MS,
+  credentialsLockTimeoutError,
+  credentialsLockTimeoutMs,
+  type HeldCredentialsLock,
+  releaseCredentialsLock,
+  tryAcquireCredentialsLock,
+  withCredentialsTransactionLockAsync,
+} from './credentials.js'
+
+/**
+ * Try the lock, sleep, try again, until ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS.
+ * Timers and stop handlers keep running while it waits, and `signal` stops
+ * the wait. A try is one synchronous step, so a stop never lands inside it.
+ * A lock a try takes is noted at once, and handed back if the run then ends
+ * any way other than returning it, wherever a stop lands.
+ */
+function acquireLock(signal: AbortSignal | null | undefined): Promise<HeldCredentialsLock> {
+  const timeoutMs = credentialsLockTimeoutMs()
+  const deadline = Date.now() + timeoutMs
+  let taken: HeldCredentialsLock | null = null
+  const attempt = Effect.try({
+    try: () => (taken = tryAcquireCredentialsLock()),
+    catch: cause => cause instanceof Error ? cause : new Error(String(cause)),
+  })
+  const program = Effect.gen(function*() {
+    while (true) {
+      const lock = yield* attempt
+      if (lock) return lock
+      const remainingMs = deadline - Date.now()
+      if (remainingMs <= 0) return yield* Effect.fail(credentialsLockTimeoutError(timeoutMs))
+      yield* Effect.sleep(Math.min(CREDENTIALS_LOCK_RETRY_MS, remainingMs))
+    }
+  })
+  return run(program, signal, () => {
+    if (!taken) return
+    try {
+      releaseCredentialsLock(taken)
+    } catch {
+      // The stop or failure is what the caller needs to see.
+    }
+  })
+}
+
+/** A stop by `signal` rejects with its reason, as an aborted fetch would. */
+async function run<A>(
+  program: Effect.Effect<A, Error>,
+  signal: AbortSignal | null | undefined,
+  onNotReturned: () => void
+): Promise<A> {
+  const exit = await Effect.runPromiseExit(program, signal ? { signal } : undefined)
+  if (Exit.isSuccess(exit)) return exit.value
+  onNotReturned()
+  if (signal?.aborted && Cause.hasInterruptsOnly(exit.cause)) throw signal.reason
+  throw Cause.squash(exit.cause)
+}
+
+/**
+ * A credentials transaction whose wait for the lock stays responsive. The
+ * in-process rules are credentials.ts's: one holder per process, and nested
+ * writes only from the holder's own async context.
+ */
+export function withCredentialsTransaction<T>(
+  operation: () => Promise<T>,
+  signal?: AbortSignal | null
+): Promise<T> {
+  return withCredentialsTransactionLockAsync(operation, () => acquireLock(signal))
+}

package/src/credentials.ts

@@ -29,6 +29,12 @@ function isNodeError(error: unknown): error is NodeJS.ErrnoException {
   return error instanceof Error
 }
 
+// The system's short error code (EACCES, EPERM), never the message: messages
+// from fs calls carry paths, and this one goes to the terminal.
+function errorCode(error: unknown): string {
+  return isNodeError(error) && typeof error.code === 'string' ? error.code : 'unknown error'
+}
+
 export function getConfigDir(): string {
   if (process.env.ORIZU_CONFIG_DIR) {
     return process.env.ORIZU_CONFIG_DIR
@@ -42,7 +48,7 @@ function getCredentialsPath(): string {
 
 const DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS = 2_000
 const MAX_CREDENTIALS_LOCK_TIMEOUT_MS = 10_000
-const CREDENTIALS_LOCK_RETRY_MS = 20
+export const CREDENTIALS_LOCK_RETRY_MS = 20
 
 interface CredentialsLockMetadata {
   version: 1
@@ -52,7 +58,7 @@ interface CredentialsLockMetadata {
   instanceId: string
 }
 
-interface HeldCredentialsLock {
+export interface HeldCredentialsLock {
   path: string
   metadata: string
   depth: number
@@ -81,69 +87,85 @@ function sleepSync(milliseconds: number): void {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds)
 }
 
