switchroom 0.14.39 → 0.14.40

package/dist/auth-broker/index.js

@@ -6932,7 +6932,7 @@ var require_public_api = __commonJS((exports) => {
 });
 
 // src/auth/broker/index.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
 
 // src/config/loader.ts
 import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:fs";
@@ -12152,20 +12152,20 @@ import * as net from "node:net";
 import {
   chmodSync,
   chownSync as chownSync2,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   lstatSync,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync5,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync6,
   renameSync as renameSync3,
-  rmSync as rmSync4,
-  statSync as statSync4,
+  rmSync as rmSync5,
+  statSync as statSync5,
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { closeSync as closeSync2, openSync as openSync2, writeSync as writeSync2 } from "node:fs";
 import * as constants2 from "node:constants";
 import { createHash as createHash2 } from "node:crypto";
-import { dirname as dirname2, join as join3, resolve as resolve6 } from "node:path";
+import { dirname as dirname3, join as join4, resolve as resolve7 } from "node:path";
 
 // src/agents/compose.ts
 import { createHash } from "node:crypto";
@@ -13021,6 +13021,74 @@ function listGoogleAccounts(stateDir) {
   }).filter((name) => existsSync5(join2(root, name, "credentials.json")));
 }
 
+// src/auth/broker/microsoft-storage.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync4 } from "node:fs";
+import { dirname as dirname2, join as join3, resolve as resolve6 } from "node:path";
+function normalizeMicrosoftAccountForStorage(account) {
+  return account.trim().toLowerCase();
+}
+function validateMicrosoftAccountLabel(account) {
+  if (typeof account !== "string" || account.length === 0) {
+    throw new Error(`Microsoft account label must be a non-empty string`);
+  }
+  if (account !== account.trim()) {
+    throw new Error(`Microsoft account label must not have leading/trailing whitespace`);
+  }
+  if (/[\x00-\x1f\x7f]/.test(account)) {
+    throw new Error(`Microsoft account label '${account.replace(/[\x00-\x1f\x7f]/g, "?")}' contains control characters; email shape rejects them.`);
+  }
+  if (!/^[^@\s:/\\]+@[^@\s:/\\]+\.[^@\s:/\\]+$/.test(account)) {
+    throw new Error(`Microsoft account label '${account}' is not a valid email shape. Expected like 'alice@outlook.com' or 'alice@contoso.com' (no slashes, colons, or whitespace).`);
+  }
+}
+function microsoftAccountDir(stateDir, account) {
+  return resolve6(stateDir, "microsoft", normalizeMicrosoftAccountForStorage(account));
+}
+function microsoftAccountCredentialsPath(stateDir, account) {
+  return join3(microsoftAccountDir(stateDir, account), "credentials.json");
+}
+function microsoftAccountExists(stateDir, account) {
+  return existsSync6(microsoftAccountCredentialsPath(stateDir, account));
+}
+function readMicrosoftAccountCredentials(stateDir, account) {
+  const path = microsoftAccountCredentialsPath(stateDir, account);
+  if (!existsSync6(path))
+    return null;
+  try {
+    const raw = readFileSync5(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.microsoftOauth?.accessToken)
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeMicrosoftAccountCredentials(stateDir, account, credentials) {
+  const path = microsoftAccountCredentialsPath(stateDir, account);
+  mkdirSync3(dirname2(path), { recursive: true, mode: 448 });
+  atomicWriteFileSync(path, JSON.stringify(credentials, null, 2), 384);
+  return path;
+}
+function removeMicrosoftAccount(stateDir, account) {
+  const dir = microsoftAccountDir(stateDir, account);
+  if (existsSync6(dir)) {
