diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..89af86b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,35 @@
+name: CI
+
+on:
+ pull_request:
+ push:
+ branches: [main]
+
+permissions:
+ contents: read
+
+jobs:
+ verify:
+ runs-on: macos-latest
+ timeout-minutes: 15
+ steps:
+ - name: Check out repository
+ uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+ with:
+ persist-credentials: false
+ - name: Set up Bun
+ uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+ with:
+ bun-version: 1.3.14
+ - name: Install dependencies
+ run: bun install --frozen-lockfile
+ - name: Lint
+ run: bun run lint
+ - name: Typecheck
+ run: bun run typecheck
+ - name: Test
+ run: bun test
+ - name: Build
+ run: bun run build
+ - name: Compile server entry point
+ run: bun build src/server.ts --target=bun --outdir /tmp/dondo-build
diff --git a/AGENTS.md b/AGENTS.md
index 56ec8cf..1de2285 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,6 +13,10 @@
- UI CSS: `src/ui/styles.css`.
- Antigravity behavior: `src/antigravity/*`.
- Codex behavior: `src/codex/*`.
+- Cline behavior: `src/cline/*`.
+- Kiro behavior: `src/kiro/*`.
+- MiniMax behavior: `src/minimax/*`.
+- Shared account state: `src/account-state.ts`.
- Vault and encryption: `src/storage/*`.
- Shared types: `src/types.ts`.
- Config and constants: `src/config.ts`.
@@ -44,6 +48,18 @@ Do not reintroduce root launcher shims or barrel `index.ts` files. Import concre
"codex": {
"data": {},
"limits": {}
+ },
+ "cline": {
+ "data": {},
+ "limits": {}
+ },
+ "kiro": {
+ "data": {},
+ "limits": {}
+ },
+ "minimax": {
+ "data": {},
+ "limits": {}
}
}
```
@@ -52,7 +68,14 @@ Do not reintroduce root launcher shims or barrel `index.ts` files. Import concre
- `antigravity.limits` contains cached limit data.
- `codex.data` contains encrypted `~/.codex/auth.json` snapshots.
- `codex.limits` contains cached Codex ChatGPT usage data.
-- Do not add flat-vault migrations unless explicitly requested.
+- `cline.data` contains encrypted `~/.cline/data/settings/providers.json` snapshots; Cline has no limit cache.
+- `kiro.data` contains encrypted Kiro auth, profile, and client-registration snapshots.
+- `kiro.limits` contains cached Kiro usage data.
+- `minimax.data` contains encrypted MiniMax Agent config snapshots.
+- `minimax.limits` contains cached MiniMax quota and credit data.
+- The nested encrypted format is a hard cut. Do not add flat-vault, plaintext, or runtime compatibility migrations.
+- Preserve isolated corrupt entries across unrelated writes. They must remain deletable but not loadable, syncable,
+ refreshable, or exportable.
- Default app data path logic lives in `src/config.ts`.
## Verification
@@ -60,10 +83,10 @@ Do not reintroduce root launcher shims or barrel `index.ts` files. Import concre
Before finishing code changes, run:
```sh
-bun run typecheck
bun run lint
+bun run typecheck
bun test
bun build src/server.ts --target=bun --outdir /tmp/dondo-build
```
-All three must pass without TypeScript errors, Biome errors, or Biome warnings.
+All four must pass. `bun run lint` is the full Biome formatting, lint, and assist gate, with warnings treated as errors.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..b9de77c
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,54 @@
+# Contributing
+
+Dondo is a macOS-only Bun and TypeScript project. Install Bun 1.3.14 or newer and ensure the macOS `security` command
+is available.
+
+## Setup and development
+
+```sh
+bun install --frozen-lockfile
+bun run dev
+```
+
+The development watcher restarts the server for runtime TypeScript, TSX, CSS, package metadata, and icon changes. Test
+file edits do not restart it.
+
+The package entry point and HTTP server are in `src/server.ts`. Platform behavior lives in `src/antigravity/`,
+`src/codex/`, `src/cline/`, `src/kiro/`, and `src/minimax/`. Shared vault/encryption code is in `src/storage/`, shared
+types are in `src/types.ts`, configuration is in `src/config.ts`, and the Preact UI is in `src/ui/`.
+
+Do not add launcher shims, barrel exports, runtime compatibility layers, or dependencies without a concrete reduction in
+complexity. Import concrete files directly and use arrow functions.