-function acquireCredentialsLock(): HeldCredentialsLock {
+export function credentialsLockTimeoutMs(): number {
+  return readLockDuration(
+    'ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS',
+    DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS,
+    MAX_CREDENTIALS_LOCK_TIMEOUT_MS
+  )
+}
+
+export function credentialsLockTimeoutError(timeoutMs: number): Error {
+  return new Error(
+    `ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`
+  )
+}
+
+/**
+ * One try at the cross-process lock. Returns null when another owner holds
+ * it. The waits between tries belong to the caller: a blocking one below for
+ * synchronous writers, an Effect sleep in credentials-transaction.ts.
+ */
+export function tryAcquireCredentialsLock(): HeldCredentialsLock | null {
   const dir = getConfigDir()
   mkdirSync(dir, { recursive: true, mode: 0o700 })
   chmodSync(dir, 0o700)
 
   const lockPath = getCredentialsLockPath()
-  const timeoutMs = readLockDuration(
-    'ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS',
-    DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS,
-    MAX_CREDENTIALS_LOCK_TIMEOUT_MS
+  const metadata = JSON.stringify({
+    version: 1,
+    pid: process.pid,
+    hostname: hostname(),
+    createdAt: Date.now(),
+    instanceId: randomBytes(16).toString('hex'),
+  } satisfies CredentialsLockMetadata)
+  const tempPath = join(
+    dir,
+    `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`
   )
-  const deadline = Date.now() + timeoutMs
 
-  while (true) {
-    const metadata = JSON.stringify({
-      version: 1,
-      pid: process.pid,
-      hostname: hostname(),
-      createdAt: Date.now(),
-      instanceId: randomBytes(16).toString('hex'),
-    } satisfies CredentialsLockMetadata)
-    const tempPath = join(
-      dir,
-      `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`
-    )
+  try {
+    const fd = openSync(tempPath, 'wx', 0o600)
+    try {
+      writeFileSync(fd, metadata, 'utf8')
+      fsyncSync(fd)
+      chmodSync(tempPath, 0o600)
+    } finally {
+      closeSync(fd)
+    }
 
     try {
-      const fd = openSync(tempPath, 'wx', 0o600)
-      try {
-        writeFileSync(fd, metadata, 'utf8')
-        fsyncSync(fd)
-        chmodSync(tempPath, 0o600)
-      } finally {
-        closeSync(fd)
-      }
+      // link(2) publishes the already-complete inode without replacing an
+      // existing owner. No contender ever unlinks the canonical lock.
+      linkSync(tempPath, lockPath)
+    } catch (error) {
+      if (isNodeError(error) && error.code === 'EEXIST') return null
+      throw error
+    }
 
-      try {
-        // link(2) publishes the already-complete inode without replacing an
-        // existing owner. No contender ever unlinks the canonical lock.
-        linkSync(tempPath, lockPath)
-      } catch (error) {
-        if (!(isNodeError(error) && error.code === 'EEXIST')) throw error
-        if (Date.now() >= deadline) {
-          throw new Error(
-            `ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`
-          )
-        }
-        sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())))
-        continue
-      }
+    let resolveReleased = () => {}
+    const released = new Promise<void>(resolve => { resolveReleased = resolve })
+    return { path: lockPath, metadata, depth: 1, released, resolveReleased }
+  } finally {
+    // The unique owner-only preparation link is never retained, whether
+    // publication succeeds, loses to an owner, or fails unexpectedly.
+    rmSync(tempPath, { force: true })
+  }
+}
 
-      let resolveReleased = () => {}
-      const released = new Promise<void>(resolve => { resolveReleased = resolve })
-      return { path: lockPath, metadata, depth: 1, released, resolveReleased }
-    } finally {
-      // The unique owner-only preparation link is never retained, whether
-      // publication succeeds, loses to an owner, or fails unexpectedly.
-      rmSync(tempPath, { force: true })
-    }
+/** Blocks the process between tries; only for synchronous writers. */
+function acquireCredentialsLock(): HeldCredentialsLock {
+  const timeoutMs = credentialsLockTimeoutMs()
+  const deadline = Date.now() + timeoutMs
+  while (true) {
+    const lock = tryAcquireCredentialsLock()
+    if (lock) return lock
+    if (Date.now() >= deadline) throw credentialsLockTimeoutError(timeoutMs)
+    sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())))
   }
 }
 
