gitpane 1.0.0__py3-none-any.whl

gitpane/account/authentication.py

@@ -0,0 +1,1811 @@
+"""Select confirmed HTTPS accounts without persisting credentials in application settings."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import shlex
+import stat
+import sys
+import uuid
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import asdict, dataclass, field, fields, replace
+from enum import Enum
+from typing import TYPE_CHECKING, Self
+from urllib.parse import quote, unquote, urlsplit, urlunsplit
+
+from PySide6.QtCore import QObject, Qt, QTimer, Signal, Slot
+
+from gitpane.account.credential_manager import CredentialManagerProblem, CredentialManagerRefusal
+from gitpane.config import (
+    ACCOUNT_CHECK_TIMEOUT_MS,
+    ACCOUNT_SIGN_IN_METHOD_PREFERENCE_KEY,
+    AUTHENTICATION_CONFIG_FILE_LIMIT,
+    AUTHENTICATION_CONFIG_LIMIT_BYTES,
+    AUTHENTICATION_IDLE_TIMEOUT_MS,
+    AUTHENTICATION_PREFERENCE_KEY,
+    AUTHENTICATION_TIMEOUT_MS,
+    BROWSER_SIGN_IN_STOP_GRACE_MS,
+    BROWSER_SIGN_IN_TIMEOUT_MS,
+    CREDENTIAL_MANAGER_PLATFORM_BY_NAME,
+    GCM_ENVIRONMENT_NAME_BY_SETTING,
+    GIT_DEFAULT_TEMPLATE_DIR,
+    HTTPS_PREFIX,
+    SECRET_ERASE_TIMEOUT_MS,
+    SECRET_LOOKUP_STOP_GRACE_MS,
+    SECRET_LOOKUP_TIMEOUT_MS,
+    application_module_interpreter_options,
+)
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus, operation_status
+from gitpane.process.process_group import NativeProcessGroup, console_interpreter_filename
+from gitpane.process.process_runner import CREDENTIAL_PROFILE, ProcessRequest, ProcessRunner, ProcessStatus
+from gitpane.system.path_identity import canonical_path
+from gitpane.transport.refusal_notice import NO_ACCOUNT_CONFIGURED_TEXT, TransferAccount
+from gitpane.worktree.command_sequence import GitCommand
+from gitpane.worktree.worktree_snapshot import read_validated_size
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator
+    from concurrent.futures import Future
+
+    from gitpane.account.credential_manager import CredentialManagerDetection, CredentialManagerLocator
+    from gitpane.history.repository_value import RepositoryContext
+    from gitpane.operation.diagnostic import DiagnosticLog, PreparedDiagnostic
+    from gitpane.preference.preference_store import PreferenceStore
+    from gitpane.process.process_runner import ProcessResult
+
+
+GITHUB_PROVIDER = "GitHub"
+GITLAB_PROVIDER = "GitLab"
+BITBUCKET_PROVIDER = "Bitbucket"
+PROVIDER_HOST_BY_NAME = {GITHUB_PROVIDER: "github.com", GITLAB_PROVIDER: "gitlab.com", BITBUCKET_PROVIDER: "bitbucket.org"}
+# The providers a self-hosted server can be recognised as after it refused a password, each with the path, on that
+# server, of the page where its users create a personal access token.
+TOKEN_PAGE_PATH_BY_PROVIDER = {GITHUB_PROVIDER: "/settings/tokens", GITLAB_PROVIDER: "/-/user_settings/personal_access_tokens"}
+# A generic account is a username with a password or token, valid for any HTTPS server (a self-hosted GitLab with an LDAP
+# login, for example). Its identity is the username the user typed. Before it is saved, Git lists a repository of that
+# server with the typed username and password; a refused test saves nothing.
+GENERIC_PROVIDER = "Generic"
+# GitHub, gitlab.com and Bitbucket Cloud refuse the account password over Git HTTPS, so a new username + password account
+# is refused there before anything is stored; the address is put in front of this text.
+CLOUD_PASSWORD_REFUSAL_TEXT = " does not accept account passwords for Git. Sign in with your browser or use a personal access token."
+ACCOUNT_PROVIDER_SET = frozenset({*PROVIDER_HOST_BY_NAME, GENERIC_PROVIDER})
+
+
+class SignInMethod(Enum):
+    """How an account signs in, with the text the Type column of Settings shows for it.
+
+    The value is the word recorded in the preferences file when an account is added or reconnected. An account saved
+    before that record existed is classified from its own fields; only an old GitHub account cannot be, since its browser
+    and token sign-ins give the same account fields, so it is shown as either and that method is never recorded.
+    """
+
+    BROWSER = ("browser", "Browser (OAuth)")
+    TOKEN = ("token", "Token")
+    PASSWORD = ("password", "Username + password")
+    BROWSER_OR_TOKEN = ("browser-or-token", "Browser or token")
+
+    def __new__(cls, value: str, type_label: str) -> Self:
+        """Keep the recorded word as the value and the Type column text beside it."""
+        member = object.__new__(cls)
+        member._value_ = value
+        member.type_label = type_label
+        return member
+
+
+# The methods recorded when an account is added or reconnected: Browser or token is only ever deduced, never recorded.
+RECORDED_SIGN_IN_METHOD_SET = frozenset((SignInMethod.BROWSER, SignInMethod.TOKEN, SignInMethod.PASSWORD))
+# Git usernames that GitLab and Bitbucket require with a token obtained by browser (OAuth) sign-in.
+GITLAB_OAUTH_GIT_USERNAME = "oauth2"
+BITBUCKET_OAUTH_GIT_USERNAME = "x-token-auth"
+BROWSER_GIT_USERNAME_SET = frozenset({GITLAB_OAUTH_GIT_USERNAME, BITBUCKET_OAUTH_GIT_USERNAME})
+# Optional key of the saved account data: the name the user gave each service address (for example "GitLab at work").
+# Data saved without it stays valid and is never rewritten just to add it.
+SERVICE_NAME_KEY = "service_name"
+ACCOUNT_DATA_KEY_SET = frozenset({"accounts", "global", "repository"})
+RECURSIVE_AUTHENTICATION_KEY_PATTERN = r"^(credential\..*helper|http\..*extraheader)$"
+RECURSIVE_CONFIG_PATH_PATTERN = r"^(include(if\..*)?\.path|init\.templatedir)$"
+# One search of the credential manager at a time for the account service: the search already waits for any other
+# search, and an account exchange never needs two of them.
+CREDENTIAL_HELPER_WORKER_COUNT = 1
+# Key of an exchange's private request that names the folder of Git's programs, given to every direct start of the
+# credential manager so it finds Git even when Git is not on the PATH.
+GIT_EXEC_PATH_KEY = "git_exec_path"
+# Composing with this empty helper list builds a preview: every inherited helper is disabled and no helper command is
+# named, so a captured destination can be compared without searching the credential manager.
+PREVIEW_HELPER_COMMANDS: tuple[str, ...] = ()
+# Written to --log, in front of the refusal sentence, when a recursive operation goes on without any credential helper.
+CREDENTIAL_MANAGER_SKIPPED_LOG_TEXT = "Credential manager refused, continuing without a credential helper: "
+
+
+def helper_after_refusal(refusal: ValueError, *, operation_uses_account: bool, log: DiagnosticLog | None) -> tuple[str, ...]:
+    """Decide what a recursive operation (clone, submodule initialization, Retry submodules) does when the credential manager is refused.
+
+    The search only happens when one of the operation's destinations has an account, often only a service default kept
+    for submodules on another service. The refusal stops the operation only when the operation itself uses an account:
+    a clone URL with an account, the HTTPS ``origin`` with an account of the repository that declares the submodule, or
+    an account chosen for the submodule before Retry submodules. Otherwise, with a parent reached over SSH,
+    ``file://``, a local folder or HTTPS without an account, the operation is never blocked by the credential manager:
+    it goes on with the preview, which gives Git no helper at all, and the refusal is written to --log. A submodule
+    that needed the account then fails on Git's own refusal.
+    """
+    if operation_uses_account:
+        raise refusal
+    if log is not None:
+        log.write_line(CREDENTIAL_MANAGER_SKIPPED_LOG_TEXT + str(refusal))
+    return PREVIEW_HELPER_COMMANDS
+
+
+@dataclass(frozen=True)
+class CredentialHelper:
+    """Name the credential helper one operation uses and the folder of the programs of the Git it belongs to.
+
+    ``exec_path`` is given to every direct start of the helper, so it finds Git even when Git is not on the PATH; it
+    stays empty for a helper injected by tests.
+    """
+
+    commands: tuple[str, ...]
+    exec_path: str = ""
+
+
+# Where Git Credential Manager keeps the secrets of GitPane's accounts: the system's protected store, never a plaintext file.
+# It is chosen per system, like the search of the credential manager; a system missing from the table gets no store, and
+# the search refuses such a system before anything is started.
+MANAGED_CREDENTIAL_STORE = CREDENTIAL_MANAGER_PLATFORM_BY_NAME[sys.platform].credential_store if sys.platform in CREDENTIAL_MANAGER_PLATFORM_BY_NAME else ""
+# Git Credential Manager's provider for a stored account secret: it returns the secret as stored, without any provider sign-in.
+MANAGED_CREDENTIAL_PROVIDER = "generic"
+# Value of Git Credential Manager's yes/no settings that GitPane turns off: prompts and secrets in its traces.
+GCM_DISABLED_VALUE = "false"
+# The sign-in mode a browser sign-in asks each provider's part of Git Credential Manager for: the browser itself for
+# GitHub and GitLab, OAuth (which opens the browser) for Bitbucket, never a prompt for a password or a token.
+BROWSER_AUTH_MODE_BY_SETTING = {"gitHubAuthModes": "browser", "gitLabAuthModes": "browser", "bitbucketAuthModes": "oauth"}
+
+
+class AuthenticationAction(Enum):
+    """The exchanges the account service asks its worker for, written as their value in the JSON the worker reads."""
+
+    SIGN_IN = "sign-in"
+    """Add a new account, by the browser, a typed token or a username + password."""
+    GET = "get"
+    """Read the stored secret of a listed account and check whom it belongs to."""
+    APPROVE = "approve"
+    """Reconnect a listed account: sign in again and replace its stored secret."""
+    REJECT = "reject"
+    """Erase the stored secret of one account and nothing else: after an explicit rejection, or when a new account's
+    secret was stored for a sign-in whose result nobody can see any more."""
+    REMOVE = "remove"
+    """Erase an account's stored secret like a rejection does, then take the account off the durable list."""
+    ERASE_CHECK = "erase-check"
+    """Erase only the temporary copy of a secret under test, when its test was stopped before it could erase the copy itself."""
+    LOOKUP = "lookup"
+    """Ask the helper, without any prompt and without contacting any server, whether each account's secret is still
+    stored: Git and Git Credential Manager erase an account's secret by themselves when a server refuses it."""
+
+
+# Only a new sign-in or a Reconnect stores a fresh secret; checking or erasing an account never adds it to the list.
+REMEMBERED_ACTION_SET = frozenset({AuthenticationAction.SIGN_IN, AuthenticationAction.APPROVE})
+# Every credential namespace of a GitPane account starts with this, so no other program's secrets are ever addressed.
+ACCOUNT_NAMESPACE_PREFIX = "gitpane-"
+# The temporary copy of a secret under test has its own namespace, derived from the account's, so the test never touches
+# the secret already saved for that account. A copy the test could not erase is erased again by the account service,
+# and removing the account erases it too.
+CHECK_NAMESPACE_SUFFIX = "-check"
+# The key of an account test's result that tells whether its worker erased the temporary copy itself; any other answer
+# makes the account service erase the copy again.
+CHECK_COPY_ERASED_KEY = "check_copy_erased"
+# The key of an exchange's result that says its error is GitPane's own sentence, refusing the account the sign-in
+# returned, rather than the output of a program the worker ran.
+GITPANE_REFUSAL_KEY = "gitpane_refusal"
+EMPTY_CHECK_URL_TEXT = "Enter the URL of a repository on {address} to test the sign-in."
+CHECK_URL_FORMAT_TEXT = "Enter the HTTPS URL of a repository on {address}, without a password, to test the sign-in."
+CHECK_URL_ADDRESS_TEXT = "The repository to test must be on {address}."
+GIT_MISSING_TEXT = "Git is not configured. Choose the Git executable in Settings › Tools."
+ACCOUNT_LIST_UNREADABLE_TEXT = ("The saved account list could not be read, so nothing was changed. Another GitPane version may have written it: "
+                                "close the other GitPane windows, then try again.")
+# Said when Git could not complete the test for another reason than a refusal: repository not found, server unreachable.