+
+## Verification
+
+Run every gate before opening a pull request:
+
+```sh
+bun run lint
+bun run typecheck
+bun test
+bun run build
+bun build src/server.ts --target=bun --outdir /tmp/dondo-build
+```
+
+Use `bun run format` for formatting-only writes or `bun run fix` for Biome's safe formatter, lint, and assist fixes.
+`bun run lint` is the full read-only gate, including formatting, lint rules, assists, and warning rejection.
+`bun run build` produces a self-contained runnable `dist/` directory and the build smoke test launches that artifact.
+
+## Tests and secrets
+
+- Isolate filesystem tests with temporary `DONDO_VAULT`, auth, config, and data paths. Never target a real application
+ profile or vault.
+- Keychain tests should inject the command runner. If a test must touch macOS Keychain, use a dedicated service/account,
+ avoid parallel mutation, and clean it up.
+- The packaged UI smoke test starts a real local server, so keep its environment and data directory isolated.
+- Never commit, log, snapshot, or render credentials, Keychain payloads, auth/config contents, or decrypted exports.
+- Only `POST /api/{platform}/export` may return credential payloads. Keep it local-only, confirmed, non-cacheable, and
+ all-or-nothing.
+
+## Pull requests
+
+Keep changes narrow, add behavior-focused tests, preserve unrelated worktree changes, and document user-visible or
+breaking behavior. Include the commands you ran and their results. Changes to storage, export, switching, or token
+handling should explain their failure behavior and demonstrate that ordinary API responses remain redacted.
diff --git a/README.md b/README.md
index 0cff291..42d7121 100644
--- a/README.md
+++ b/README.md
@@ -8,227 +8,218 @@
[](https://bun.sh)
[](https://www.typescriptlang.org)
[](https://preactjs.com)
-[](https://biomejs.dev)
+[](https://biomejs.dev)
[](https://www.apple.com/macos)
[](https://antigravity.google)
[](https://openai.com/codex)
-[](https://kiro.dev)
[](https://cline.bot)
+[](https://kiro.dev)
+[](https://www.minimax.io)
[](./LICENSE)
-[](https://github.com/ragaeeb/dondo/issues)
-[](https://wakatime.com/badge/user/a0b906ce-b8e7-4463-8bce-383238df6d4b/project/1c226a67-6f05-42d3-a8c3-591ef0fa09fd)
-Dondo is a small local Bun app for saving and switching local AI tool accounts. It starts a local web UI, stores saved accounts in an encrypted local vault, and currently supports Antigravity, Codex, Cline, Kiro, and MiniMax.
+Dondo is a small local Bun app for saving and switching Antigravity, Codex, Cline, Kiro, and MiniMax accounts. It
+runs a Preact UI on loopback, keeps saved credentials in an encrypted local vault, and fetches supported usage limits
+server-side without returning token payloads from ordinary state APIs.
-Current platform support is macOS. Dondo uses the macOS `security` CLI for the local vault key, and Antigravity account switching uses macOS Keychain entries.
+**Dondo supports macOS only.** It uses the macOS `security` CLI and the login user's default Keychain for its vault
+key and Antigravity credentials. Custom Keychain files are not supported.
## Install
-Install Bun 1.3 or newer, then run:
+Install Bun 1.3.14 or newer, then run:
```sh
bunx dondo-donuts
```
-Then open the URL printed by the server. By default Dondo starts at:
-
-```text
-http://127.0.0.1:3000
-```
-
-If that port is busy, Dondo uses the next available port. The server binds to `127.0.0.1` only.
-
-## Development
+Open the URL printed by the server. Dondo starts at `http://127.0.0.1:3000` by default and tries the next available
+port when that port is occupied. It never binds to a non-loopback interface.
-```sh
-bun install
-bun run start
-```
-
-Useful checks:
-
-```sh
-bun run typecheck
-bun run lint
-bun test
-bun build src/server.ts --target=bun --outdir /tmp/dondo-build
-```
-
-## Storage
-
-Dondo stores its vault at the platform data directory:
-
-- macOS: `~/Library/Application Support/Dondo/vault.json`
-- Windows: `%LOCALAPPDATA%/Dondo/Data/vault.json`
-- Linux: `$XDG_DATA_HOME/dondo/vault.json` or `~/.local/share/dondo/vault.json`
-
-Set `DONDO_DATA_DIR` to override the directory, or `ANTIGRAVITY_VAULT` to override the full vault path.
-`DONDO_VAULT` also overrides the full vault path and takes precedence over the historical `ANTIGRAVITY_VAULT` name.