-function releaseCredentialsLock(lock: HeldCredentialsLock): void {
+export function releaseCredentialsLock(lock: HeldCredentialsLock): void {
   let currentMetadata: string
   try {
     currentMetadata = readFileSync(lock.path, 'utf8')
@@ -183,15 +205,26 @@ export function withCredentialsTransactionLock<T>(operation: () => T): T {
 
   const lock = acquireCredentialsLock()
   heldCredentialsLock = lock
+  let failed = false
   try {
     return operation()
+  } catch (error) {
+    failed = true
+    throw error
   } finally {
     heldCredentialsLock = null
-    try {
-      releaseCredentialsLock(lock)
-    } finally {
-      lock.resolveReleased()
-    }
+    endTransaction(lock, failed)
+  }
+}
+
+/** Release the lock if it is still ours. A release error never hides the transaction's own error. */
+function endTransaction(lock: HeldCredentialsLock, failed: boolean): void {
+  try {
+    releaseCredentialsLock(lock)
+  } catch (releaseError) {
+    if (!failed) throw releaseError
+  } finally {
+    lock.resolveReleased()
   }
 }
 
@@ -201,7 +234,10 @@ export function withCredentialsTransactionLock<T>(operation: () => T): T {
  * async execution context; unrelated same-process work must wait or fail.
  */
 export async function withCredentialsTransactionLockAsync<T>(
-  operation: () => Promise<T>
+  operation: () => Promise<T>,
+  // How to wait for the cross-process lock. The default blocks the process
+  // between tries; stored-login commands pass credentials-transaction.ts's.
+  acquire: () => HeldCredentialsLock | Promise<HeldCredentialsLock> = acquireCredentialsLock
 ): Promise<T> {
   const lockPath = getCredentialsLockPath()
   const currentOwner = credentialsTransactionOwner.getStore()
@@ -218,38 +254,30 @@ export async function withCredentialsTransactionLockAsync<T>(
       }
     }
 
-    const timeoutMs = readLockDuration(
-      'ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS',
-      DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS,
-      MAX_CREDENTIALS_LOCK_TIMEOUT_MS
-    )
+    const timeoutMs = credentialsLockTimeoutMs()
     let timer: ReturnType<typeof setTimeout> | undefined
     const didRelease = await Promise.race([
       heldCredentialsLock.released.then(() => true),
       new Promise<false>(resolve => { timer = setTimeout(() => resolve(false), timeoutMs) }),
     ])
     if (timer) clearTimeout(timer)
-    if (!didRelease) {
-      throw new Error(
-        `ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`
-      )
-    }
-    return await withCredentialsTransactionLockAsync(operation)
+    if (!didRelease) throw credentialsLockTimeoutError(timeoutMs)
+    return await withCredentialsTransactionLockAsync(operation, acquire)
   }
 
-  const lock = acquireCredentialsLock()
+  const lock = await acquire()
   const owner = Symbol('credentials-transaction-owner')
   lock.asyncOwner = owner
   heldCredentialsLock = lock
+  let failed = false
   try {
     return await credentialsTransactionOwner.run(owner, operation)
+  } catch (error) {
+    failed = true
+    throw error
   } finally {
     heldCredentialsLock = null
-    try {
-      releaseCredentialsLock(lock)
-    } finally {
-      lock.resolveReleased()
-    }
+    endTransaction(lock, failed)
   }
 }
 
@@ -319,18 +347,26 @@ function writeCredentials(config: StoredCredentialsV2 | StoredCredentialsV3) {
   const payload = JSON.stringify(config, null, 2) + '\n'
 
   try {
-    const fd = openSync(tempPath, 'wx', 0o600)
     try {
-      writeFileSync(fd, payload, 'utf-8')
-      fsyncSync(fd)
-    } finally {
-      closeSync(fd)
-    }
+      const fd = openSync(tempPath, 'wx', 0o600)
+      try {
+        writeFileSync(fd, payload, 'utf-8')
+        fsyncSync(fd)
+      } finally {
+        closeSync(fd)
+      }
 