+    rmSync4(dir, { recursive: true, force: true });
+  }
+}
+function listMicrosoftAccounts(stateDir) {
+  const root = join3(stateDir, "microsoft");
+  if (!existsSync6(root))
+    return [];
+  return readdirSync4(root).filter((name) => {
+    try {
+      return statSync4(join3(root, name)).isDirectory();
+    } catch {
+      return false;
+    }
+  }).filter((name) => existsSync6(join3(root, name, "credentials.json")));
+}
+
 // src/auth/broker/provider.ts
 class ProviderRegistry {
   providers = new Map;
@@ -13195,6 +13263,11 @@ var ListGoogleAccountsRequestSchema = exports_external.object({
   op: exports_external.literal("list-google-accounts"),
   id: exports_external.string().min(1)
 });
+var ListMicrosoftAccountsRequestSchema = exports_external.object({
+  v: exports_external.literal(PROTOCOL_VERSION),
+  op: exports_external.literal("list-microsoft-accounts"),
+  id: exports_external.string().min(1)
+});
 var ProbeQuotaRequestSchema = exports_external.object({
   v: exports_external.literal(PROTOCOL_VERSION),
   op: exports_external.literal("probe-quota"),
@@ -13212,6 +13285,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RmAccountRequestSchema,
   SetOverrideRequestSchema,
   ListGoogleAccountsRequestSchema,
+  ListMicrosoftAccountsRequestSchema,
   ProbeQuotaRequestSchema
 ]);
 var GetCredentialsDataSchema = exports_external.object({
@@ -13276,6 +13350,16 @@ var GoogleAccountStateSchema = exports_external.object({
 var ListGoogleAccountsDataSchema = exports_external.object({
   accounts: exports_external.array(GoogleAccountStateSchema)
 });
+var MicrosoftAccountStateSchema = exports_external.object({
+  account: exports_external.string(),
+  expiresAt: exports_external.number(),
+  scope: exports_external.string(),
+  clientId: exports_external.string(),
+  accountType: exports_external.enum(["personal", "work"])
+});
+var ListMicrosoftAccountsDataSchema = exports_external.object({
+  accounts: exports_external.array(MicrosoftAccountStateSchema)
+});
 var ErrorBodySchema = exports_external.object({
   code: exports_external.enum([
     "FORBIDDEN",
@@ -13405,7 +13489,7 @@ class AuthBroker {
     this.now = opts.now ?? nowMs;
     this.operatorUid = opts.operatorUid;
     this.fetcher = opts.fetcher;
-    this.stateDir = opts.stateDir ?? resolve6(this.homeRoot(), ".switchroom", "state", "auth-broker");
+    this.stateDir = opts.stateDir ?? resolve7(this.homeRoot(), ".switchroom", "state", "auth-broker");
     this.socketRoot = opts.socketRoot ?? AUTH_BROKER_ROOT;
     this.providers = new ProviderRegistry;
     this.providers.register(new AnthropicProvider);
@@ -13433,9 +13517,9 @@ class AuthBroker {
   }
   async start() {
     process.umask(63);
-    mkdirSync3(this.stateDir, { recursive: true, mode: 448 });
-    mkdirSync3(join3(this.stateDir, "refresh-lease"), { recursive: true, mode: 448 });
-    mkdirSync3(this.socketRoot, { recursive: true, mode: 493 });
+    mkdirSync4(this.stateDir, { recursive: true, mode: 448 });
+    mkdirSync4(join4(this.stateDir, "refresh-lease"), { recursive: true, mode: 448 });
+    mkdirSync4(this.socketRoot, { recursive: true, mode: 493 });
     this.loadStateFromDisk();
     this.assertDriftFree();
     for (const agentName of Object.keys(this.config.agents ?? {})) {
@@ -13462,7 +13546,7 @@ class AuthBroker {
     }
     if (!this.opts.skipHealthyMarker) {
       try {
-        const healthyPath = join3(this.stateDir, "healthy");
+        const healthyPath = join4(this.stateDir, "healthy");
         writeFileSync2(healthyPath, String(this.now()) + `
 `, { mode: 384 });
       } catch (err) {
@@ -13485,14 +13569,14 @@ class AuthBroker {
         lis.server.close();