-When upgrading, rename `ANTIGRAVITY_VAULT` to `DONDO_VAULT` for clarity; the historical name remains supported.
-
-Vault shape:
-
-```json
-{
- "antigravity": {
- "data": {},
- "limits": {}
- },
- "codex": {
- "data": {},
- "limits": {}
- },
- "cline": {
- "data": {},
- "limits": {}
- },
- "kiro": {
- "data": {},
- "limits": {}
- },
- "minimax": {
- "data": {},
- "limits": {}
- }
-}
-```
+## Using Dondo
-`antigravity.data` stores saved account snapshots. The token-bearing `password` field is encrypted with AES-256-GCM before writing to disk. Non-secret metadata such as labels, service names, and timestamps remains readable in the vault so the UI can list accounts. The encryption key is a random local secret stored in macOS Keychain as `dondo / vault-key`.
+Open a platform tab and use `Save current` while that application's desired account is live. A saved account can then
+be loaded, deleted, and, where supported, refreshed or synchronized with the current account. Export downloads every
+saved account for one platform as an unencrypted JSON attachment after an explicit warning.
-`antigravity.limits` stores cached rate-limit data. Dondo fetches missing limits on first load and refreshes cached limits only when the UI `Refresh limits` button is used.
+### Antigravity switching
-`codex.data` stores encrypted snapshots of `~/.codex/auth.json`. Loading a saved Codex account writes that snapshot back to `~/.codex/auth.json` with `0600` permissions.
+Loading Antigravity replaces its live Keychain credential and removes these local state paths before restoration:
-`codex.limits` stores cached Codex ChatGPT usage data. Dondo fetches missing limits on first load and refreshes cached limits only when the UI `Refresh limits` button is used.
+- `~/.antigravity-agent/cloud_accounts.db`
+- `~/.gemini/antigravity`
+- `~/.gemini/antigravity-ide`
+- `~/.gemini/antigravity-backup`
+- `~/Library/Application Support/Antigravity`
-`cline.data` stores encrypted snapshots of `~/.cline/data/secrets.json`. Loading a saved Cline account writes the complete
-secrets file back to the same path with `0600` permissions. Cline account rows use the stable account identity from the
-file only to show which saved account is active; token values are never returned by the state API or rendered in the UI.
+`Clear live` deletes the live Keychain item and the same local state. Antigravity must be fully quit before loading or
+clearing; Dondo rejects either operation while its process is running so it cannot restore stale state. Reopen it after
+the operation. These actions change local login state; they do not remotely revoke the account.
-`kiro.data` stores encrypted snapshots of `~/.aws/sso/cache/kiro-auth-token.json`. Loading a saved Kiro account
-writes a freshly validated snapshot back to the same path with `0600` permissions. Kiro watches this file and picks
-up account changes while the IDE is running. If Kiro has remotely revoked a saved session, Dondo rejects the load
-without replacing the current live credentials.
+### Kiro switching
-To add multiple accounts, use `Save current` while signed in, fully quit Kiro, and use `Clear live`. Reopen Kiro,
-sign into the next account, and save it under another label. To switch accounts later, fully quit Kiro, load the
-saved account in Dondo, and reopen Kiro. Dondo snapshots the auth token, cached profile, and the client-registration
-credential used by Builder ID or enterprise sessions. `Clear live` removes those account-specific local artifacts
-without calling Kiro's remote logout endpoint.
-The Kiro account rows intentionally do not offer `Sync current`, because that action cannot verify that the live
-account matches the row label.
+Kiro must be fully quit before `Load` or `Clear live`; Dondo rejects either operation while Kiro is running. Save the
+current account first, quit Kiro, clear its live files, reopen it, sign into the next account, and save that account under
+a new label. To switch later, quit Kiro, load the saved account in Dondo, and reopen Kiro.
-`kiro.limits` stores cached Kiro usage data. Dondo fetches missing limits when the Kiro tab opens and refreshes every
-saved account only when `Refresh limits` is selected.
+Dondo snapshots Kiro's auth token, optional profile, and matching client registration. Loading validates or refreshes
+the saved session, stages the replacement files, and then commits them with `0600` permissions. Clearing removes those
+local account files without calling Kiro's remote logout endpoint. Kiro intentionally has no `Sync current` row action.
-`minimax.data` stores encrypted snapshots of `~/Library/Application Support/MiniMax Agent/minimax-agent-config.json`. Loading a saved MiniMax account writes that snapshot back to the same path with `0600` permissions.