-    chmodSync(tempPath, 0o600)
-    // Never delete the destination to emulate replacement. If this platform
-    // cannot atomically replace it, preserve the old file and surface the error.
-    renameSync(tempPath, path)
+      chmodSync(tempPath, 0o600)
+      // Never delete the destination to emulate replacement. If this platform
+      // cannot atomically replace it, preserve the old file and surface the error.
+      renameSync(tempPath, path)
+    } catch (error) {
+      // Until the rename succeeds the saved file is untouched.
+      throw new Error(
+        `ORIZU_CREDENTIALS_WRITE_FAILED: could not save sign-ins to ${path} (${errorCode(error)}). The saved file is unchanged.`,
+        { cause: error }
+      )
+    }
     chmodSync(path, 0o600)
   } finally {
     // On success rename has already removed this path; on every error this
@@ -347,11 +383,17 @@ function createEmptyCredentialsConfig(): StoredCredentialsV3 {
   }
 }
 
+// A missing file, invalid JSON or an unknown format start empty (the "log in
+// again" recovery). A file that exists but cannot be read is never replaced:
+// that would delete every other saved sign-in.
 function loadCredentialsConfigForWrite(): StoredCredentialsV2 | StoredCredentialsV3 {
   try {
     return loadCredentialsConfig() || createEmptyCredentialsConfig()
-  } catch {
-    return createEmptyCredentialsConfig()
+  } catch (error) {
+    throw new Error(
+      `ORIZU_CREDENTIALS_READ_FAILED: could not read ${getCredentialsPath()} (${errorCode(error)}). Saved sign-ins were not changed. Move it aside, then run \`orizu login\` again.`,
+      { cause: error }
+    )
   }
 }
 

package/src/stored-session-requests.ts

@@ -6,8 +6,8 @@ import {
   getServerCredentials,
   rememberResolvedBearer,
   updateServerCredentialsIfCurrent,
-  withCredentialsTransactionLockAsync,
 } from './credentials.js'
+import { withCredentialsTransaction } from './credentials-transaction.js'
 import { assertSecureTokenTransport, credentialRequestRedirectPolicy } from './http.js'
 import { describeLogoutHttpFailure, describeLogoutTransportFailure } from './logout-diagnostic.js'
 import { ServerCredentials, SessionServerCredentials } from './types.js'
@@ -182,7 +182,9 @@ async function refreshStoredCredentialsIfCurrent(
   const stop = lockStopWindow(callerSignal)
   stop.listen()
   try {
-    return await withCredentialsTransactionLockAsync(async () => {
+    // A stop or the caller's cancel also ends the wait for the lock.
+    const waitSignal = callerSignal ? AbortSignal.any([callerSignal, stop.signal]) : stop.signal
+    return await withCredentialsTransaction(async () => {
       const current = getServerCredentials(baseUrl)
       if (!current || !credentialsEqual(current, expected)) {
         return { status: 'changed', credentials: current }
@@ -193,7 +195,7 @@ async function refreshStoredCredentialsIfCurrent(
         return { status: 'changed', credentials: getServerCredentials(baseUrl) }
       }
       return { status: 'refreshed', credentials: refreshed }
-    })
+    }, waitSignal)
   } finally {
     stop.unlisten()
     await stop.endIfStopped()
@@ -311,6 +313,7 @@ export async function storedLogout(
   } catch (error) {
     remoteError = describeLogoutTransportFailure(error, secrets)
   }
-  const localCredentialCleared = clearServerCredentialsIfCurrent(credentialKey, credentials)
+  // Not stopped by the caller's cancel: a cancelled logout still removes the login, as before.
+  const localCredentialCleared = await withCredentialsTransaction(async () => clearServerCredentialsIfCurrent(credentialKey, credentials))
   return { remoteError, localCredentialCleared }
 }