+CHECK_FAILED_TEXT = "The sign-in could not be tested with {url}. Nothing was saved."
+# Text of a browser sign-in whose browser did not answer within the wait: the exchange was stopped before
+# anything was stored. The worker writes it with its status and the sign-in window shows it.
+BROWSER_TIMEOUT_TEXT = "The browser did not answer in time. Try again."
+# Said instead of starting a browser sign-in when GitPane runs inside a job that forbids leaving it: the browser would
+# then belong to the same job and be closed with it.
+BROWSER_SIGN_IN_UNAVAILABLE_TEXT = "Browser sign-in is not available here: GitPane runs inside a job that would close the browser with it. Sign in with a token instead."
+# A browser sign-in that ran out of time: stopped by its worker at the end of the wait, or, as a safety net, by the
+# process supervisor when the worker itself no longer answers.
+BROWSER_TIMEOUT_STATUS_SET = frozenset((OperationStatus.SIGN_IN_TIMEOUT, OperationStatus.TIMEOUT))
+
+
+class SecretPresence(Enum):
+    """How a check of the stored secrets classifies each account, written as their value in the JSON the worker publishes.
+
+    Only a secret that is clearly gone counts as missing; anything ambiguous (no helper, time limit reached, an unknown
+    error) is unknown and never marks an account.
+    """
+
+    PRESENT = "present"
+    MISSING = "missing"
+    UNKNOWN = "unknown"
+
+
+# The only fields of an account a check of its stored secret needs: where the secret is kept, the address and username
+# the helper is asked about, and the label written to the diagnostics.
+SECRET_LOOKUP_FIELDS = ("namespace", "origin", "git_username", "label")
+
+
+def validate_configuration_filename(filename: str) -> str:
+    """Refuse configuration paths that could bind to another file in a descendant's cwd."""
+    if not os.path.isabs(filename) and os.path.normcase(filename) != os.path.normcase(os.devnull):
+        raise ValueError("Recursive authentication requires absolute Git configuration filenames. Update GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, HOME or XDG_CONFIG_HOME and retry.")
+    return filename
+
+
+def configuration_identity(metadata: os.stat_result) -> tuple[int, int, int, int]:
+    """Answer what proves a configuration file is still the same one: its identity, its size and its modification time."""
+    return metadata.st_dev, metadata.st_ino, metadata.st_size, metadata.st_mtime_ns
+
+
+def configuration_signature(filename: str) -> tuple | None:
+    """Detect replacement and content changes without retaining configuration secrets.
+
+    The opened file must be the one looked at first, before anything is read, and exactly its size is read. The path
+    is looked at again after the read: on POSIX another program can move a new file over a path that is open, and the
+    open stream would keep describing the old file.
+    """
+    try:
+        before = os.stat(filename)
+    except FileNotFoundError:
+        return None
+    if not stat.S_ISREG(before.st_mode):
+        if canonical_path(filename) != canonical_path(os.devnull):
+            raise ValueError("Git authentication configuration must use regular files.")
+        # The null device holds nothing, yet macOS moves its modification time each time any program writes to it: its
+        # identity alone is its signature, so a write by another process never makes a queued recursive command stale.
+        return before.st_dev, before.st_ino
+    if before.st_size > AUTHENTICATION_CONFIG_LIMIT_BYTES:
+        raise ValueError("Git authentication configuration exceeds the inspection size limit.")
+    with open(filename, "rb") as stream:
+        opened = os.fstat(stream.fileno())
+        if configuration_identity(opened) != configuration_identity(before):
+            raise ValueError("Git authentication configuration changed during inspection. Retry the operation.")
+        content = read_validated_size(stream, opened.st_size)
+        after = os.fstat(stream.fileno())
+    try:
+        path_after = os.stat(filename)
+    except FileNotFoundError:
+        path_after = None
+    if (len(content) != opened.st_size or configuration_identity(after) != configuration_identity(before)
+            or path_after is None or configuration_identity(path_after) != configuration_identity(before)):
+        raise ValueError("Git authentication configuration changed during inspection. Retry the operation.")
+    return before.st_dev, before.st_ino, before.st_size, before.st_mtime_ns, hashlib.sha256(content).digest()
+
+
+@dataclass(frozen=True)
+class RecursiveTransportConfiguration:
+    """Keep cleared key names bound to the configuration files inspected before transport."""
+
+    keys: tuple[str, ...]
+    signature_by_filename: dict[str, tuple | None]
+    environment_by_name: dict[str, str | None]
+
+    def verify(self) -> None:
+        """Refuse stale key discovery before a queued recursive command can contact a server."""
+        for name, expected in self.environment_by_name.items():
+            if os.environ.get(name) != expected:
+                raise ValueError("Git authentication environment changed. Retry the operation.")
+        for filename, expected in self.signature_by_filename.items():
+            if configuration_signature(filename) != expected:
+                raise ValueError("Git authentication configuration changed. Retry the operation.")
+
+
+def isolated_http_arguments(command_endpoint: str) -> list[str]:
+    """Prevent inherited HTTP headers from authenticating as another selected account."""
+    # Git prefers the longest matching URL path and then its username. An exact
+    # command-URL reset therefore covers global, included and repository header lists.
+    return ["-c", "http.extraHeader=", "-c", "http." + command_endpoint + ".extraHeader="]
+
+
+def account_namespace(provider: str, origin: str, account: str) -> str:
+    """Bind each managed credential namespace to its full logical account identity."""
+    return ACCOUNT_NAMESPACE_PREFIX + hashlib.sha256(json.dumps([provider, origin, account], ensure_ascii=False).encode("utf-8")).hexdigest()
+
+
+def validate_text(value: object, *, allow_empty: bool = False) -> str:
+    """Reject protocol delimiters without altering exact external account text."""
+    if not isinstance(value, str) or not allow_empty and not value or any(ord(character) < 32 or ord(character) == 127 for character in value):
+        raise ValueError("Account and host fields must contain text without control characters")
+    return value
+
+
+def endpoint_origin(endpoint: str) -> str:
+    """Keep the exact HTTPS host and port while excluding repository paths and userinfo."""
+    validate_text(endpoint)
+    parsed = urlsplit(endpoint)
+    if parsed.scheme != "https" or not parsed.hostname or parsed.password is not None or parsed.query or parsed.fragment:
+        raise ValueError("Enter an HTTPS URL without a password, query or fragment")
+    port = parsed.port
+    if port == 0:
+        raise ValueError("The HTTPS port must be positive")
+    return HTTPS_PREFIX + parsed.netloc.rsplit("@", 1)[-1]
+
+
+def origin_address(origin: str) -> str:
+    """Return the service address shown to the user: host and port, without the scheme."""
+    return endpoint_origin(origin).removeprefix(HTTPS_PREFIX)
+
+
+def check_repository_url(check_url: str, origin: str) -> str:
+    """Accept the repository used to test a username + password account, and return it without any credentials part.
+
+    It must be an HTTPS repository URL on exactly the account's address, so the typed secret is only ever sent to the
+    server it belongs to; a username written in the URL is dropped, since the test always uses the typed username.
+    """
+    validate_text(check_url, allow_empty=True)
+    address = origin_address(origin)
+    if not check_url:
+        raise ValueError(EMPTY_CHECK_URL_TEXT.format(address=address))
+    parsed = urlsplit(check_url)
+    if parsed.scheme != "https" or not parsed.hostname or parsed.password is not None or parsed.query or parsed.fragment or parsed.path in ("", "/"):
+        raise ValueError(CHECK_URL_FORMAT_TEXT.format(address=address))
+    if endpoint_origin(check_url) != origin:
+        raise ValueError(CHECK_URL_ADDRESS_TEXT.format(address=address))
+    return urlunsplit((parsed.scheme, parsed.netloc.rsplit("@", 1)[-1], parsed.path, "", ""))
+
+
+def helper_command_text(helper_commands: tuple[str, ...], environment_by_name: dict[str, str] | None = None) -> str:
+    """Return the helper setting Git runs for the verified helper command: a quoted shell fragment starting with ``!``.
+
+    Git runs such a fragment through a shell, so each variable of ``environment_by_name`` is written as a ``NAME=value``
+    assignment in front of the command: it is given to that helper process only, never to Git or to another helper.
+    """
+    words = []
+    for name, value in (environment_by_name or {}).items():
+        words.append(name + "=" + shlex.quote(value))
+    commands = []
+    for command in helper_commands:
+        commands.append(command.replace("\\", "/") if os.name == "nt" else command)
+    # Git's helper interface is a shell fragment; quote only the captured, verified command.
+    words.append(shlex.join(commands))
+    return "!" + " ".join(words)
+
+
+def gcm_setting_value_by_name(namespace: str) -> dict[str, str]:
+    """Return the Git Credential Manager settings of one account's stored secret, keyed by their Git configuration name.
+
+    The secret is read from GitPane's protected store, in the account's own namespace, without any prompt and without
+    tracing secrets; both the ``-c`` settings and the helper's environment are built from this one mapping.
+    """
+    return {"provider": MANAGED_CREDENTIAL_PROVIDER, "namespace": namespace, "credentialStore": MANAGED_CREDENTIAL_STORE,
+            "interactive": GCM_DISABLED_VALUE, "traceSecrets": GCM_DISABLED_VALUE}
+
+
+def credential_configuration(origin: str, git_username: str, namespace: str, helper_commands: tuple[str, ...], scope: str | None = None) -> list[str]:
+    """Return the ``-c`` settings that make one Git child use only this helper, username and namespace for one address.
+
+    Every inherited helper is disabled first, prompts are off and secrets are never traced. With ``scope`` the settings
+    apply to that URL only instead of the whole address. An empty ``helper_commands`` names no helper: a preview.
+
+    Git chooses the helper with the URL it contacts, repository path included, but Git Credential Manager only matches
+    its own settings against the host, because Git does not send it the path; a setting scoped to a repository URL would
+    be invisible to it and it would look for the secret in its default namespace. The helper is therefore started with
+    those settings in its environment, which Git Credential Manager reads first. The same settings stay in the ``-c``
+    list, where they describe the destination to anyone comparing two previews.
+    """
+    helper_scope = scope or origin
+    setting_value_by_name = gcm_setting_value_by_name(namespace)
+    helper_command = ""
+    if helper_commands:
+        environment_by_name = {}
+        for name, value in setting_value_by_name.items():
+            environment_by_name[GCM_ENVIRONMENT_NAME_BY_SETTING[name]] = value
+        helper_command = helper_command_text(helper_commands, environment_by_name)
+    interactive = setting_value_by_name["interactive"]
+    trace_secrets = setting_value_by_name["traceSecrets"]
+    arguments = ["-c", "credential.helper=", "-c", f"credential.{helper_scope}.helper=", "-c", f"credential.{helper_scope}.helper=" + helper_command,
+                 "-c", f"credential.{origin}.provider=" + setting_value_by_name["provider"], "-c", f"credential.{origin}.username={git_username}",
+                 "-c", f"credential.{origin}.useHttpPath=false", "-c", f"credential.{origin}.namespace=" + setting_value_by_name["namespace"],
+                 "-c", "credential.interactive=" + interactive, "-c", f"credential.{origin}.interactive=" + interactive,
+                 "-c", "credential.traceSecrets=" + trace_secrets, "-c", f"credential.{origin}.traceSecrets=" + trace_secrets,
+                 "-c", f"credential.{origin}.credentialStore=" + setting_value_by_name["credentialStore"]]
+    if scope is None:
+        return arguments
+    scoped_arguments = []
+    for argument in arguments:
+        scoped_arguments.append(argument.replace("credential." + origin + ".", "credential." + scope + "."))
+    return scoped_arguments
+
+
+@dataclass(frozen=True)
+class AccountSelection:
+    """Keep a verified logical account distinct from the username used by Git."""
+
+    provider: str
+    origin: str
+    account: str
+    git_username: str
+    api_identity: str
+    label: str
+    namespace: str
+
+    def __post_init__(self) -> None:
+        """Reject edited selectors that could address an unrelated credential-store namespace."""
+        for value in asdict(self).values():
+            validate_text(value)
+        if self.provider not in ACCOUNT_PROVIDER_SET or endpoint_origin(self.origin) != self.origin or self.namespace != account_namespace(self.provider, self.origin, self.account):
+            raise ValueError("The account selector is invalid. Sign in again.")
+
+    def command_url(self, endpoint: str) -> str:
+        """Apply the selected Git username to an ephemeral URL while preserving the displayed URL."""