+## Vault and recovery
-`minimax.limits` caches the 5-hour and weekly MiniMax Code quotas fetched from its current coding-plan endpoint. Dondo fetches missing limits when the MiniMax tab opens and refreshes every saved account only when `Refresh limits` is selected.
+The default vault is `~/Library/Application Support/Dondo/vault.json`. Set `DONDO_DATA_DIR` to replace its containing
+directory or `DONDO_VAULT` to replace the complete vault path.
-Each limit cache entry has this shape:
+The current vault contract is a hard cut to nested, encrypted platform sections:
```json
{
- "fetchedAt": "2026-06-02T00:00:00.000Z",
- "quota": {
- "ok": true,
- "tier": "plus",
- "expires": "",
- "models": {}
- }
+ "antigravity": { "data": {}, "limits": {} },
+ "cline": { "data": {}, "limits": {} },
+ "codex": { "data": {}, "limits": {} },
+ "kiro": { "data": {}, "limits": {} },
+ "minimax": { "data": {}, "limits": {} }
}
```
-Encrypted strings use the `enc:v1:` envelope: AES-256-GCM with a 12-byte IV, 16-byte auth tag, then ciphertext, base64 encoded.
+Dondo does not perform runtime migrations from historical flat vaults, plaintext secret fields, or `enc:v1`
+ciphertexts. Back up an old vault before upgrading and re-save accounts from their live applications into the current
+format. Existing `enc:v1` rows appear as `Corrupted`; delete and re-save them before exporting. The historical
+`ANTIGRAVITY_VAULT` environment name is no longer supported; use `DONDO_VAULT`. The historical
+`ANTIGRAVITY_KEYCHAIN` override is also unsupported; Dondo always uses the default Keychain.
+
+Secret-bearing fields are encrypted independently with AES-256-GCM in an `enc:v2:` envelope. Each ciphertext is bound
+to its platform, account label, secret field, and non-secret snapshot metadata, so copying it to another row or changing
+its metadata fails authentication. The random vault secret is stored in the default macOS Keychain as
+`dondo / vault-key`; only non-secret labels, timestamps, and cached limit metadata remain readable in the vault. Codex,
+Cline, Kiro, and MiniMax live files restored by Dondo are written with `0600` permissions.
+
+The vault file is not a self-contained credential backup. If the `dondo / vault-key` Keychain item is lost, Dondo
+refuses to generate a replacement while `enc:v2` data exists because doing so would make the loss permanent and
+silent. Restore that Keychain item from backup, or remove the unreadable vault and save every account again from its
+live application.
+
+If one saved credential cannot be decrypted or has an invalid stored shape, Dondo isolates and preserves its raw vault
+entry. The UI shows a redacted `Corrupted` row: it cannot be loaded, synchronized, or refreshed, but it can be deleted.
+Delete that row and use `Save current` to create it again. Other healthy accounts remain usable.
+
+An export is all-or-nothing for the selected platform. If any saved account for that platform is damaged, Dondo refuses
+the entire export instead of silently producing an incomplete wallet. In browsers that support the File System Access
+API, Dondo asks for the destination before requesting the wallet and streams the response directly to that file; a
+failed stream is aborted so a partial file is not committed. Other browsers use a temporary in-memory Blob download.
+
+### Platform data
+
+| Platform | Live source restored by Dondo | Cached usage |
+| --- | --- | --- |
+| Antigravity | Default macOS Keychain service/account configured below | Model quotas |
+| Codex | `~/.codex/auth.json` | ChatGPT usage windows |
+| Cline | `~/.cline/data/settings/providers.json` | None |
+| Kiro | `~/.aws/sso/cache/kiro-auth-token.json` plus related profile/registration | Agentic-request usage |
+| MiniMax | `~/Library/Application Support/MiniMax Agent/minimax-agent-config.json` | 5-hour, weekly, and credit balance |
+
+MiniMax also provides `Daily Check-In`. A successful claim invalidates the affected cached limits so the credit balance
+can be refreshed.
+
+Codex snapshots follow the current Codex CLI auth contract: API-key accounts use `auth_mode: "apikey"` and ChatGPT
+accounts use `auth_mode: "chatgpt"`. The historical `auth_mode: "api_key"` spelling is rejected; sign in again with a
+current Codex CLI and re-save that account.
+
+Cline snapshots contain the current `providers.json` contract only; historical settings or secret-file layouts are not
+read or migrated. MiniMax snapshots require a non-empty JWT access token with the current account identity claim;
+legacy identity heuristics are not used. Kiro snapshots require a refresh token and valid JSON objects for any saved
+profile or client registration. A saved label with any semantically invalid configuration is shown as `Corrupted` and
+must be deleted before that label can be saved again.