       } catch {}
       try {
-        if (existsSync6(sock))
+        if (existsSync7(sock))
           unlinkSync(sock);
       } catch {}
     }
     this.listeners.clear();
     try {
-      const healthyPath = join3(this.stateDir, "healthy");
-      if (existsSync6(healthyPath))
+      const healthyPath = join4(this.stateDir, "healthy");
+      if (existsSync7(healthyPath))
         unlinkSync(healthyPath);
     } catch {}
   }
@@ -13516,7 +13600,7 @@ class AuthBroker {
           lis.server.close();
         } catch {}
         try {
-          if (existsSync6(sock))
+          if (existsSync7(sock))
             unlinkSync(sock);
         } catch {}
         this.listeners.delete(sock);
@@ -13539,13 +13623,13 @@ class AuthBroker {
     }
   }
   agentSocketPath(name) {
-    return join3(this.socketRoot, name, "sock");
+    return join4(this.socketRoot, name, "sock");
   }
   consumerSocketPath(name) {
-    return join3(this.socketRoot, name, "sock");
+    return join4(this.socketRoot, name, "sock");
   }
   operatorSocketPath() {
-    return join3(this.socketRoot, "operator", "sock");
+    return join4(this.socketRoot, "operator", "sock");
   }
   async bindAgentListener(agentName) {
     if (RESERVED_NAMES.has(agentName)) {
@@ -13575,8 +13659,8 @@ class AuthBroker {
     await this.bindListener(sockPath, operatorUid, 384, { kind: "operator" });
   }
   async bindListener(sockPath, targetUid, sockMode, identity2) {
-    const dir = dirname2(sockPath);
-    if (existsSync6(dir)) {
+    const dir = dirname3(sockPath);
+    if (existsSync7(dir)) {
       try {
         chownSync2(dir, 0, 0);
       } catch {}
@@ -13584,9 +13668,9 @@ class AuthBroker {
         chmodSync(dir, 448);
       } catch {}
     } else {
-      mkdirSync3(dir, { recursive: true, mode: 448 });
+      mkdirSync4(dir, { recursive: true, mode: 448 });
     }
-    if (existsSync6(sockPath)) {
+    if (existsSync7(sockPath)) {
       try {
         unlinkSync(sockPath);
       } catch {}
@@ -13667,6 +13751,10 @@ class AuthBroker {
             await this.opGoogleGetCredentials(socket, reqId, identity2);
             break;
           }
+          if (provider === "microsoft") {
+            await this.opMicrosoftGetCredentials(socket, reqId, identity2);
+            break;
+          }
           socket.write(encodeError(reqId, "INTERNAL", `unhandled provider '${provider}' in get-credentials dispatch`));
           break;
         }
@@ -13719,6 +13807,11 @@ class AuthBroker {
             await this.opGoogleAddAccount(socket, reqId, identity2, req.label, googleCreds, req.replace ?? false);
             break;
           }
+          if (provider === "microsoft") {
+            const microsoftCreds = req.credentials;
+            await this.opMicrosoftAddAccount(socket, reqId, identity2, req.label, microsoftCreds, req.replace ?? false);
+            break;
+          }
           socket.write(encodeError(reqId, "INTERNAL", `unhandled provider '${provider}' in add-account dispatch`));
           break;
         }
@@ -13736,6 +13829,10 @@ class AuthBroker {
             await this.opGoogleRmAccount(socket, reqId, identity2, req.label);
             break;
           }
+          if (provider === "microsoft") {
+            await this.opMicrosoftRmAccount(socket, reqId, identity2, req.label);
+            break;
+          }
           socket.write(encodeError(reqId, "INTERNAL", `unhandled provider '${provider}' in rm-account dispatch`));
           break;
         }
@@ -13745,6 +13842,9 @@ class AuthBroker {
         case "list-google-accounts":
           await this.opListGoogleAccounts(socket, reqId, identity2);
           break;