+        if endpoint_origin(endpoint) != self.origin:
+            raise ValueError("The account belongs to a different service endpoint")
+        parsed = urlsplit(endpoint)
+        return urlunsplit((parsed.scheme, quote(self.git_username, safe="") + "@" + parsed.netloc.rsplit("@", 1)[-1], parsed.path, "", ""))
+
+    def credential_arguments(self, helper_commands: tuple[str, ...], endpoint: str | None = None) -> list[str]:
+        """Override inherited helpers and account hints only for the intended Git child; an empty ``helper_commands`` gives a preview."""
+        self.command_url(endpoint or self.origin)
+        return credential_configuration(self.origin, self.git_username, self.namespace, helper_commands, endpoint)
+
+
+def generic_account(origin: str, username: str) -> AccountSelection:
+    """Build the selector of a username + password account: the typed username is its account, Git username, identity and label.
+
+    Its namespace is derived like any other account's, so two usernames of one server never share a stored secret.
+    """
+    validate_text(username)
+    origin = endpoint_origin(origin)
+    return AccountSelection(GENERIC_PROVIDER, origin, username, username, username, username, account_namespace(GENERIC_PROVIDER, origin, username))
+
+
+def transfer_account(selection: AccountSelection | None, endpoint: str = "", missing_namespace_set: set[str] | frozenset[str] = frozenset()) -> TransferAccount | None:
+    """Describe the address and account a transfer used, so its failure can name them without carrying any secret.
+
+    With an account, its own address and label are used, and it needs a reconnect when its namespace is in
+    ``missing_namespace_set``, the accounts whose secret a check found gone. Without one, an HTTPS ``endpoint`` still
+    gives the address (with no account), so the failure can say none is connected there; any other endpoint (SSH,
+    local path) gives None.
+    """
+    if selection is not None:
+        return TransferAccount(urlsplit(endpoint_origin(selection.origin)).netloc, selection.label, selection.namespace in missing_namespace_set)
+    try:
+        origin = endpoint_origin(endpoint)
+    except ValueError:
+        return None
+    return TransferAccount(urlsplit(origin).netloc)
+
+
+@dataclass(frozen=True)
+class RecursiveTransportContext:
+    """Bind a confirmed account to one effective Git destination without carrying a secret."""
+
+    endpoint: str
+    origin: str
+    selection: AccountSelection | None = None
+    repository: RepositoryContext | None = None
+
+    def __post_init__(self) -> None:
+        """Refuse selectors that refer to another destination before preparing transport."""
+        if endpoint_origin(self.endpoint) != self.origin:
+            raise ValueError("The recursive destination origin changed. Read the repository again.")
+        if self.selection is not None:
+            self.selection.command_url(self.endpoint)
+
+
+ACCOUNT_FIELD_SET = frozenset(account_field.name for account_field in fields(AccountSelection))
+
+
+def validate_service_names(service_name_by_origin: object) -> None:
+    """Accept only non-empty display names keyed by an exact HTTPS service address."""
+    if not isinstance(service_name_by_origin, dict):
+        raise TypeError("Unreadable service names")
+    for origin, service_name in service_name_by_origin.items():
+        validate_text(origin)
+        validate_text(service_name)
+        if endpoint_origin(origin) != origin:
+            raise ValueError("Unreadable service address")
+
+
+def token_page_url(provider: str, origin: str) -> str:
+    """Return the page of this server where a user of a recognised provider creates a personal access token, or an empty text for any other server."""
+    path = TOKEN_PAGE_PATH_BY_PROVIDER.get(provider)
+    if path is None:
+        return ""
+    return endpoint_origin(origin) + path
+
+
+def provider_for_browser_origin(origin: str) -> str | None:
+    """Name the provider whose browser sign-in is offered for exactly this address (github.com, gitlab.com or bitbucket.org), else None."""
+    for provider, host in PROVIDER_HOST_BY_NAME.items():
+        if origin == HTTPS_PREFIX + host:
+            return provider
+    return None
+
+
+def recorded_sign_in_method(word: object) -> SignInMethod:
+    """Return the recorded sign-in method a saved word names, raising ValueError for a word that names none or one that is never recorded."""
+    try:
+        method = SignInMethod(word)
+    except ValueError as error:
+        raise ValueError("Unreadable account sign-in method") from error
+    if method not in RECORDED_SIGN_IN_METHOD_SET:
+        raise ValueError("Unreadable account sign-in method")
+    return method
+
+
+def read_sign_in_method_json(value: object) -> dict[str, SignInMethod]:
+    """Read the saved JSON object mapping GitPane account namespaces to a recorded sign-in method, raising TypeError or ValueError when it is not one."""
+    if not isinstance(value, str):
+        raise TypeError("Unreadable account sign-in methods")
+    word_by_namespace = json.loads(value)
+    if not isinstance(word_by_namespace, dict):
+        raise TypeError("Unreadable account sign-in methods")
+    method_by_namespace = {}
+    for namespace, word in word_by_namespace.items():
+        validate_text(namespace)
+        if not namespace.startswith(ACCOUNT_NAMESPACE_PREFIX):
+            raise ValueError("Unreadable account sign-in method")
+        method_by_namespace[namespace] = recorded_sign_in_method(word)
+    return method_by_namespace
+
+
+def validate_sign_in_method_json(value: object) -> str:
+    """Accept only a JSON object mapping GitPane account namespaces to a recorded sign-in method, and keep its text as saved."""
+    read_sign_in_method_json(value)
+    return value
+
+
+def sign_in_method_json(method_by_namespace: dict[str, SignInMethod]) -> str:
+    """Write the sign-in methods as the JSON the preferences file holds: each method as its recorded word, which every system and older GitPane versions read."""
+    word_by_namespace = {}
+    for namespace, method in method_by_namespace.items():
+        word_by_namespace[namespace] = method.value
+    return json.dumps(word_by_namespace, ensure_ascii=False)
+
+
+def exchange_sign_in_method(provider: str, action: AuthenticationAction, token: str) -> SignInMethod:
+    """Name how an add or reconnect exchange signs in: a password for a username + password account, else the browser or a typed token."""
+    if provider == GENERIC_PROVIDER:
+        return SignInMethod.PASSWORD
+    if is_browser_sign_in(action, provider, token):
+        return SignInMethod.BROWSER
+    return SignInMethod.TOKEN
+
+
+def account_sign_in_method(selection: AccountSelection, recorded_method_by_namespace: dict[str, SignInMethod]) -> SignInMethod:
+    """Tell how a listed account signs in: its recorded method, else what its own fields show.
+
+    A username + password account is always one. GitLab and Bitbucket give a browser sign-in its own Git username, so
+    any other of their accounts used a token. An old GitHub account without record can be either.
+    """
+    if selection.provider == GENERIC_PROVIDER:
+        return SignInMethod.PASSWORD
+    recorded_method = recorded_method_by_namespace.get(selection.namespace)
+    if recorded_method is not None:
+        return recorded_method
+    if selection.git_username in BROWSER_GIT_USERNAME_SET:
+        return SignInMethod.BROWSER
+    if selection.provider in (GITLAB_PROVIDER, BITBUCKET_PROVIDER):
+        return SignInMethod.TOKEN
+    return SignInMethod.BROWSER_OR_TOKEN
+
+
+def validate_selection_json(value: object) -> str:
+    """Allow only nonsecret account records, scope selectors and service names in persisted JSON."""
+    if not isinstance(value, str):
+        raise TypeError("Unreadable authentication preferences")
+    data_by_key = json.loads(value)
+    if not isinstance(data_by_key, dict) or set(data_by_key) - {SERVICE_NAME_KEY} != ACCOUNT_DATA_KEY_SET:
+        raise ValueError("Unreadable authentication preferences")
+    validate_service_names(data_by_key.get(SERVICE_NAME_KEY, {}))
+    if not isinstance(data_by_key["accounts"], list):
+        raise TypeError("Unreadable account list")
+    for account_by_key in data_by_key["accounts"]:
+        if not isinstance(account_by_key, dict) or set(account_by_key) != ACCOUNT_FIELD_SET:
+            raise ValueError("Authentication preferences may contain only account selectors")
+        for text in account_by_key.values():
+            validate_text(text)
+        if account_by_key["provider"] not in ACCOUNT_PROVIDER_SET or endpoint_origin(account_by_key["origin"]) != account_by_key["origin"]:
+            raise ValueError("Unreadable account endpoint")
+        AccountSelection(**account_by_key)
+    for scope in ("global", "repository"):
+        selection_by_key = data_by_key[scope]
+        if not isinstance(selection_by_key, dict):
+            raise TypeError("Unreadable account scope")
+        for key, selector in selection_by_key.items():
+            validate_text(key)
+            validate_text(selector)
+    return value
+
+
+@dataclass(frozen=True)
+class AuthOutcome:
+    """Report verified identity and credential-store success independently.
+
+    ``refused_before_start`` is set when the exchange ended before any worker or helper ran, so nothing was stored or
+    erased; a removal result still carries its account then, and the Accounts page says the account was not removed
+    without claiming an erase failed. ``credential_manager_refusal`` is set when that early end came from a refused
+    credential manager, so the window explaining how to install it can open. ``refused_by_gitpane`` is set when the
+    exchange ran but GitPane refused the account it returned, such as a Reconnect signed in as another account: the cause
+    is GitPane's own sentence, not a program's output.
+    """
+
+    operation_id: str
+    status: OperationStatus
+    selection: AccountSelection | None = None
+    authenticated: bool = False
+    stored: bool = False
+    diagnostic: PreparedDiagnostic | None = None
+    renewed: bool = False
+    became_default: bool = False
+    removal: AccountRemoval | None = None
+    check: AccountCheck | None = None
+    refused_before_start: bool = False
+    credential_manager_refusal: CredentialManagerDetection | None = None
+    refused_by_gitpane: bool = False
+
+
+def store_was_refused(outcome: AuthOutcome) -> bool:
+    """Tell whether the step that failed is the secure store saving the account, read on the fields of the result only.
+
+    It is so when nothing was stored after the service accepted the sign-in, or after a username + password account
+    passed its Git test. A refusal before any program ran, an account GitPane itself refused, or a failed Git test is
+    another step. The output of the credential manager is never read for this: it names the secure store whatever the
+    failure is.
+    """
+    if outcome.stored or outcome.refused_before_start or outcome.refused_by_gitpane or outcome.check is not None:
+        return False
+    if outcome.selection is not None and outcome.selection.provider == GENERIC_PROVIDER:
+        return True
+    return outcome.authenticated
+
+
+@dataclass(frozen=True)
+class AccountCheck:
+    """Tell what Git said when the test of a username + password on a repository of its server failed.
+
+    ``git_output`` is Git's standard error as a form shows it, without any secret or URL credentials; ``url`` is the
+    tested repository, also without credentials. After an authentication refusal, ``server_provider`` names the
+    provider the server was recognised as (GitHub or GitLab), ``browser_provider`` the provider whose browser sign-in
+    that server offers, and ``token_page_url`` the page where a personal access token is created there; each is empty
+    when unknown.
+    """
+
+    git_output: str
+    url: str = ""
+    server_provider: str = ""
+    browser_provider: str = ""
+    token_page_url: str = ""
+
+
+def account_check(value: object) -> AccountCheck | None:
+    """Read the nonsecret test result a worker published, refusing anything but text.
+
+    A recognised provider must be one a server can be recognised as, its browser sign-in can only be that provider's,
+    and the token page must be exactly the one of that provider on the tested server, so a worker result can never
+    point the user to another address.
+    """
+    if value is None:
+        return None
+    if not isinstance(value, dict) or not isinstance(value.get("git_output"), str):
+        raise TypeError("The credential helper returned an invalid test result")
+    url = validate_text(value.get("url", ""), allow_empty=True)
+    server_provider = validate_text(value.get("server_provider", ""), allow_empty=True)
+    browser_provider = validate_text(value.get("browser_provider", ""), allow_empty=True)
+    page_url = validate_text(value.get("token_page_url", ""), allow_empty=True)
+    if server_provider and (server_provider not in TOKEN_PAGE_PATH_BY_PROVIDER or not url):
+        raise ValueError("The credential helper returned an unknown server provider")
+    if browser_provider not in ("", server_provider):
+        raise ValueError("The credential helper returned an unknown browser sign-in")
+    if page_url and page_url != token_page_url(server_provider, url):
+        raise ValueError("The credential helper returned a token page on another address")
+    return AccountCheck(value["git_output"], url, server_provider, browser_provider, page_url)
+
+
+@dataclass(frozen=True)
+class AccountRemoval:
+    """Tell what a removed account leaves to choose again.
+
+    ``default_cleared`` says the account was its address's Global default, now cleared; ``repository_choice_count`` counts
+    the repositories that chose it explicitly, whose choices are kept so they ask for another account instead of silently
+    using a different one; ``address_has_account`` says another account of the same address is still listed.