## Environment
-```sh
-DONDO_PORT=3000
-PORT=3000
-DONDO_DATA_DIR=/custom/data/dir
-DONDO_VAULT=/custom/vault.json
-ANTIGRAVITY_VAULT=/custom/vault.json
-ANTIGRAVITY_SERVICE=gemini
-ANTIGRAVITY_ACCOUNT=antigravity
-ANTIGRAVITY_KEYCHAIN=login.keychain-db
-ANTIGRAVITY_VERSION=2.0.3
-ANTIGRAVITY_LANGUAGE_SERVER_PATH=/Applications/Antigravity.app/Contents/Resources/bin/language_server
-CODEX_AUTH_PATH=~/.codex/auth.json
-CLINE_SECRETS_PATH=~/.cline/data/secrets.json
-KIRO_AUTH_PATH=~/.aws/sso/cache/kiro-auth-token.json
-KIRO_PROFILE_PATH="~/Library/Application Support/Kiro/User/globalStorage/kiro.kiroagent/profile.json"
-KIRO_AUTH_REFRESH_URL=https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken
-MINIMAX_CONFIG_PATH=~/Library/Application Support/MiniMax Agent/minimax-agent-config.json
-MINIMAX_PLATFORM_URL=https://platform.minimax.io
-```
-
-`DONDO_PORT` takes precedence over `PORT`; both set the preferred starting port, and Dondo uses the next available port if that port is busy. `ANTIGRAVITY_KEYCHAIN` is passed as the keychain argument to macOS `security` commands, for example `login.keychain-db` or an absolute keychain path.
-
-Antigravity limit refreshes can use the saved Google refresh token to rotate an expired saved access token, then write the refreshed token blob back to the encrypted vault entry. Dondo discovers Antigravity's Google OAuth client from the local Antigravity language server binary. Codex limit refreshes only call the usage endpoint with the saved access token.
+All overrides are optional.
+
+| Variable | Default or behavior |
+| --- | --- |
+| `DONDO_PORT` | Preferred port, default `3000`; takes precedence over `PORT` |
+| `PORT` | Fallback preferred port |
+| `DONDO_DATA_DIR` | `~/Library/Application Support/Dondo` |
+| `DONDO_VAULT` | `vault.json` under `DONDO_DATA_DIR` |
+| `ANTIGRAVITY_SERVICE` | `gemini` |
+| `ANTIGRAVITY_ACCOUNT` | `antigravity` |
+| `ANTIGRAVITY_VERSION` | `2.0.3` request version |
+| `ANTIGRAVITY_PROCESS_NAME` | `Antigravity` |
+| `ANTIGRAVITY_LANGUAGE_SERVER_PATH` | Optional language-server binary used for local OAuth client discovery |
+| `CODEX_AUTH_PATH` | `~/.codex/auth.json` |
+| `CLINE_PROVIDERS_PATH` | `~/.cline/data/settings/providers.json` |
+| `KIRO_AUTH_PATH` | `~/.aws/sso/cache/kiro-auth-token.json` |
+| `KIRO_PROFILE_PATH` | Kiro's macOS global-storage `profile.json` |
+| `KIRO_PROCESS_NAME` | `Kiro` |
+| `KIRO_AUTH_REFRESH_URL` | Kiro desktop session refresh endpoint |
+| `KIRO_USAGE_URL` | Optional usage endpoint override; normally derived from the profile region |
+| `KIRO_USER_AGENT` | `KiroIDE-0.0.0-dondo` |
+| `MINIMAX_CONFIG_PATH` | MiniMax Agent's macOS `minimax-agent-config.json` |
+| `MINIMAX_AGENT_URL` | `https://agent.minimax.io` |
+| `MINIMAX_PLATFORM_URL` | `https://platform.minimax.io` |
+| `MINIMAX_UUID` | Optional MiniMax device UUID override |
+| `MINIMAX_LOCAL_STORAGE_PATH` | `Local Storage/leveldb` beside `MINIMAX_CONFIG_PATH` |
+
+For local development, use repository-relative override paths such as `DONDO_DATA_DIR=./local-data` rather than a real
+application vault.
## Local API
-All API requests must be sent to localhost. Mutating routes require `POST` with a JSON object body. Export routes
-require `POST` and the `X-Dondo-Export: 1` header.