+        case "list-microsoft-accounts":
+          await this.opListMicrosoftAccounts(socket, reqId, identity2);
+          break;
         case "probe-quota":
           await this.opProbeQuota(socket, reqId, identity2, req.accounts, req.timeoutMs);
           break;
@@ -13965,7 +14065,7 @@ class AuthBroker {
       return;
     }
     this.chownAccountFilesIfRoot(label);
-    const contents = readFileSync5(accountCredentialsPath(label, this.home), "utf-8");
+    const contents = readFileSync6(accountCredentialsPath(label, this.home), "utf-8");
     this.shaIndex[label] = sha256Hex(contents);
     this.lastWrittenExpiresAt.set(label, credentials.claudeAiOauth?.expiresAt);
     this.persistShaIndex();
@@ -13995,7 +14095,7 @@ class AuthBroker {
       return;
     }
     try {
-      rmSync4(accountDir(label, this.home), { recursive: true, force: true });
+      rmSync5(accountDir(label, this.home), { recursive: true, force: true });
     } catch (err) {
       socket.write(encodeError(id, "INTERNAL", err.message));
       return;
@@ -14098,6 +14198,110 @@ class AuthBroker {
     this.audit({ op: "rm-account", identity: identity2, account: label, ok: true });
     socket.write(encodeSuccess(id, { label }));
   }
+  async opMicrosoftGetCredentials(socket, id, identity2) {
+    if (identity2.kind !== "agent") {
+      socket.write(encodeError(id, "INVALID_ARGS", `Microsoft get-credentials is per-agent only (caller kind '${identity2.kind}' not supported); use the agent's per-agent socket bind`));
+      return;
+    }
+    const agentName = identity2.name;
+    const agent = (this.config.agents ?? {})[agentName];
+    const account = agent?.microsoft_workspace?.account;
+    if (!account) {
+      this.audit({ op: "get-credentials", identity: identity2, ok: false, error: "no-microsoft-account-configured" });
+      socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `agent '${agentName}' has no microsoft_workspace.account configured in switchroom.yaml`));
+      return;
+    }
+    const ma = this.config.microsoft_accounts;
+    const enabledFor = ma?.[account]?.enabled_for ?? [];
+    if (!enabledFor.includes(agentName)) {
+      this.audit({ op: "get-credentials", identity: identity2, account, ok: false, error: "acl-deny" });
+      socket.write(encodeError(id, "FORBIDDEN", `agent '${agentName}' not in microsoft_accounts['${account}'].enabled_for[] — operator must run \`switchroom auth microsoft enable ${account} ${agentName}\``));
+      return;
+    }
+    const creds = readMicrosoftAccountCredentials(this.stateDir, account);
+    if (!creds) {
+      this.audit({ op: "get-credentials", identity: identity2, account, ok: false, error: "missing-credentials" });
+      socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `no Microsoft credentials for account '${account}' — operator must run \`switchroom auth microsoft account add ${account}\``));
+      return;
+    }
+    const expiresAt = creds.microsoftOauth?.expiresAt;
+    this.audit({ op: "get-credentials", identity: identity2, account, ok: true });
+    socket.write(encodeSuccess(id, { account, credentials: creds, expiresAt }));
+  }
+  async opMicrosoftAddAccount(socket, id, identity2, label, credentials, replace) {
+    if (!this.isAdmin(identity2)) {
+      this.audit({ op: "add-account", identity: identity2, account: label, ok: false, error: "FORBIDDEN" });
+      this.respondForbidden(socket, id, "add-account requires admin");
+      return;
+    }
+    try {
+      validateMicrosoftAccountLabel(label);
+    } catch (err) {
+      socket.write(encodeError(id, "INVALID_ARGS", err.message));
+      return;
+    }