+    """
+
+    default_cleared: bool
+    repository_choice_count: int
+    address_has_account: bool
+
+
+@dataclass(frozen=True)
+class AccountCatalogue:
+    """Hold the nonsecret accounts, the default of each service address and one repository's explicit choices, read together in one read.
+
+    ``needs_reconnect_namespace_set`` names the listed accounts whose secret a check of the system credential store
+    found gone: such an account must be reconnected before Git can use it again. ``sign_in_method_by_namespace`` tells
+    how each listed account signs in (see ``account_sign_in_method``).
+    """
+
+    accounts: tuple[AccountSelection, ...]
+    default_namespace_by_origin: dict[str, str]
+    repository_namespace_by_origin: dict[str, str]
+    service_name_by_origin: dict[str, str] = field(default_factory=dict)
+    needs_reconnect_namespace_set: frozenset[str] = frozenset()
+    sign_in_method_by_namespace: dict[str, SignInMethod] = field(default_factory=dict)
+
+
+@dataclass(frozen=True)
+class SecretLookup:
+    """Tell, for each account a check of the system credential store covered, whether its secret is still there.
+
+    It never carries a secret: only the namespaces of the accounts, sorted into present, missing and unknown.
+    """
+
+    missing_namespace_set: frozenset[str]
+    present_namespace_set: frozenset[str]
+    unknown_namespace_set: frozenset[str]
+
+
+@dataclass(frozen=True)
+class AccountListChange:
+    """Tell whether a remembered account was already listed and whether it became its address's default."""
+
+    renewed: bool
+    became_default: bool
+
+
+def check_copy_erased(output: bytes | bytearray) -> bool:
+    """Tell whether an account test's worker reported, in its private result, that it erased the temporary copy of the tested secret.
+
+    An unreadable result, or one that does not say so, counts as not erased: the copy may still be in the secure store.
+    """
+    try:
+        value = json.loads(output) if output else None
+    except ValueError:
+        return False
+    return isinstance(value, dict) and value.get(CHECK_COPY_ERASED_KEY) is True
+
+
+def authentication_worker_filename() -> str:
+    """Answer the absolute file of the account worker, as imported from the installation; a module that cannot be found or is not valid Python, or a missing file, is a launch error.
+
+    The account exchange ends with its own failure on a launch error, so a worker that cannot be found, or that Python
+    cannot compile, never leaves it waiting.
+    """
+    # Imported here, not at the top: the worker imports this module at its top, and only an account exchange needs it.
+    try:
+        import gitpane.account.authentication_worker
+    except (ImportError, SyntaxError) as error:
+        raise OSError("The account worker is not available: " + str(error)) from error
+
+    worker_filename = os.path.abspath(gitpane.account.authentication_worker.__file__)
+    if not os.path.isfile(worker_filename):
+        raise OSError("The account worker is not available: " + worker_filename)
+    return worker_filename
+
+
+def account_worker_command(worker_filename: str) -> tuple[str, list[str]]:
+    """Answer the program and arguments that start the account worker of ``worker_filename`` on the Python GitPane runs on.
+
+    The Python variables the interpreter reads itself and the folders the worker starts from stay out of its import
+    path, while the user's site-packages folder, where pip may have installed GitPane, stays in it as long as the
+    running GitPane has it, and stays out when the running GitPane runs without it. GitPane and the test that
+    launches the worker both take the command from here, so the test runs what GitPane runs. A GitPane started without
+    a console runs on the windowless interpreter, so the worker runs on the console interpreter beside it: the worker
+    starts the credential manager and Git, which would each open a visible console window under a windowless worker. An
+    interpreter that is missing is a launch error: another Python is never searched for.
+    """
+    interpreter_filename = console_interpreter_filename(sys.executable)
+    if not os.path.isfile(interpreter_filename):
+        raise OSError("The account worker interpreter is not available: " + interpreter_filename)
+    return interpreter_filename, [*application_module_interpreter_options(bool(sys.flags.no_user_site)), worker_filename]
+
+
+def breakaway_process_group() -> NativeProcessGroup:
+    """Create the process group of a browser sign-in worker: a member may leave it only by asking explicitly when it starts a process.
+
+    Only the worker asks, for the helper of a browser sign-in, which it then holds in a job of its own. Every other
+    worker keeps a closed group: Git's shell asks to leave any group that allows it for the programs it starts, so a
+    helper run by Git during an account test would otherwise outlive a Cancel or the closing of GitPane.
+    """
+    return NativeProcessGroup(breakaway_allowed=True)
+
+
+def is_browser_sign_in(action: AuthenticationAction, provider: str, token: str) -> bool:
+    """Tell whether an exchange waits for the browser: a new service account or a Reconnect without a typed token."""
+    return action in REMEMBERED_ACTION_SET and provider != GENERIC_PROVIDER and not token
+
+
+@dataclass
+class _AuthenticationRun:
+    """Retain private output and the captured callback until descendants have stopped."""
+
+    callback: Callable[[AuthOutcome], None]
+    output: bytearray
+    is_current: Callable[[], bool] | None = None
+    cancelled: bool = False
+    action: AuthenticationAction | None = None
+    service_name: str = ""
+    sign_in_method: SignInMethod | None = None
+    selection: AccountSelection | None = None
+    check_selection: AccountSelection | None = None
+    # A check of the stored secrets: who gets its result, and each account's list generation when it started.
+    lookup_callback: Callable[[SecretLookup], None] | None = None
+    lookup_generation_by_namespace: dict[str, int] = field(default_factory=dict)
+    # An erase the service started itself, for a secret an exchange left behind: it runs on while GitPane closes.
+    cleanup: bool = False
+
+
+def lookup_request(selection: AccountSelection) -> dict[str, str]:
+    """Describe one account to a check of its stored secret with the nonsecret fields that check needs, and nothing else."""
+    account_by_key = asdict(selection)
+    request_by_key = {}
+    for name in SECRET_LOOKUP_FIELDS:
+        request_by_key[name] = account_by_key[name]
+    return request_by_key
+
+
+def lookup_result(value: object, requested_namespace_set: frozenset[str]) -> SecretLookup:
+    """Read the classification a secret check published, keeping only the accounts it was asked about.
+
+    An account the answer does not classify, or classifies twice, is unknown, so a malformed answer can never mark an
+    account as needing a reconnect.
+    """
+    namespace_set_by_presence: dict[SecretPresence, set[str]] = {}
+    for presence in SecretPresence:
+        namespace_set_by_presence[presence] = set()
+    if isinstance(value, dict) and value.get("status") == OperationStatus.SUCCESS.value:
+        for presence in SecretPresence:
+            namespaces = value.get(presence.value, [])
+            if not isinstance(namespaces, list):
+                continue
+            for namespace in namespaces:
+                if isinstance(namespace, str) and namespace in requested_namespace_set:
+                    namespace_set_by_presence[presence].add(namespace)
+    classified_namespace_set: set[str] = set()
+    ambiguous_namespace_set: set[str] = set()
+    for presence in SecretPresence:
+        ambiguous_namespace_set |= classified_namespace_set & namespace_set_by_presence[presence]
+        classified_namespace_set |= namespace_set_by_presence[presence]
+    missing_namespace_set = namespace_set_by_presence[SecretPresence.MISSING] - ambiguous_namespace_set
+    present_namespace_set = namespace_set_by_presence[SecretPresence.PRESENT] - ambiguous_namespace_set
+    unknown_namespace_set = requested_namespace_set - missing_namespace_set - present_namespace_set
+    return SecretLookup(frozenset(missing_namespace_set), frozenset(present_namespace_set), frozenset(unknown_namespace_set))
+
+
+def no_git_filename() -> str:
+    """Answer that no Git is known: the search of the credential manager then reads only the PATH and the fixed locations."""
+    return ""
+
+
+class AuthenticationService(QObject):
+    """Share the account exchanges with the Git Credential Manager found for Git, and publish only observed, nonsecret account choices."""
+
+    idle = Signal()
+    # A search of the credential manager ended on the service's own thread: its request id and its finished future.
+    credential_helper_resolved = Signal(str, object)
+
+    def __init__(self, preference: PreferenceStore, parent: QObject | None = None,
+                 *, credential_manager: CredentialManagerLocator, helper_commands: tuple[str, ...] | None = None, validation_origin: str | None = None, timeout_ms: int = AUTHENTICATION_TIMEOUT_MS,
+                 check_timeout_ms: int = ACCOUNT_CHECK_TIMEOUT_MS,
+                 browser_timeout_ms: int = BROWSER_SIGN_IN_TIMEOUT_MS, lookup_timeout_ms: int = SECRET_LOOKUP_TIMEOUT_MS,
+                 erase_timeout_ms: int = SECRET_ERASE_TIMEOUT_MS,
+                 current_git_filename: Callable[[], str] = no_git_filename) -> None:
+        """Inject the search of the credential manager, and for isolated tests a helper and a controlled endpoint.
+
+        ``credential_manager`` finds the Git Credential Manager each operation hands to Git and writes its install
+        lines; it is always given, since only the composition root knows the session's distribution and processor,
+        which those lines depend on. A non-empty ``helper_commands`` is used as it is by every exchange and every
+        operation, without any search. ``current_git_filename`` names the Git whose credential manager an account
+        exchange uses when the exchange itself names none (checks, removals, erases).
+
+        ``check_timeout_ms`` bounds the Git test of a username + password account before it is saved, and
+        ``browser_timeout_ms`` the wait for the browser during a browser sign-in; the sign-in window counts that wait down.
+        ``lookup_timeout_ms`` bounds a whole check of the stored secrets, whatever the number of accounts it covers, and
+        ``erase_timeout_ms`` the erase of a secret an exchange left behind.
+        Only the process group of a browser sign-in worker lets its helper leave, so that the browser it opens is
+        never held, nor stopped, with the group; every other worker, the Git test of an account included, stays in a
+        closed group that stops all it started.
+
+        ``missing_secret_namespace_set`` holds, in memory only, the accounts whose secret a check found gone; it is
+        found again by the next check and never saved. Each account's list generation grows with every successful
+        save or removal of that account, so a check started before a Reconnect cannot mark the renewed account.
+        """
+        super().__init__(parent)
+        self.preference = preference
+        self.helper_commands = helper_commands
+        self.credential_manager = credential_manager
+        self.validation_origin = validation_origin
+        self.timeout_ms = timeout_ms
+        self.check_timeout_ms = check_timeout_ms
+        self.browser_timeout_ms = browser_timeout_ms
+        self.lookup_timeout_ms = lookup_timeout_ms
+        self.erase_timeout_ms = erase_timeout_ms
+        self.missing_secret_namespace_set: set[str] = set()
+        self.account_generation_by_namespace: dict[str, int] = {}
+        self.runner = ProcessRunner(self, credential_consumer=self._consume)
+        self.runner.finished.connect(self._finished)
+        self.runner.idle.connect(self.idle)
+        self.active_by_id: dict[str, _AuthenticationRun] = {}
+        self.outcome_by_id: dict[str, AuthOutcome] = {}
+        self.closed = False
+        self.current_git_filename = current_git_filename
+        # The search may start short processes and wait for them, so it never runs on the window's thread; its result
+        # comes back there through a queued signal. Like the file executor of the worktree service, it is never shut
+        # down explicitly: a search still running when GitPane closes ends by itself and starts nothing.
+        self.helper_executor = ThreadPoolExecutor(max_workers=CREDENTIAL_HELPER_WORKER_COUNT, thread_name_prefix="gitpane-credential-manager")
+        # One table for both kinds of answer: the helper an exchange waits for, and the bare detection Settings and the
+        # install window ask for. Each request keeps the continuation of its own kind under its own ID.
+        self.helper_continuation_by_id: dict[str, Callable[[CredentialHelper | None, Exception | None], None] | Callable[[CredentialManagerDetection | None, Exception | None], None]] = {}
+        self.credential_helper_resolved.connect(self._credential_helper_resolved, Qt.ConnectionType.QueuedConnection)
+
+    def accounts(self, origin: str, provider: str) -> list[AccountSelection]:
+        """List the connected accounts of exactly this provider and service endpoint, as saved in the durable list."""
+        accounts = []
+        for data_by_key in self._read()["accounts"]:
+            selection = AccountSelection(**data_by_key)
+            if selection.origin == origin and selection.provider == provider:
+                accounts.append(selection)
+        return sorted(accounts, key=lambda selection: (selection.label, selection.account))
+
+    def account_for_endpoint(self, endpoint: str, context: RepositoryContext | None = None) -> AccountSelection | None:
+        """Resolve repository override before service default without substituting a missing account."""