-
-- `GET /api/antigravity/state`
-- `POST /api/antigravity/export`
-- `POST /api/antigravity/limits/refresh` with optional `{ "key": "label" }`
-- `POST /api/antigravity/save` with `{ "key": "label" }`
-- `POST /api/antigravity/load` with `{ "key": "label" }`
-- `POST /api/antigravity/delete` with `{ "key": "label" }`
-- `POST /api/antigravity/clear`
-- `GET /api/codex/state`
-- `POST /api/codex/export`
-- `POST /api/codex/limits/refresh` with optional `{ "key": "label" }`
-- `POST /api/codex/save` with `{ "key": "label" }`
-- `POST /api/codex/load` with `{ "key": "label" }`
-- `POST /api/codex/delete` with `{ "key": "label" }`
-- `GET /api/cline/state`
-- `POST /api/cline/export`
-- `POST /api/cline/save` with `{ "key": "label" }`
-- `POST /api/cline/load` with `{ "key": "label" }`
-- `POST /api/cline/delete` with `{ "key": "label" }`
-- `GET /api/kiro/state`
-- `POST /api/kiro/limits/refresh` with optional `{ "key": "label" }`
-- `POST /api/kiro/export`
-- `POST /api/kiro/save` with `{ "key": "label" }`
-- `POST /api/kiro/load` with `{ "key": "label" }`
-- `POST /api/kiro/delete` with `{ "key": "label" }`
-- `POST /api/kiro/clear`
-- `GET /api/minimax/state`
-- `POST /api/minimax/export`
-- `POST /api/minimax/limits/refresh` with optional `{ "key": "label" }`
-- `POST /api/minimax/save` with `{ "key": "label" }`
-- `POST /api/minimax/load` with `{ "key": "label" }`
-- `POST /api/minimax/delete` with `{ "key": "label" }`
-
-`Clear live` deletes the live Antigravity Keychain item plus these local Antigravity state paths:
+Every API request must target `localhost` or `127.0.0.1`, and the request URL and `Host` header must agree. When an
+`Origin` header is present, it must exactly equal the local server origin, including host and port. JSON body routes
+require `Content-Type: application/json` and a top-level object.
+
+The complete route surface is:
+
+- `GET /api/{platform}/state` for `antigravity`, `codex`, `cline`, `kiro`, and `minimax`.
+- `POST /api/{platform}/export` for all five platforms. It requires `X-Dondo-Export: 1`.
+- `POST /api/{platform}/save`, `/load`, and `/delete` for all five platforms with `{ "key": "label" }`.
+- `POST /api/{platform}/limits/refresh` for Antigravity, Codex, Kiro, and MiniMax with optional
+ `{ "key": "label" }`.
+- `POST /api/antigravity/clear` and `POST /api/kiro/clear` with an empty JSON object.
+- `POST /api/minimax/check-in` with optional `{ "key": "label" }`.
+
+The server accepts at most **16 KiB** per JSON request body, serializes at most **8 MiB** per export attachment, and
+reads at most **16 MiB** from the vault file. Local API traffic is rate limited to 120 requests per 10 seconds.
+Live credential files, captured system-command output, and each upstream HTTP response are limited to **1 MiB**.
+OAuth discovery scans at most **192 MiB** from a language-server binary; MiniMax identity discovery examines the newest
+64 LevelDB/log files, reads at most **16 MiB** from each, and stops after **64 MiB** in total.
+The vault accepts at most 4,096 accounts per platform, 256 cached models per account, and 4 KiB per non-secret metadata
+field.
+
+State, limit, mutation, and error responses are non-cacheable and never contain credential payloads. Export is the only
+token-bearing API response. It is a local-only, non-cacheable attachment and should be protected like the original auth
+files.
+
+When Dondo writes a vault secret or Antigravity credential through the macOS `security` CLI, it sends the secret over
+the child process's standard input instead of placing it in the process argument list. Command failures redact both
+private input and recognizable token fields. macOS may still show a Keychain access prompt, and another process running
+as the logged-in user remains within the local trust boundary.
-- `~/.antigravity-agent/cloud_accounts.db`
-- `~/.gemini/antigravity`
-- `~/.gemini/antigravity-ide`
-- `~/.gemini/antigravity-backup`
-- `~/Library/Application Support/Antigravity`
+## Development
-## Security Model
+```sh
+bun install --frozen-lockfile
+bun run dev
+```
-Dondo is designed to be easy to inspect:
+`bun run dev` restarts the local server when runtime TypeScript, TSX, CSS, package metadata, or icons change. Test-only
+edits do not restart it. Run the full gates before submitting a change:
-- The server listens on `127.0.0.1`.