+    if (microsoftAccountExists(this.stateDir, label) && !replace) {
+      this.audit({ op: "add-account", identity: identity2, account: label, ok: false, error: "ACCOUNT_ALREADY_EXISTS" });
+      socket.write(encodeError(id, "ACCOUNT_ALREADY_EXISTS", `microsoft account '${label}' already exists; pass replace:true to overwrite`));
+      return;
+    }
+    try {
+      writeMicrosoftAccountCredentials(this.stateDir, label, credentials);
+    } catch (err) {
+      socket.write(encodeError(id, "INTERNAL", err.message));
+      return;
+    }
+    const expiresAt = credentials.microsoftOauth?.expiresAt;
+    this.audit({ op: "add-account", identity: identity2, account: label, ok: true, replace });
+    socket.write(encodeSuccess(id, { label, expiresAt }));
+  }
+  async opMicrosoftRmAccount(socket, id, identity2, label) {
+    if (!this.isAdmin(identity2)) {
+      this.audit({ op: "rm-account", identity: identity2, account: label, ok: false, error: "FORBIDDEN" });
+      this.respondForbidden(socket, id, "rm-account requires admin");
+      return;
+    }
+    try {
+      validateMicrosoftAccountLabel(label);
+    } catch (err) {
+      socket.write(encodeError(id, "INVALID_ARGS", err.message));
+      return;
+    }
+    if (!microsoftAccountExists(this.stateDir, label)) {
+      socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `microsoft account '${label}' not found`));
+      return;
+    }
+    const ma = this.config.microsoft_accounts;
+    const enabledFor = ma?.[label]?.enabled_for ?? [];
+    if (enabledFor.length > 0) {
+      socket.write(encodeError(id, "INVALID_ARGS", `microsoft account '${label}' is still enabled for agents: ${enabledFor.join(", ")}. Run \`auth microsoft disable ${label} all\` first.`));
+      return;
+    }
+    try {
+      removeMicrosoftAccount(this.stateDir, label);
+    } catch (err) {
+      socket.write(encodeError(id, "INTERNAL", err.message));
+      return;
+    }
+    this.audit({ op: "rm-account", identity: identity2, account: label, ok: true });
+    socket.write(encodeSuccess(id, { label }));
+  }
+  async opListMicrosoftAccounts(socket, id, identity2) {
+    const accounts = listMicrosoftAccounts(this.stateDir).map((account) => {
+      const creds = readMicrosoftAccountCredentials(this.stateDir, account);
+      if (!creds)
+        return null;
+      return {
+        account,
+        expiresAt: creds.microsoftOauth.expiresAt,
+        scope: creds.microsoftOauth.scope,
+        clientId: creds.microsoftOauth.clientId,
+        accountType: creds.microsoftOauth.accountType
+      };
+    }).filter((entry) => entry !== null).sort((a, b) => a.account.localeCompare(b.account));
+    this.audit({ op: "list-microsoft-accounts", identity: identity2, ok: true });
+    socket.write(encodeSuccess(id, { accounts }));
+  }
   async opSetOverride(socket, id, identity2, agentName, account) {
     if (!this.isAdmin(identity2)) {
       this.audit({ op: "set-override", identity: identity2, account: account ?? undefined, ok: false, error: "FORBIDDEN" });
@@ -14142,6 +14346,15 @@ class AuthBroker {
         }
       }
     }
+    if (this.providers.has("microsoft")) {
+      for (const account of listMicrosoftAccounts(this.stateDir)) {
+        try {
+          await this.refreshOneMicrosoftAccount(account, false);
+        } catch (err) {
+          this.logErr(`refresh-tick microsoft:${account}: ${err.message}`);
+        }
+      }
+    }
   }
   async refreshOneGoogleAccount(account, force) {
     const leaseKey = `google:${account}`;
@@ -14177,6 +14390,41 @@ class AuthBroker {
       this.refreshInFlight.delete(leaseKey);
     }
   }
+  async refreshOneMicrosoftAccount(account, force) {