+        origin = endpoint_origin(endpoint)
+        data_by_key = self._read()
+        namespace = data_by_key["repository"].get(self._scope_key(origin, context)) if context is not None else None
+        namespace = namespace if namespace is not None else data_by_key["global"].get(origin)
+        if namespace is None:
+            return None
+        for account_by_key in data_by_key["accounts"]:
+            if account_by_key["namespace"] == namespace and account_by_key["origin"] == origin:
+                return AccountSelection(**account_by_key)
+        raise ValueError("The selected account is absent. Sign in again or choose an account explicitly.")
+
+    def catalogue(self, context: RepositoryContext | None = None) -> AccountCatalogue:
+        """Read every connected account, the service defaults and, with a repository, its explicit choices in one read, without writing."""
+        data_by_key = self._read()
+        accounts = []
+        for account_by_key in data_by_key["accounts"]:
+            accounts.append(AccountSelection(**account_by_key))
+        accounts.sort(key=lambda selection: (selection.origin, selection.label, selection.account))
+        repository_namespace_by_origin: dict[str, str] = {}
+        if context is not None:
+            repository_dir = canonical_path(context.common_git_dir)
+            for scope_key, namespace in data_by_key["repository"].items():
+                scope = self._decode_scope_key(scope_key)
+                if scope is None:
+                    continue
+                scope_dir, origin = scope
+                if scope_dir == repository_dir:
+                    repository_namespace_by_origin[origin] = namespace
+        needs_reconnect_namespace_set = set()
+        for selection in accounts:
+            if selection.namespace in self.missing_secret_namespace_set:
+                needs_reconnect_namespace_set.add(selection.namespace)
+        recorded_method_by_namespace = self._read_sign_in_methods()
+        sign_in_method_by_namespace = {}
+        for selection in accounts:
+            sign_in_method_by_namespace[selection.namespace] = account_sign_in_method(selection, recorded_method_by_namespace)
+        return AccountCatalogue(tuple(accounts), dict(data_by_key["global"]), repository_namespace_by_origin, dict(data_by_key.get(SERVICE_NAME_KEY, {})),
+                                frozenset(needs_reconnect_namespace_set), sign_in_method_by_namespace)
+
+    def remember_account(self, selection: AccountSelection, service_name: str = "", *, sign_in_method: SignInMethod | None = None) -> AccountListChange:
+        """Add or refresh a signed-in account in the durable list; the first new account of an address without default becomes its default.
+
+        Everything is written at once, so a failed write leaves the stored list unchanged. A default that names an account missing
+        from the list still counts as a default and is not replaced here: the user replaces it explicitly. A non-empty
+        ``service_name`` becomes the name of the account's address in that same write; an empty one keeps the current name.
+        A ``sign_in_method`` records how the account signed in, also in that write; None keeps the record.
+        """
+        validate_text(service_name, allow_empty=True)
+        if sign_in_method is not None and sign_in_method not in RECORDED_SIGN_IN_METHOD_SET:
+            raise ValueError("Unknown sign-in method")
+        data_by_key = self._read_for_write()
+        renewed = False
+        retained_accounts = []
+        for account_by_key in data_by_key["accounts"]:
+            if account_by_key["namespace"] == selection.namespace:
+                renewed = True
+                continue
+            retained_accounts.append(account_by_key)
+        retained_accounts.append(asdict(selection))
+        data_by_key["accounts"] = retained_accounts
+        became_default = not renewed and selection.origin not in data_by_key["global"]
+        if became_default:
+            data_by_key["global"][selection.origin] = selection.namespace
+        if service_name:
+            data_by_key.setdefault(SERVICE_NAME_KEY, {})[selection.origin] = service_name
+        value_by_key = {AUTHENTICATION_PREFERENCE_KEY: json.dumps(data_by_key, ensure_ascii=False)}
+        if sign_in_method is not None:
+            method_by_namespace = self._read_sign_in_methods(for_write=True)
+            method_by_namespace[selection.namespace] = sign_in_method
+            value_by_key[ACCOUNT_SIGN_IN_METHOD_PREFERENCE_KEY] = sign_in_method_json(method_by_namespace)
+        self.preference.update(value_by_key)
+        self._account_changed(selection.namespace)
+        return AccountListChange(renewed, became_default)
+
+    def forget_account(self, selection: AccountSelection) -> AccountRemoval:
+        """Take an account off the durable list, once its stored secret is erased, and clear the Global default that named it.
+
+        Repository choices naming it are kept on purpose: such a repository then asks for another account and its
+        transport refuses, instead of silently using the Global default, which may be someone else; adding the same
+        account again makes those choices valid again. The name of the address goes with its last account. Everything
+        is written at once, and nothing is written when nothing changes, so calling it again is harmless.
+        """
+        data_by_key = self._read_for_write()
+        changed = False
+        retained_accounts = []
+        for account_by_key in data_by_key["accounts"]:
+            if account_by_key["namespace"] == selection.namespace:
+                changed = True
+                continue
+            retained_accounts.append(account_by_key)
+        data_by_key["accounts"] = retained_accounts
+        default_cleared = data_by_key["global"].get(selection.origin) == selection.namespace
+        if default_cleared:
+            del data_by_key["global"][selection.origin]
+            changed = True
+        repository_choice_count = 0
+        for namespace in data_by_key["repository"].values():
+            if namespace == selection.namespace:
+                repository_choice_count += 1
+        address_has_account = False
+        for account_by_key in retained_accounts:
+            if account_by_key["origin"] == selection.origin:
+                address_has_account = True
+        service_name_by_origin = data_by_key.get(SERVICE_NAME_KEY, {})
+        if not address_has_account and selection.origin in service_name_by_origin:
+            del service_name_by_origin[selection.origin]
+            changed = True
+        value_by_key = {}
+        if changed:
+            value_by_key[AUTHENTICATION_PREFERENCE_KEY] = json.dumps(data_by_key, ensure_ascii=False)
+        method_by_namespace = self._read_sign_in_methods(for_write=True)
+        if method_by_namespace.pop(selection.namespace, None) is not None:
+            value_by_key[ACCOUNT_SIGN_IN_METHOD_PREFERENCE_KEY] = sign_in_method_json(method_by_namespace)
+        if value_by_key:
+            self.preference.update(value_by_key)
+        self._account_changed(selection.namespace)
+        return AccountRemoval(default_cleared, repository_choice_count, address_has_account)
+
+    def _account_changed(self, namespace: str) -> None:
+        """Forget that this account needed a reconnect and make any check started before this save or removal stale for it."""
+        self.account_generation_by_namespace[namespace] = self.account_generation_by_namespace.get(namespace, 0) + 1
+        self.missing_secret_namespace_set.discard(namespace)
+
+    def save_global_defaults(self, namespace_by_origin: dict[str, str]) -> None:
+        """Write only the service defaults the user changed, keeping every other default and all repository choices.
+
+        Every value is checked before anything changes and all are written at once, so a refused value or a failed write
+        leaves the saved data as it was. A default can only be replaced by another account of the same address, never removed.
+        """
+        data_by_key = self._read_for_write()
+        origins = sorted(namespace_by_origin)
+        for origin in origins:
+            self._require_connected_account(data_by_key, origin, namespace_by_origin[origin])
+        for origin in origins:
+            data_by_key["global"][origin] = namespace_by_origin[origin]
+        self.preference.update({AUTHENTICATION_PREFERENCE_KEY: json.dumps(data_by_key, ensure_ascii=False)})
+
+    def save_repository_choices(self, namespace_by_origin: dict[str, str | None], context: RepositoryContext) -> None:
+        """Write only this repository's changed rows; None removes the explicit choice so the row follows the global default.
+
+        Choices of other repositories and every default stay as saved. Nothing is written when no row changed.
+        """
+        if not namespace_by_origin:
+            return
+        data_by_key = self._read_for_write()
+        origins = sorted(namespace_by_origin)
+        for origin in origins:
+            namespace = namespace_by_origin[origin]
+            if namespace is not None:
+                self._require_connected_account(data_by_key, origin, namespace)
+        for origin in origins:
+            namespace = namespace_by_origin[origin]
+            scope_key = self._scope_key(origin, context)
+            if namespace is None:
+                data_by_key["repository"].pop(scope_key, None)
+            else:
+                data_by_key["repository"][scope_key] = namespace
+        self.preference.update({AUTHENTICATION_PREFERENCE_KEY: json.dumps(data_by_key, ensure_ascii=False)})
+
+    def save_selection(self, origin: str, selection: AccountSelection | None, context: RepositoryContext | None = None) -> None:
+        """Persist one confirmed nonsecret selector, preserving other repository overrides."""
+        endpoint_origin(origin)
+        data_by_key = self._read_for_write()
+        scope = "repository" if context is not None else "global"
+        key = self._scope_key(origin, context) if context is not None else origin
+        if selection is None:
+            data_by_key[scope].pop(key, None)
+        else:
+            known_accounts = self.accounts(origin, selection.provider)
+            if selection not in known_accounts:
+                raise ValueError("Sign in successfully before saving this account")
+            retained_accounts = []
+            for item in data_by_key["accounts"]:
+                if item["namespace"] != selection.namespace:
+                    retained_accounts.append(item)
+            data_by_key["accounts"] = retained_accounts
+            data_by_key["accounts"].append(asdict(selection))
+            data_by_key[scope][key] = selection.namespace
+        self.preference.update({AUTHENTICATION_PREFERENCE_KEY: json.dumps(data_by_key, ensure_ascii=False)})
+
+    def sign_in(self, provider: str, endpoint: str, callback: Callable[[AuthOutcome], None], *, token: str = "", account_hint: str = "", api_email: str = "",
+                git_filename: str = "", is_current: Callable[[], bool] | None = None, username: str = "", service_name: str = "", check_url: str = "") -> str:
+        """Add an account in a supervised private child: a service account's browser or token identity is verified first,
+        a generic account (``username`` with its password or token) only once Git lists the repository ``check_url`` of that
+        server with them, using ``git_filename``.
+
+        A non-empty ``service_name`` becomes the name shown for this address once the account is listed.
+        """
+        return self._start(AuthenticationAction.SIGN_IN, provider, endpoint, callback, token=token, account_hint=account_hint, api_email=api_email, git_filename=git_filename,
+                           is_current=is_current, username=username, service_name=service_name, check_url=check_url)
+
+    def get(self, selection: AccountSelection, callback: Callable[[AuthOutcome], None], *, git_filename: str = "") -> str:
+        """Check the exact stored account and report expiration without falling back to another."""
+        return self._start(AuthenticationAction.GET, selection.provider, selection.origin, callback, selection=selection, git_filename=git_filename)
+
+    def credential_helper(self, git_filename: str) -> CredentialHelper:
+        """Return the credential manager found for this Git, or raise CredentialManagerRefusal, a ValueError carrying the sentence and the detection of its refusal.
+
+        Blocking: the search may start short processes, so it is called only from a background task, never from the
+        window's thread. An injected helper is returned as it is, without any search.
+        """
+        if self.helper_commands:
+            return CredentialHelper(tuple(self.helper_commands))
+        detection = self.credential_manager.locate(git_filename)
+        if detection.problem != CredentialManagerProblem.NONE:
+            raise CredentialManagerRefusal(detection, self.credential_manager.platform)
+        return CredentialHelper((detection.filename,), detection.exec_path)
+
+    def resolve_credential_helper(self, git_filename: str, continuation: Callable[[CredentialHelper | None, Exception | None], None]) -> None:
+        """Give ``continuation``, on the window's thread, the credential manager found for this Git or the error of its refusal.
+
+        An injected helper answers at once, before this returns. Otherwise the search runs on the service's own thread,
+        since it may start processes and wait for them, and the answer comes back through a queued signal.
+        """
+        if self.helper_commands:
+            continuation(self.credential_helper(git_filename), None)
+            return
+        self._submit_search(self.credential_helper, git_filename, continuation)
+
+    def locate_credential_manager(self, git_filename: str, continuation: Callable[[CredentialManagerDetection | None, Exception | None], None]) -> None:
+        """Give ``continuation``, on the window's thread, what the search finds for this Git, success or refusal, or the error that kept it from running.
+
+        An injected helper is ignored, since the question is what the search itself finds. The search runs on the
+        service's own thread, since it may start processes and wait for them, and the answer comes back through the
+        same queued signal as the helper of an exchange.
+        """
+        self._submit_search(self.credential_manager.locate, git_filename, continuation)
+
+    def _submit_search(self, search: Callable[[str], CredentialHelper | CredentialManagerDetection], git_filename: str,
+                       continuation: Callable[[CredentialHelper | None, Exception | None], None] | Callable[[CredentialManagerDetection | None, Exception | None], None]) -> None:
+        """Run one credential manager search on the service's own thread and give its answer, or the error that kept it from running, to ``continuation`` on the window's thread through the queued signal.