-- State and limit APIs do not return token payloads.
-- Saved token payloads are encrypted at rest.
-- Rate-limit API calls happen server-side.
-- Token payloads and Codex `auth.json` contents are never rendered in the UI.
+```sh
+bun run lint
+bun run typecheck
+bun test
+bun run build
+bun build src/server.ts --target=bun --outdir /tmp/dondo-build
+```
-The export routes are the sole API exception: they return every saved account for the selected platform as an
-unencrypted JSON attachment. The UI asks for explicit confirmation before calling them. Export requires a local
-`POST` request with a dedicated confirmation header, is rate limited with the rest of the local API, and uses
-`Cache-Control: no-store`. The downloaded file contains live credentials and must be stored and shared as carefully
-as the original auth files.
+`bun run lint` checks formatting, lint rules, and import/key-order assists with warnings treated as failures.
+`bun run format` writes formatting only; `bun run fix` applies Biome's safe formatter, lint, and assist fixes. See
+[CONTRIBUTING.md](./CONTRIBUTING.md) for test isolation and pull request expectations.
-This protects against casual plaintext scraping of the vault file. A process running as the same logged-in user may still be able to access local Keychain items depending on operating-system policy. Antigravity restore currently passes the token blob to the macOS `security` CLI as an argument, which can be visible briefly to same-user process listings.
+`bun run build` writes a runnable `dist/server.js` plus its browser bundle, stylesheet, and icons. Launch that artifact
+with `bun dist/server.js`; it does not depend on the source tree at runtime.
## License
diff --git a/biome.json b/biome.json
index e40139e..6ae959a 100644
--- a/biome.json
+++ b/biome.json
@@ -1,5 +1,5 @@
{
- "$schema": "https://biomejs.dev/schemas/latest/schema.json",
+ "$schema": "https://biomejs.dev/schemas/2.5.8/schema.json",
"assist": {
"actions": {
"source": {
@@ -17,11 +17,8 @@
"ignoreUnknown": true,
"includes": [
"src/**",
- "test/**",
- "bin/**",
- "*.ts",
- "*.mjs",
- "*.js",
+ "scripts/**",
+ ".github/**",
"*.json",
"*.md",
"!!**/node_modules",
@@ -54,7 +51,7 @@
"enabled": true,
"rules": {
"complexity": {
- "noExcessiveCognitiveComplexity": "off",
+ "noExcessiveCognitiveComplexity": "error",
"useArrowFunction": "error"
},
"correctness": {
@@ -69,7 +66,7 @@
},
"style": {
"noInferrableTypes": "error",
- "noNonNullAssertion": "off",
+ "noNonNullAssertion": "error",
"noRestrictedImports": {
"level": "error",
"options": {
@@ -104,7 +101,7 @@
"noAssignInExpressions": "off",
"noConsole": "off",
"noControlCharactersInRegex": "off",
- "noExplicitAny": "off",
+ "noExplicitAny": "error",
"noTemplateCurlyInString": "off"
}
}
diff --git a/bun.lock b/bun.lock
index f6c2190..cdd48bc 100644
--- a/bun.lock
+++ b/bun.lock
@@ -3,35 +3,35 @@
"configVersion": 1,
"workspaces": {
"": {
- "name": "dondo",
+ "name": "dondo-donuts",
"dependencies": {
- "preact": "latest",
+ "preact": "10.29.8",
},
"devDependencies": {
- "@biomejs/biome": "latest",
- "@types/bun": "latest",
- "typescript": "latest",
+ "@biomejs/biome": "2.5.8",
+ "@types/bun": "1.3.14",
+ "typescript": "7.0.2",
},
},
},
"packages": {