+    const leaseKey = `microsoft:${account}`;
+    if (this.refreshInFlight.has(leaseKey))
+      return { kind: "noop" };
+    const credsBefore = readMicrosoftAccountCredentials(this.stateDir, account);
+    if (!credsBefore) {
+      return { kind: "noop" };
+    }
+    const provider = this.providers.lookup("microsoft");
+    const onDiskExpires = provider.extractExpiresAt(credsBefore);
+    if (!force) {
+      const remaining = (onDiskExpires ?? 0) - this.now();
+      if (onDiskExpires !== undefined && remaining > REFRESH_THRESHOLD_MS) {
+        return { kind: "noop" };
+      }
+    }
+    this.refreshInFlight.add(leaseKey);
+    try {
+      const refreshToken = credsBefore.microsoftOauth.refreshToken;
+      const result = await provider.refresh({
+        refreshToken,
+        accountEmail: account,
+        clientId: credsBefore.microsoftOauth.clientId,
+        priorCredentials: credsBefore
+      });
+      if (!result.ok) {
+        return { kind: "failed", error: `${result.kind}: ${result.detail}` };
+      }
+      const newCreds = result.rawCredentials;
+      writeMicrosoftAccountCredentials(this.stateDir, account, newCreds);
+      return { kind: "refreshed", newExpiresAt: result.expiresAt };
+    } finally {
+      this.refreshInFlight.delete(leaseKey);
+    }
+  }
   async refreshOneAccount(label, force) {
     if (this.refreshInFlight.has(label))
       return { kind: "noop" };
@@ -14194,7 +14442,7 @@ class AuthBroker {
         return { kind: "noop" };
       }
     }
-    const leasePath = join3(this.stateDir, "refresh-lease", label);
+    const leasePath = join4(this.stateDir, "refresh-lease", label);
     let leaseFd = null;
     try {
       leaseFd = openSync2(leasePath, constants2.O_RDWR | constants2.O_CREAT, 384);
@@ -14211,7 +14459,7 @@ class AuthBroker {
         const creds = readAccountCredentials(label, this.home);
         const newExpiresAt = creds?.claudeAiOauth?.expiresAt ?? outcome.newExpiresAt;
         this.lastWrittenExpiresAt.set(label, newExpiresAt);
-        const contents = readFileSync5(accountCredentialsPath(label, this.home), "utf-8");
+        const contents = readFileSync6(accountCredentialsPath(label, this.home), "utf-8");
         this.shaIndex[label] = sha256Hex(contents);
         this.persistShaIndex();
         this.fanoutToAffectedAgents(label);
@@ -14294,9 +14542,9 @@ class AuthBroker {
   }
   resolveMirrorPathsSafe(agentName) {
     const agentsDir = resolveAgentsDir(this.config);
-    const agentDir = resolve6(agentsDir, agentName);
-    const claudeDir = join3(agentDir, ".claude");
-    const targetPath = join3(claudeDir, ".credentials.json");
+    const agentDir = resolve7(agentsDir, agentName);
+    const claudeDir = join4(agentDir, ".claude");
+    const targetPath = join4(claudeDir, ".credentials.json");
     const refuse = (component, reason) => {
       this.logErr(`fanout ${agentName}: REFUSING mirror — ${component} ${reason} ` + `(symlink-guard #1393; agent-owned tree may be attacker-poisoned)`);
       this.audit({
@@ -14346,14 +14594,14 @@ class AuthBroker {
   }
   mirrorAccountToAgent(label, agentName) {
     const credsPath = accountCredentialsPath(label, this.home);
-    if (!existsSync6(credsPath))
+    if (!existsSync7(credsPath))
       return false;
-    const mirrorContent = enrichMirrorContent(readFileSync5(credsPath, "utf-8"));
+    const mirrorContent = enrichMirrorContent(readFileSync6(credsPath, "utf-8"));
     const safe = this.resolveMirrorPathsSafe(agentName);
     if (!safe)
       return false;
     const { claudeDir, targetPath } = safe;
-    mkdirSync3(claudeDir, { recursive: true, mode: 448 });