+
+        An executor that no longer accepts work answers on the next turn of the event loop, never before this returns.
+        """
+        request_id = uuid.uuid4().hex
+        self.helper_continuation_by_id[request_id] = continuation
+        try:
+            future = self.helper_executor.submit(search, git_filename)
+        except RuntimeError as failure:
+            self.helper_continuation_by_id.pop(request_id, None)
+            QTimer.singleShot(0, self, lambda failure=failure: continuation(None, failure))
+            return
+        future.add_done_callback(lambda completed: self.credential_helper_resolved.emit(request_id, completed))
+
+    @Slot(str, object)
+    def _credential_helper_resolved(self, request_id: str, future: Future) -> None:
+        """Hand a finished search to the exchange, window or Settings line waiting for it, on the window's thread."""
+        continuation = self.helper_continuation_by_id.pop(request_id, None)
+        if continuation is None:
+            return
+        error = future.exception()
+        if error is not None:
+            continuation(None, error)
+            return
+        continuation(future.result(), None)
+
+    def command_configuration(self, endpoint: str, context: RepositoryContext | None = None, *, selection: AccountSelection | None = None,
+                              helper_commands: tuple[str, ...]) -> tuple[str, list[str]]:
+        """Return an ephemeral command URL and helper configuration for one account.
+
+        Every caller names the helper it composes, since nothing is searched here: the preview (``PREVIEW_HELPER_COMMANDS``),
+        which disables every helper and is used to capture and compare a destination, or the credential manager its
+        operation already found in the background.
+        """
+        if selection is not None and selection not in self.accounts(endpoint_origin(endpoint), selection.provider):
+            raise ValueError("Choose a confirmed account for this service before continuing.")
+        selection = selection or self.account_for_endpoint(endpoint, context)
+        if selection is None:
+            raise ValueError(NO_ACCOUNT_CONFIGURED_TEXT)
+        return selection.command_url(endpoint), selection.credential_arguments(tuple(helper_commands))
+
+    def recursive_configuration(self, destinations: tuple[RecursiveTransportContext, ...], inherited_keys: tuple[str, ...] | RecursiveTransportConfiguration = (), *,
+                                helper_commands: tuple[str, ...]) -> list[str]:
+        """Clear inherited authentication and authorize helpers only for captured destinations.
+
+        Nothing is searched here: a recursive operation finds the credential manager once, in its background task, and
+        passes its ``helper_commands`` for all its destinations, so the Git of every submodule starts that same helper;
+        ``PREVIEW_HELPER_COMMANDS`` composes a preview that names no helper.
+        """
+        if isinstance(inherited_keys, RecursiveTransportConfiguration):
+            inherited_keys.verify()
+            inherited_keys = inherited_keys.keys
+        arguments = ["-c", "credential.helper=", "-c", "http.extraHeader=", "-c", "credential.interactive=" + GCM_DISABLED_VALUE, "-c", "credential.traceSecrets=" + GCM_DISABLED_VALUE]
+        for key in sorted(set(inherited_keys)):
+            validate_text(key)
+            if key.lower().startswith("credential.") and key.lower().endswith(".helper") or key.lower().startswith("http.") and key.lower().endswith(".extraheader"):
+                arguments.extend(["-c", key + "="])
+        for destination in destinations:
+            if destination.selection is None:
+                continue
+            _endpoint, selected_arguments = self.command_configuration(destination.endpoint, destination.repository, selection=destination.selection,
+                                                                       helper_commands=helper_commands)
+            for argument in selected_arguments:
+                if argument == "credential.helper=":
+                    continue
+                if argument == "-c":
+                    continue
+                # Path-scoped selectors prevent another repository on the same host from adopting this account. Only Git
+                # reads them with the path: the helper carries the account's store namespace in its own environment,
+                # since Git Credential Manager ignores a setting scoped to a repository path.
+                argument = argument.replace("credential." + destination.origin + ".", "credential." + destination.endpoint + ".")
+                if argument.startswith("credential.helper="):
+                    argument = "credential." + destination.endpoint + ".helper=" + argument.partition("=")[2]
+                arguments.extend(["-c", argument])
+            arguments.extend(isolated_http_arguments(destination.endpoint))
+        return arguments
+
+    def recursive_context(self, endpoint: str | None = None, selection: AccountSelection | None = None) -> tuple[RecursiveTransportContext, ...]:
+        """Capture each service's default for the whole service, then the parent's own account for its URL only.
+
+        A service default authorizes every repository of that service, the parent's host included, as submodule
+        initialization, Fetch and Push already do: a submodule on the parent's host finds that default. The parent's
+        account comes last because Git applies every matching credential setting in order, so its URL-scoped settings
+        override the host's default for the parent alone, and other repositories of the host never inherit it.
+        """
+        destinations = []
+        for selected_origin in sorted(self._read()["global"]):
+            selected_account = self.account_for_endpoint(selected_origin)
+            if selected_account is not None:
+                destinations.append(RecursiveTransportContext(selected_origin, selected_origin, selected_account))
+        if endpoint is not None:
+            selection = selection or self.account_for_endpoint(endpoint)
+            destinations.append(RecursiveTransportContext(endpoint, endpoint_origin(endpoint), selection))
+        return tuple(destinations)
+
+    def recursive_inherited_keys(self, repository_dirs: tuple[str, ...]) -> Generator[GitCommand, bytes, RecursiveTransportConfiguration]:
+        """Inspect conditional includes and templates before future children can activate headers."""
+        key_set: set[str] = set()
+        pending_files: list[tuple[str, str | None, bool]] = []
+        visited_file_set: set[tuple[str, str | None, bool]] = set()
+        signature_by_filename: dict[str, tuple | None] = {}
+        environment_by_name = {}
+        for name in ("GIT_TEMPLATE_DIR", "GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM", "GIT_CONFIG_NOSYSTEM", "HOME", "XDG_CONFIG_HOME", "USERPROFILE", "HOMEDRIVE", "HOMEPATH"):
+            environment_by_name[name] = os.environ.get(name)
+        for name in ("GIT_CONFIG_GLOBAL", "GIT_CONFIG_SYSTEM"):
+            if environment_by_name[name]:
+                validate_configuration_filename(environment_by_name[name])
+
+        def add_template(directory: str) -> None:
+            """Inspect copied config paths without changing Git's template selection."""
+            if not directory:
+                return
+            if not os.path.isabs(directory):
+                raise ValueError("Recursive authentication requires an absolute Git template directory. Update GIT_TEMPLATE_DIR or init.templateDir and retry.")
+            for basename in ("config", "config.worktree"):
+                pending_files.append((os.path.join(directory, basename), directory, False))
+
+        if not repository_dirs:
+            return RecursiveTransportConfiguration((), {}, environment_by_name)
+        first_repository_dir = next(iter(repository_dirs))
+        for variable in ("GIT_CONFIG_SYSTEM", "GIT_CONFIG_GLOBAL"):
+            output = yield GitCommand(["-C", first_repository_dir, "var", variable], accepted_codes=(0, 1))
+            for raw_filename in output.splitlines():
+                pending_files.append((validate_configuration_filename(os.fsdecode(raw_filename)), None, True))
+        template_directory = os.environ.get("GIT_TEMPLATE_DIR")
+        if template_directory is not None:
+            add_template(template_directory)
+        else:
+            output = yield GitCommand(["-C", first_repository_dir, "-c", "gitpane.templatedir=" + GIT_DEFAULT_TEMPLATE_DIR,
+                                       "config", "--path", "--get", "gitpane.templatedir"])
+            add_template(os.fsdecode(output).rstrip("\r\n"))
+        for repository_dir in repository_dirs:
+            output = yield GitCommand(["-C", repository_dir, "config", "--includes", "--null", "--show-scope", "--show-origin", "--name-only", "--list"])
+            fields = iter(output.removesuffix(b"\0").split(b"\0") if output else ())
+            for scope, origin, _key in zip(fields, fields, fields, strict=True):
+                if not origin.startswith(b"file:"):
+                    continue
+                filename = os.fsdecode(origin.removeprefix(b"file:"))
+                if not os.path.isabs(filename):
+                    filename = os.path.join(repository_dir, filename)
+                pending_files.append((filename, None, scope in (b"system", b"global")))
+        inspected_size = 0
+        while pending_files:
+            filename, template_dir, protected = pending_files.pop()
+            filename = os.path.abspath(filename)
+            if template_dir is not None and os.path.commonpath((canonical_path(template_dir), canonical_path(filename))) != canonical_path(template_dir):
+                raise ValueError("A Git template configuration link escapes its copied directory. Use a regular configuration file and retry.")
+            identity = (canonical_path(filename), canonical_path(template_dir) if template_dir else None, protected)
+            if identity in visited_file_set:
+                continue
+            visited_file_set.add(identity)
+            if len(visited_file_set) > AUTHENTICATION_CONFIG_FILE_LIMIT:
+                raise ValueError("Git authentication configuration exceeds the included-file limit.")
+            signature = configuration_signature(filename)
+            signature_by_filename[filename] = signature
+            if signature is None:
+                continue
+            inspected_size += os.stat(filename).st_size
+            if inspected_size > AUTHENTICATION_CONFIG_LIMIT_BYTES:
+                raise ValueError("Git authentication configuration exceeds the inspection size limit.")
+            output = yield GitCommand(["config", "--file", filename, "--no-includes", "--null", "--name-only", "--get-regexp", RECURSIVE_AUTHENTICATION_KEY_PATTERN], accepted_codes=(0, 1))
+            for raw_key in output.split(b"\0"):
+                if raw_key:
+                    key_set.add(validate_text(raw_key.decode("utf-8", "strict")))
+            # Parse every include independently of its condition: the next Git process
+            # may have a different gitdir, branch or remote URL than this inspection.
+            output = yield GitCommand(["config", "--file", filename, "--no-includes", "--null", "--path", "--get-regexp", RECURSIVE_CONFIG_PATH_PATTERN], accepted_codes=(0, 1))
+            for record in output.split(b"\0"):
+                if not record:
+                    continue
+                key, raw_path = record.split(b"\n", 1)
+                path = os.fsdecode(raw_path)
+                if key == b"init.templatedir":
+                    if protected and template_directory is None:
+                        add_template(path)
+                    continue
+                if not path:
+                    continue
+                included_template_dir = None
+                if not os.path.isabs(path):
+                    path = os.path.abspath(os.path.join(os.path.dirname(filename), path))
+                    if template_dir is not None:
+                        if os.path.commonpath((canonical_path(template_dir), canonical_path(path))) != canonical_path(template_dir):
+                            raise ValueError("A relative Git template include escapes its copied directory. Use an absolute include path and retry.")
+                        included_template_dir = template_dir
+                pending_files.append((path, included_template_dir, protected))
+        configuration = RecursiveTransportConfiguration(tuple(sorted(key_set)), signature_by_filename, environment_by_name)
+        configuration.verify()
+        return configuration
+
+    def reject(self, selection: AccountSelection, callback: Callable[[AuthOutcome], None], *, git_filename: str = "") -> str:
+        """Erase only the selected account's private namespace after an explicit rejection."""
+        return self._start(AuthenticationAction.REJECT, selection.provider, selection.origin, callback, selection=selection, git_filename=git_filename)
+
+    def remove_account(self, selection: AccountSelection, callback: Callable[[AuthOutcome], None], *, is_current: Callable[[], bool] | None = None) -> str:
+        """Erase this account's stored secret, and only its own, then take it off Connected accounts.
+
+        Nothing of any repository is touched: no Git command runs and no repository file is read or written. Once the
+        secret is erased the account is taken off the list even if ``is_current`` no longer accepts the result, so no
+        account stays listed without its secret; if erasing fails the account stays listed and usable.
+        """
+        return self._start(AuthenticationAction.REMOVE, selection.provider, selection.origin, callback, selection=selection, is_current=is_current)
+
+    def lookup_secrets(self, selections: tuple[AccountSelection, ...] | list[AccountSelection], callback: Callable[[SecretLookup], None], *,
+                       is_current: Callable[[], bool] | None = None) -> str:
+        """Check whether each account's secret is still in the system credential store, and remember the accounts whose secret is gone.
+
+        Git and Git Credential Manager erase an account's secret by themselves when a server refuses it, so an account
+        can stay listed without any secret. The check first finds the credential manager of the current Git, away from
+        the window's thread, then only asks it for each secret, in a worker of its own, never interactively, without
+        contacting any server and without writing or erasing anything; it stops after ``lookup_timeout_ms``. It neither
+        waits for nor blocks a sign-in, a Reconnect or a removal. ``callback`` receives the classification while
+        ``is_current`` still accepts it; the remembered accounts change either way. A refused credential manager, or a
+        worker that cannot start, answers through ``callback`` too, every account unknown, and changes no remembered
+        account. Returns the check's operation id, or an empty text when nothing was started (no account, closing).