+    mkdirSync4(claudeDir, { recursive: true, mode: 448 });
     try {
       atomicWriteFileSync(targetPath, mirrorContent, 384);
       try {
@@ -14374,32 +14622,32 @@ class AuthBroker {
     this.thresholdViolations = this.readJson("threshold-violations.json") ?? {};
   }
   readJson(name) {
-    const p = join3(this.stateDir, name);
-    if (!existsSync6(p))
+    const p = join4(this.stateDir, name);
+    if (!existsSync7(p))
       return null;
     try {
-      return JSON.parse(readFileSync5(p, "utf-8"));
+      return JSON.parse(readFileSync6(p, "utf-8"));
     } catch {
       return null;
     }
   }
   persistQuota() {
-    atomicWriteJsonSync(join3(this.stateDir, "quota.json"), this.quota, 384);
+    atomicWriteJsonSync(join4(this.stateDir, "quota.json"), this.quota, 384);
   }
   persistShaIndex() {
-    atomicWriteJsonSync(join3(this.stateDir, "sha-index.json"), this.shaIndex, 384);
+    atomicWriteJsonSync(join4(this.stateDir, "sha-index.json"), this.shaIndex, 384);
   }
   persistThresholdViolations() {
-    atomicWriteJsonSync(join3(this.stateDir, "threshold-violations.json"), this.thresholdViolations, 384);
+    atomicWriteJsonSync(join4(this.stateDir, "threshold-violations.json"), this.thresholdViolations, 384);
   }
   assertDriftFree() {
     for (const label of Object.keys(this.shaIndex)) {
       const p = accountCredentialsPath(label, this.home);
-      if (!existsSync6(p)) {
+      if (!existsSync7(p)) {
         this.logErr(`DRIFT_DETECTED ${label}: index entry but no on-disk credentials`);
         process.exit(1);
       }
-      const got = sha256Hex(readFileSync5(p, "utf-8"));
+      const got = sha256Hex(readFileSync6(p, "utf-8"));
       if (got !== this.shaIndex[label]) {
         this.logErr(`DRIFT_DETECTED ${label}: sha256 mismatch (recover with 'switchroom auth add ${label} --replace')`);
         process.exit(1);
@@ -14423,7 +14671,7 @@ class AuthBroker {
       error: entry.error,
       replace: entry.replace
     });
-    const auditPath = join3(this.stateDir, "audit.jsonl");
+    const auditPath = join4(this.stateDir, "audit.jsonl");
     try {
       this.rotateAuditIfLarge(auditPath);
       const line = row + `
@@ -14455,7 +14703,7 @@ class AuthBroker {
   rotateAuditIfLarge(path) {
     let size = 0;
     try {
-      size = statSync4(path).size;
+      size = statSync5(path).size;
     } catch {
       return;
     }
@@ -14464,7 +14712,7 @@ class AuthBroker {
     for (let i = AUDIT_KEEP - 1;i >= 1; i--) {
       const src = `${path}.${i}`;
       const dst = `${path}.${i + 1}`;
-      if (existsSync6(src)) {
+      if (existsSync7(src)) {
         try {
           renameSync3(src, dst);
         } catch {}
@@ -14558,14 +14806,14 @@ async function main() {
   const flags = parseFlags(argv);
   const operatorUid = flags.operatorUid ?? operatorUidFromEnv();
   const configPath = process.env.SWITCHROOM_CONFIG;
-  if (configPath !== undefined && !existsSync7(configPath)) {
+  if (configPath !== undefined && !existsSync8(configPath)) {
     process.stderr.write(`auth-broker fatal: SWITCHROOM_CONFIG='${configPath}' does not exist
 `);
     process.exit(1);
   }
   if (configPath !== undefined) {
     try {
-      readFileSync6(configPath, "utf-8");
+      readFileSync7(configPath, "utf-8");
     } catch (err) {
       process.stderr.write(`auth-broker fatal: failed to read ${configPath}: ${err.message}
 `);

package/dist/cli/drive-write-pretool.mjs

@@ -4000,7 +4000,7 @@ function decodeResponse(line) {
   }
   return ResponseSchema.parse(parsed);
 }
-var MAX_FRAME_BYTES, PROTOCOL_VERSION = 1, ProviderNameSchema, GetCredentialsRequestSchema, ListStateRequestSchema, SetActiveRequestSchema, MarkExhaustedRequestSchema, RefreshAccountRequestSchema, AnthropicCredentialsSchema, GoogleCredentialsSchema, MicrosoftCredentialsSchema, ProviderCredentialsSchema, AddAccountRequestSchema, RmAccountRequestSchema, SetOverrideRequestSchema, ListGoogleAccountsRequestSchema, ProbeQuotaRequestSchema, RequestSchema, GetCredentialsDataSchema, AccountStateSchema, AgentStateSchema, ConsumerStateSchema, ListStateDataSchema, SetActiveDataSchema, MarkExhaustedDataSchema, RefreshAccountDataSchema, AddAccountDataSchema, RmAccountDataSchema, SetOverrideDataSchema, GoogleAccountStateSchema, ListGoogleAccountsDataSchema, ErrorBodySchema, SuccessResponseSchema, ErrorResponseSchema, ResponseSchema;
+var MAX_FRAME_BYTES, PROTOCOL_VERSION = 1, ProviderNameSchema, GetCredentialsRequestSchema, ListStateRequestSchema, SetActiveRequestSchema, MarkExhaustedRequestSchema, RefreshAccountRequestSchema, AnthropicCredentialsSchema, GoogleCredentialsSchema, MicrosoftCredentialsSchema, ProviderCredentialsSchema, AddAccountRequestSchema, RmAccountRequestSchema, SetOverrideRequestSchema, ListGoogleAccountsRequestSchema, ListMicrosoftAccountsRequestSchema, ProbeQuotaRequestSchema, RequestSchema, GetCredentialsDataSchema, AccountStateSchema, AgentStateSchema, ConsumerStateSchema, ListStateDataSchema, SetActiveDataSchema, MarkExhaustedDataSchema, RefreshAccountDataSchema, AddAccountDataSchema, RmAccountDataSchema, SetOverrideDataSchema, GoogleAccountStateSchema, ListGoogleAccountsDataSchema, MicrosoftAccountStateSchema, ListMicrosoftAccountsDataSchema, ErrorBodySchema, SuccessResponseSchema, ErrorResponseSchema, ResponseSchema;
 var init_protocol = __esm(() => {
   init_zod();
   MAX_FRAME_BYTES = 64 * 1024;
@@ -4104,6 +4104,11 @@ var init_protocol = __esm(() => {
     op: exports_external.literal("list-google-accounts"),
     id: exports_external.string().min(1)
   });
+  ListMicrosoftAccountsRequestSchema = exports_external.object({
+    v: exports_external.literal(PROTOCOL_VERSION),
+    op: exports_external.literal("list-microsoft-accounts"),
+    id: exports_external.string().min(1)
+  });
   ProbeQuotaRequestSchema = exports_external.object({
     v: exports_external.literal(PROTOCOL_VERSION),
     op: exports_external.literal("probe-quota"),
@@ -4121,6 +4126,7 @@ var init_protocol = __esm(() => {
     RmAccountRequestSchema,
     SetOverrideRequestSchema,
     ListGoogleAccountsRequestSchema,
+    ListMicrosoftAccountsRequestSchema,
     ProbeQuotaRequestSchema
   ]);
   GetCredentialsDataSchema = exports_external.object({
@@ -4185,6 +4191,16 @@ var init_protocol = __esm(() => {
   ListGoogleAccountsDataSchema = exports_external.object({
     accounts: exports_external.array(GoogleAccountStateSchema)
   });
+  MicrosoftAccountStateSchema = exports_external.object({
+    account: exports_external.string(),
+    expiresAt: exports_external.number(),
+    scope: exports_external.string(),
+    clientId: exports_external.string(),
+    accountType: exports_external.enum(["personal", "work"])
+  });
+  ListMicrosoftAccountsDataSchema = exports_external.object({
+    accounts: exports_external.array(MicrosoftAccountStateSchema)
+  });
   ErrorBodySchema = exports_external.object({
     code: exports_external.enum([
       "FORBIDDEN",
@@ -4308,6 +4324,14 @@ class AuthBrokerClient {
     });
     return data;
   }
+  async listMicrosoftAccounts() {
+    const data = await this.send({
+      v: PROTOCOL_VERSION,
+      id: randomUUID(),
+      op: "list-microsoft-accounts"
+    });
+    return data;
+  }
   async probeQuota(accounts, timeoutMs) {
     const data = await this.send({
       v: PROTOCOL_VERSION,