+        """
+        requested_namespace_set = set()
+        account_by_key_list: list[dict[str, str]] = []
+        for selection in selections:
+            if selection.namespace in requested_namespace_set:
+                continue
+            requested_namespace_set.add(selection.namespace)
+            account_by_key_list.append(lookup_request(selection))
+        if self.closed or not account_by_key_list:
+            return ""
+        operation_id = uuid.uuid4().hex
+        generation_by_namespace = {}
+        for namespace in requested_namespace_set:
+            generation_by_namespace[namespace] = self.account_generation_by_namespace.get(namespace, 0)
+        data_by_key = {"action": AuthenticationAction.LOOKUP.value, "accounts": account_by_key_list, "lookup_timeout_ms": self.lookup_timeout_ms}
+        self.active_by_id[operation_id] = _AuthenticationRun(lambda _outcome: None, bytearray(), is_current=is_current, action=AuthenticationAction.LOOKUP, lookup_callback=callback,
+                                                             lookup_generation_by_namespace=generation_by_namespace)
+
+        def before_start() -> None:
+            """A queued check is not worth starting once GitPane is closing."""
+            if self.closed:
+                raise ValueError("Authentication is shutting down")
+
+        def launch(helper: CredentialHelper | None, error: Exception | None) -> None:
+            """Start the check with the credential manager found, or answer every account unknown on the refusal."""
+            self._launch_exchange(operation_id, data_by_key, helper, error, lambda: self._launch_worker(operation_id, data_by_key, before_start,
+                                                                                                      self.lookup_timeout_ms + SECRET_LOOKUP_STOP_GRACE_MS))
+
+        self.resolve_credential_helper(self.current_git_filename(), launch)
+        return operation_id
+
+    def approve(self, selection: AccountSelection, token: str, callback: Callable[[AuthOutcome], None], *, git_filename: str = "",
+                api_email: str = "", is_current: Callable[[], bool] | None = None, check_url: str = "") -> str:
+        """Reconnect exactly this account, by browser when the token is empty, and refuse any other account before storing a secret.
+
+        Bitbucket token checks need the account e-mail: an entered one wins, otherwise the one saved with the account is used.
+        A username + password account keeps its old secret unless Git lists the repository ``check_url`` with the new one.
+        ``is_current`` lets the requesting form drop a result it can no longer show, so nothing is written for it either.
+        """
+        bitbucket_email = api_email or selection.api_identity
+        return self._start(AuthenticationAction.APPROVE, selection.provider, selection.origin, callback, token=token, selection=selection,
+                           api_email=bitbucket_email if selection.provider == BITBUCKET_PROVIDER else "", git_filename=git_filename, is_current=is_current,
+                           check_url=check_url)
+
+    def cancel(self, operation_id: str) -> None:
+        """Invalidate publication immediately while retaining the process until drainage."""
+        active = self.active_by_id.get(operation_id)
+        if active is not None:
+            active.cancelled = True
+            self.runner.cancel(operation_id)
+
+    def close(self) -> None:
+        """Stop owned helpers before application exit; no result published afterwards can reach a form.
+
+        A stopped account test still gets its temporary secret copy erased, and a new account's secret stored for a
+        result nobody sees is erased too: the runner stays open until those erases end.
+        """
+        self.closed = True
+        for operation_id, active in tuple(self.active_by_id.items()):
+            if not active.cleanup:
+                self.cancel(operation_id)
+        if not self._secret_cleanup_pending():
+            self.runner.close()
+
+    def _start(self, action: AuthenticationAction, provider: str, endpoint: str, callback: Callable[[AuthOutcome], None], *, token: str = "", account_hint: str = "", api_email: str = "",
+               selection: AccountSelection | None = None, git_filename: str = "", is_current: Callable[[], bool] | None = None, username: str = "",
+               service_name: str = "", check_url: str = "") -> str:
+        """Check one credential exchange, find the credential manager for it, then start it; recheck queued work just before it starts.
+
+        Adding or reconnecting a username + password account needs a repository of its server to test the secret on and
+        an absolute Git executable to run the test; both are checked here, before anything starts.
+        An account exchange holds no repository: it only writes GitPane's account list and the system credential store,
+        and only tests a secret against a server address, so no write running on a local repository has any reason to
+        refuse it. The exchange counts as running while its credential manager is searched, away from the window's
+        thread; a refused credential manager ends it with the sentence of the refusal, and nothing is stored.
+        """
+        operation_id = uuid.uuid4().hex
+        try:
+            if self.closed:
+                raise ValueError("Authentication is shutting down")
+            if self._exchange_running():
+                raise ValueError("Another sign-in is still running or stopping. Wait for it to finish, then try again.")
+            if provider not in ACCOUNT_PROVIDER_SET:
+                raise ValueError("Choose GitHub, GitLab, Bitbucket or a username and password account explicitly")
+            origin = endpoint_origin(endpoint)
+            for value in (token, account_hint, api_email, username, service_name, check_url, git_filename):
+                validate_text(value, allow_empty=True)
+            self._require_account_fields(action, provider, origin, username, token)
+            check_selection = None
+            if provider == GENERIC_PROVIDER and action in REMEMBERED_ACTION_SET:
+                check_url = check_repository_url(check_url, origin)
+                if not os.path.isabs(git_filename):
+                    raise ValueError(GIT_MISSING_TEXT)
+                check_selection = selection if selection is not None else generic_account(origin, username)
+            account_hint = account_hint or unquote(urlsplit(endpoint).username or "")
+            validate_text(account_hint, allow_empty=True)
+        except (OSError, ValueError, KeyError) as error:
+            refused_selection = selection if action == AuthenticationAction.REMOVE else None
+            outcome = AuthOutcome(operation_id, OperationStatus.FAILED, selection=refused_selection, diagnostic=Diagnostic("Authentication", "", "", [], str(error)).prepare(),
+                                  refused_before_start=True)
+            self.outcome_by_id[operation_id] = outcome
+            QTimer.singleShot(0, self, lambda: callback(outcome) if not self.closed and (is_current is None or is_current()) else None)
+            return operation_id
+        data_by_key = {"action": action.value, "provider": provider, "origin": origin, "token": token, "account_hint": account_hint, "api_email": api_email, "username": username,
+                       "validation_origin": self.validation_origin, "selection": asdict(selection) if selection else None,
+                       "check_url": check_url, "git_filename": git_filename, "check_timeout_ms": self.check_timeout_ms, "browser_timeout_ms": self.browser_timeout_ms}
+        # A browser sign-in is stopped by its worker at the end of the browser wait; the supervisor only steps in
+        # if the worker itself no longer answers, a little later.
+        browser_sign_in = is_browser_sign_in(action, provider, token)
+        run_timeout_ms = self.browser_timeout_ms + BROWSER_SIGN_IN_STOP_GRACE_MS if browser_sign_in else self.timeout_ms
+        sign_in_method = exchange_sign_in_method(provider, action, token) if action in REMEMBERED_ACTION_SET else None
+        self.active_by_id[operation_id] = _AuthenticationRun(callback, bytearray(), is_current=is_current, action=action, service_name=service_name, selection=selection,
+                                                             check_selection=check_selection, sign_in_method=sign_in_method)
+
+        def before_start() -> None:
+            """A queued helper no longer starts once GitPane is closing or the window that asked for it no longer waits for its result."""
+            if self.closed or is_current is not None and not is_current():
+                raise ValueError("Authentication is no longer authorized")
+
+        def launch(helper: CredentialHelper | None, error: Exception | None) -> None:
+            """Start the worker with the credential manager found, or end the exchange on the refusal."""
+            self._launch_exchange(operation_id, data_by_key, helper, error, lambda: self._launch_worker(operation_id, data_by_key, before_start, run_timeout_ms,
+                                                                                                      browser_sign_in=browser_sign_in))
+
+        self.resolve_credential_helper(git_filename or self.current_git_filename(), launch)
+        return operation_id
+
+    def _launch_exchange(self, operation_id: str, data_by_key: dict[str, object], helper: CredentialHelper | None, error: Exception | None,
+                         start_worker: Callable[[], None]) -> None:
+        """Start an exchange's worker once its credential manager is known, or end the exchange without any worker.
+
+        An exchange cancelled during the search, or one whose service closed meanwhile, starts nothing; neither does one
+        whose credential manager was refused, whose sentence becomes the exchange's failure. A cleanup erase alone still
+        starts while GitPane closes, so a secret left behind is not kept. The private request learns which helper to
+        start and the folder of Git's programs the helper needs.
+        """
+        active = self.active_by_id.get(operation_id)
+        if active is None:
+            return
+        if error is None and (active.cancelled or self.closed and not active.cleanup):
+            error = ValueError("Authentication is no longer authorized")
+        if error is not None:
+            refusal = error.detection if isinstance(error, CredentialManagerRefusal) else None
+            self._end_without_worker(operation_id, str(error), credential_manager_refusal=refusal)
+            return
+        data_by_key["helper_commands"] = list(helper.commands)
+        data_by_key[GIT_EXEC_PATH_KEY] = helper.exec_path
+        try:
+            start_worker()
+        except (OSError, ValueError, KeyError) as launch_error:
+            self._end_without_worker(operation_id, str(launch_error))
+
+    def _end_without_worker(self, operation_id: str, cause: str, *, credential_manager_refusal: CredentialManagerDetection | None = None) -> None:
+        """End an exchange that never got a worker: drop it, publish its failure with ``cause`` when still wanted, and let a closing GitPane go on.
+
+        Nothing ran, so nothing was stored or erased: a removal keeps its account and a check classifies every account
+        as unknown. A removal refused before any worker still carries its account, as every removal result does. No
+        worker means the runner never says it is idle for this exchange, so the service says it here. A
+        ``credential_manager_refusal`` is carried by the failure the exchange publishes, so a sign-in or a removal can
+        open the install window; the lookup of stored secrets, which Settings starts by itself, never carries it.
+        """
+        active = self.active_by_id.pop(operation_id, None)
+        if active is None:
+            return
+        publish = not active.cancelled and not self.closed and (active.is_current is None or active.is_current())
+        if active.action == AuthenticationAction.LOOKUP:
+            lookup = lookup_result(None, frozenset(active.lookup_generation_by_namespace))
+            if publish and active.lookup_callback is not None:
+                QTimer.singleShot(0, self, lambda: active.lookup_callback(lookup) if not self.closed and (active.is_current is None or active.is_current()) else None)
+        elif not active.cleanup:
+            selection = active.selection if active.action == AuthenticationAction.REMOVE else None
+            outcome = AuthOutcome(operation_id, OperationStatus.FAILED, selection=selection, diagnostic=Diagnostic("Authentication", "", "", [], cause).prepare(), refused_before_start=True,
+                                  credential_manager_refusal=credential_manager_refusal)
+            self.outcome_by_id[operation_id] = outcome
+            if publish:
+                QTimer.singleShot(0, self, lambda: active.callback(outcome) if not self.closed and (active.is_current is None or active.is_current()) else None)
+        if self.closed and not self.runner.closed and not self._secret_cleanup_pending():
+            self.runner.close()
+        if not self.active_by_id:
+            self.idle.emit()
+
+    def _launch_worker(self, operation_id: str, data_by_key: dict[str, object], before_start: Callable[[], None], timeout_ms: int, *, browser_sign_in: bool = False) -> None:
+        """Start the worker of one exchange on the command ``account_worker_command`` builds, handing it its private request on stdin only; ``timeout_ms`` bounds the whole exchange.
+
+        Only a ``browser_sign_in`` worker gets a process group its helper may leave; any other worker's group is closed.
+        """
+        worker_filename = authentication_worker_filename()
+        program_filename, arguments = account_worker_command(worker_filename)
+        self.runner.start(ProcessRequest(operation_id, program_filename, arguments, os.path.dirname(worker_filename), timeout_ms,
+                                        session_id=operation_id, stdin=json.dumps(data_by_key, ensure_ascii=False).encode("utf-8"), profile=CREDENTIAL_PROFILE, operation_id=operation_id,
+                                        operation="Authentication", idle_timeout_ms=AUTHENTICATION_IDLE_TIMEOUT_MS, before_start=before_start,
+                                        process_group_factory=breakaway_process_group if browser_sign_in else None))
+
+    def _erase_left_secret(self, selection: AccountSelection, *, account_secret: bool = False) -> None:
+        """Erase a secret an exchange may have left behind: the temporary copy of an account test, or with ``account_secret`` the secret of a new account nobody listed.
+
+        The account's own secret is only erased for an account missing from the saved list, whose secret nothing else
+        uses; for a username + password account the test copy goes with it. It runs even while GitPane is closing, and
+        nobody waits for its result: a test copy it cannot erase either is erased by the next test of the same account
+        or by the account's removal. Nothing but that account's namespaces is touched. The erase counts as pending while
+        the credential manager of the current Git is searched; a refused credential manager drops it silently.
+        """
+        operation_id = uuid.uuid4().hex
+        action = AuthenticationAction.REJECT if account_secret else AuthenticationAction.ERASE_CHECK
+        data_by_key = {"action": action.value, "provider": selection.provider, "origin": selection.origin, "token": "", "account_hint": "", "api_email": "",
+                       "username": "", "validation_origin": self.validation_origin, "selection": asdict(selection)}
+        self.active_by_id[operation_id] = _AuthenticationRun(lambda _outcome: None, bytearray(), action=action, selection=selection, cleanup=True)
+
+        def launch(helper: CredentialHelper | None, error: Exception | None) -> None:
+            """Start the erase with the credential manager found, or drop it on the refusal."""
+            self._launch_exchange(operation_id, data_by_key, helper, error, lambda: self._launch_worker(operation_id, data_by_key, lambda: None, self.erase_timeout_ms))
+
+        self.resolve_credential_helper(self.current_git_filename(), launch)
+
+    def _account_listed(self, namespace: str) -> bool:
+        """Tell whether an account with this namespace is on the saved list; an unreadable list counts as listing it, so no secret is erased on a guess."""
+        try:
+            accounts = self._read()["accounts"]
+            for account_by_key in accounts:
+                if account_by_key["namespace"] == namespace:
+                    return True
+        except (ValueError, KeyError, TypeError):
+            return True
+        return False
+
+    def _exchange_running(self) -> bool:
+        """Tell whether an exchange other than a check of the stored secrets is still running; such a check never blocks a sign-in."""
+        for active in self.active_by_id.values():
+            if active.action != AuthenticationAction.LOOKUP:
+                return True
+        return False
+
+    def _secret_cleanup_pending(self) -> bool:
+        """Tell whether an account test, or an erase of a secret an exchange left behind, is still running."""
+        for active in self.active_by_id.values():
+            if active.check_selection is not None or active.cleanup:
+                return True
+        return False
+
+    def _consume(self, operation_id: str, content: bytes) -> None:
+        active = self.active_by_id.get(operation_id)
+        if active is not None:
+            active.output.extend(content)
+
+    def _finished(self, result: ProcessResult) -> None:
+        """Publish a finished exchange and, once its secret is stored, remember the account in the durable list.
+
+        This runs as a Qt slot. An account test whose worker did not finish on its own (cancelled, timed out, crashed),
+        or did not report its temporary secret copy erased, may have left that copy behind, so it is erased next; when
+        that stopped test was adding a new account, the secret it may already have stored for the account is erased
+        with it. The runner of a closing service closes once no such erase is left.
+        """
+        operation_id = result.request.request_id
+        active = self.active_by_id.pop(operation_id, None)
+        if active is None:
+            return
+        publish = not active.cancelled and not self.closed and (active.is_current is None or active.is_current())
+        check_selection = active.check_selection
+        if check_selection is not None and (result.status != ProcessStatus.SUCCESS or not check_copy_erased(active.output)):
+            stopped_new_account = result.status != ProcessStatus.SUCCESS and active.action == AuthenticationAction.SIGN_IN and not self._account_listed(check_selection.namespace)
+            self._erase_left_secret(check_selection, account_secret=stopped_new_account)
+        if active.action == AuthenticationAction.LOOKUP:
+            self._finish_lookup(active, result, publish)
+        else:
+            self._finish_exchange(active, result, publish)
+        if self.closed and not self.runner.closed and not self._secret_cleanup_pending():
+            self.runner.close()
+
+    def _finish_exchange(self, active: _AuthenticationRun, result: ProcessResult, publish: bool) -> None:
+        """Read the result of an exchange other than a check of the stored secrets, keep the saved list in step with the secure store, and publish it.
+
+        A failed list write is reported as a partial result instead of escaping, so the requesting form always receives an
+        outcome. A secret stored for a result that can no longer be shown (cancelled, window closed, GitPane closing)
+        still keeps the list in step: an account already listed is refreshed, and a new account's secret is erased, so a
+        cancelled sign-in leaves no secret behind that Connected accounts would not show.
+        """
+        operation_id = result.request.request_id
+        selection = None
+        try:
+            data_by_key = json.loads(active.output) if active.output else {}
+            selection = AccountSelection(**data_by_key["selection"]) if data_by_key.get("selection") else None
+            diagnostic = Diagnostic("Authentication", "", "", [], data_by_key.get("error") or result.cause, stderr=result.stderr).prepare()
+            status = OperationStatus(data_by_key.get("status", OperationStatus.FAILED.value)) if result.status == ProcessStatus.SUCCESS else operation_status(result.status)
+            outcome = AuthOutcome(operation_id, status, selection, bool(data_by_key.get("authenticated")), bool(data_by_key.get("stored")), diagnostic if status != OperationStatus.SUCCESS else None,
+                                  check=account_check(data_by_key.get("check")), refused_by_gitpane=data_by_key.get(GITPANE_REFUSAL_KEY) is True)
+        except (ValueError, TypeError, KeyError):
+            selection = None
+            outcome = AuthOutcome(operation_id, OperationStatus.FAILED, diagnostic=Diagnostic("Authentication", "", "", [], "The credential helper returned an invalid response").prepare())
+        finally:
+            active.output.clear()
+        if active.action == AuthenticationAction.REMOVE and active.selection is not None:
+            outcome = self._finish_removal(active.selection, outcome)
+        elif selection is not None and outcome.stored and active.action in REMEMBERED_ACTION_SET and not publish and not self._account_listed(selection.namespace):
+            self._erase_left_secret(selection, account_secret=True)
+        elif selection is not None and outcome.stored and active.action in REMEMBERED_ACTION_SET:
+            try:
+                change = self.remember_account(selection, active.service_name, sign_in_method=active.sign_in_method)
+                outcome = replace(outcome, renewed=change.renewed, became_default=change.became_default)
+            except (OSError, ValueError, TypeError) as error:
+                outcome = AuthOutcome(operation_id, OperationStatus.PARTIAL, selection, authenticated=outcome.authenticated, stored=True, diagnostic=Diagnostic("Authentication", "", "", [], str(error)).prepare())
+        self.outcome_by_id[operation_id] = outcome
+        if publish:
+            active.callback(outcome)
+
+    def _finish_lookup(self, active: _AuthenticationRun, result: ProcessResult, publish: bool) -> None:
+        """Remember the accounts a finished check found without secret, forget those it found with one, and publish the classification.
+
+        A stopped or failed check changes nothing and classifies every account as unknown. An account saved again or
+        removed after the check started keeps its current state: the missing secret belonged to the old sign-in.
+        """
+        requested_namespace_set = frozenset(active.lookup_generation_by_namespace)
+        value = None
+        if result.status == ProcessStatus.SUCCESS and not active.cancelled:
+            try:
+                value = json.loads(active.output) if active.output else None
+            except ValueError:
+                value = None
+        active.output.clear()
+        lookup = lookup_result(value, requested_namespace_set)
+        stale_namespace_set = set()
+        for namespace in lookup.missing_namespace_set:
+            if self.account_generation_by_namespace.get(namespace, 0) != active.lookup_generation_by_namespace[namespace]:
+                stale_namespace_set.add(namespace)
+                continue
+            self.missing_secret_namespace_set.add(namespace)
+        for namespace in lookup.present_namespace_set:
+            self.missing_secret_namespace_set.discard(namespace)
+        if stale_namespace_set:
+            lookup = SecretLookup(lookup.missing_namespace_set - stale_namespace_set, lookup.present_namespace_set, lookup.unknown_namespace_set | stale_namespace_set)
+        if publish and active.lookup_callback is not None:
+            active.lookup_callback(lookup)
+
+    def _finish_removal(self, selection: AccountSelection, outcome: AuthOutcome) -> AuthOutcome:
+        """Take the account off the list once its secret was really erased, whether or not the result can still be shown.
+
+        The person already confirmed the removal, and an account listed without its secret would be worse than a finished
+        removal nobody sees. The removed account is attached to every result, so a failure can name the step that failed.
+        A list that cannot be saved after the erase gives a partial result.
+        """
+        if outcome.status != OperationStatus.SUCCESS:
+            return replace(outcome, selection=selection)
+        try:
+            removal = self.forget_account(selection)
+        except (OSError, ValueError, TypeError) as error:
+            return AuthOutcome(outcome.operation_id, OperationStatus.PARTIAL, selection, diagnostic=Diagnostic("Remove account", "", "", [], str(error)).prepare())
+        return replace(outcome, selection=selection, removal=removal)
+
+    def _read(self) -> dict[str, object]:
+        """Read the saved accounts, defaults and repository choices to show or use them."""
+        return json.loads(self.preference.read(AUTHENTICATION_PREFERENCE_KEY))
+
+    def _read_for_write(self) -> dict[str, object]:
+        """Read the saved account data as stored right now, to build a write on it.
+
+        Every write replaces the whole list, so it must start from what is stored now, never from a copy kept in memory:
+        another window or GitPane process may have removed or added an account meanwhile. When the stored list cannot
+        be read, nothing is written.
+        """
+        try:
+            return json.loads(self.preference.read_saved(AUTHENTICATION_PREFERENCE_KEY))
+        except ValueError as error:
+            raise ValueError(ACCOUNT_LIST_UNREADABLE_TEXT) from error
+
+    def _read_sign_in_methods(self, *, for_write: bool = False) -> dict[str, SignInMethod]:
+        """Read the recorded sign-in method of each account, by namespace; ``for_write`` reads it as stored right now, as ``_read_for_write`` does."""
+        if not for_write:
+            return read_sign_in_method_json(self.preference.read(ACCOUNT_SIGN_IN_METHOD_PREFERENCE_KEY))
+        try:
+            return read_sign_in_method_json(self.preference.read_saved(ACCOUNT_SIGN_IN_METHOD_PREFERENCE_KEY))
+        except ValueError as error:
+            raise ValueError(ACCOUNT_LIST_UNREADABLE_TEXT) from error
+
+    def _require_account_fields(self, action: AuthenticationAction, provider: str, origin: str, username: str, token: str) -> None:
+        """Refuse an exchange missing what its account kind needs, before any child starts.
+
+        A generic account is added with a username and a password or token and reconnected with a new password only: its
+        username never changes. A service account keeps the identity its provider verifies, so a typed username is refused.
+        A new generic account is refused on GitHub, gitlab.com and Bitbucket Cloud, whose Git refuses account passwords;
+        one saved there earlier stays usable and can still be reconnected.
+        """
+        if provider != GENERIC_PROVIDER:
+            if username:
+                raise ValueError("A username is only entered for a username and password account.")
+            return
+        if action == AuthenticationAction.SIGN_IN and provider_for_browser_origin(origin) is not None:
+            raise ValueError(origin_address(origin) + CLOUD_PASSWORD_REFUSAL_TEXT)
+        if action == AuthenticationAction.SIGN_IN and (not username or not token):
+            raise ValueError("Enter a username and a password or token.")
+        if action == AuthenticationAction.APPROVE and not token:
+            raise ValueError("Enter a username and a password or token.")
+
+    def _scope_key(self, origin: str, context: RepositoryContext) -> str:
+        return json.dumps([canonical_path(context.common_git_dir), origin], ensure_ascii=False)
+
+    def _require_connected_account(self, data_by_key: dict[str, object], origin: str, namespace: str | None) -> None:
+        """Refuse a choice that is empty or names no connected account of exactly this service address."""
+        if namespace and endpoint_origin(origin) == origin:
+            for account_by_key in data_by_key["accounts"]:
+                if account_by_key["namespace"] == namespace and account_by_key["origin"] == origin:
+                    return
+        raise ValueError("Choose a connected account for " + origin_address(origin) + " before saving.")
+
+    def _decode_scope_key(self, scope_key: str) -> tuple[str, str] | None:
+        """Split a repository choice key back into its repository directory and origin; a key not built by _scope_key gives None."""
+        scope_part_count = 2
+        try:
+            scope = json.loads(scope_key)
+        except ValueError:
+            return None
+        if not isinstance(scope, list) or len(scope) != scope_part_count:
+            return None
+        repository_dir, origin = scope
+        if not isinstance(repository_dir, str) or not isinstance(origin, str):
+            return None
+        return repository_dir, origin