- "@biomejs/biome": ["@biomejs/biome@2.5.6", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.5.6", "@biomejs/cli-darwin-x64": "2.5.6", "@biomejs/cli-linux-arm64": "2.5.6", "@biomejs/cli-linux-arm64-musl": "2.5.6", "@biomejs/cli-linux-x64": "2.5.6", "@biomejs/cli-linux-x64-musl": "2.5.6", "@biomejs/cli-win32-arm64": "2.5.6", "@biomejs/cli-win32-x64": "2.5.6" }, "bin": { "biome": "bin/biome" } }, "sha512-lxVNjv7UF6KfhMJfL9gaUHbWdJdHbsAj6OSmwSYNdhRuG67NxNQ4Xdvh3TUxsSK9sBzJBQhEJj3AopmmNJ5pSA=="],
+ "@biomejs/biome": ["@biomejs/biome@2.5.8", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.5.8", "@biomejs/cli-darwin-x64": "2.5.8", "@biomejs/cli-linux-arm64": "2.5.8", "@biomejs/cli-linux-arm64-musl": "2.5.8", "@biomejs/cli-linux-x64": "2.5.8", "@biomejs/cli-linux-x64-musl": "2.5.8", "@biomejs/cli-win32-arm64": "2.5.8", "@biomejs/cli-win32-x64": "2.5.8" }, "bin": { "biome": "bin/biome" } }, "sha512-aeAeeJB9fSDc7Gq+2GqpQxA0qBj6gj1k2R6L1cYqGePKP/baIq1WX8y6B+D+nRsO5ViQL22K/8IwbqERW0q1nw=="],
- "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.5.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-zMOLZP4oMrjh6m1zcSj1ud2awUPgTuMVbmQhYYWL7J8HwCnbHHBvTm7VBTRuY7epT5bez76IpKYQ11ZAqHFlnw=="],
+ "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.5.8", "", { "os": "darwin", "cpu": "arm64" }, "sha512-mk1QON9PHllvvLN5gU3f4rMxeh4syK5p9OvKyWH6/W8ueh04uaC8TUXXByhGufWf/y5mQc03ZLM45zU+cmqMjA=="],
- "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.5.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-JAC1VqzvO7Th5ZplU0G2uGfkZbxEe9uDDektPAhF0JLusoz1w+T4okp2bkykI0bbaO2vslKiRfj4gU43JaGreA=="],
+ "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.5.8", "", { "os": "darwin", "cpu": "x64" }, "sha512-bsGwFMBNyHPyiLSsQcZJxdoRrg1V4JL+d7wEsvUBczlP9U9lwM+7mzQHxI4o1mhBsTmdOBbAb6fHU3Z3snN45w=="],
- "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-6XsYwCFkp5sMxl85ffhgeGpGgs6A7dRYFnkceZ7WVxvycuTnGdD5xa534Z3xfrBQ0JCMK/mujT6ZNPJoghedwg=="],
+ "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.5.8", "", { "os": "linux", "cpu": "arm64" }, "sha512-XmFiA0WPYFC+uiUDC8WRFzAIH9bo7vwQLav38Uoq4ETC+T/+uBi0TsYGJECkugY3r8USl3jc+Ae2/irAF6F2lQ=="],
- "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-eUa3jeeYvfMt19LBeh6E5PUZpxnTC4JqNWo+EDjTtQjAr2xLGnWaxACtVU1DQqmHYbvThlJzLX+ZsYgrqh2qVw=="],
+ "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.5.8", "", { "os": "linux", "cpu": "arm64" }, "sha512-VcJNbstduTHx83NGAdhp78/JOcP45BZHXL7yNsfI1uGzdUgegAz2s+mSoT7wK6PBNzLoqG0zDOXaz/RQYVtSiw=="],
- "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-Pop9VXCFUhFTMfFefZ39S+u2rOPyNp5iHlxbZRwXGACHLy2r0jjiRgJHmaEKJzL3SyxlVeGShXhvvElvWowonA=="],
+ "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.5.8", "", { "os": "linux", "cpu": "x64" }, "sha512-S5wcm9OBDvLHodD4PUaN488hCpco9QD/9ZxuYJiw4euWtr/oQvLR72z2ixItH8Wd5BCm6FZaeb+YNvOoM1xHtQ=="],
- "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-2Vp13QdKysH3HIWLaYLhUUwbK+jbZonJD1K+Lr0d0RO4wH7mkYd43vJixEDm8cUWrowoRz4UUHF1nm9Ae7ym8A=="],
+ "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.5.8", "", { "os": "linux", "cpu": "x64" }, "sha512-kKmiyokeISRGq2FLwvr+TzsgBusfxaZ0FZNLcOYOpCK/78tRrEjeEBLvq3xLZMpqbANgJdRPI7vZX8ZL37u9/w=="],
- "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.5.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-tDGshcm6BdkZOCGnTDX0Y8/U4IfBSlnUU7T56nNDuPEfed+aHg+u8G36NB43fJVl0Os6+QURXIE1yuD7AaEofA=="],
+ "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.5.8", "", { "os": "win32", "cpu": "arm64" }, "sha512-nILH0mzm3Hi3iEdd7o7GpB8kBR/mSQwfQG/tyBqyNrY2GFtcgwfV9nV8xLmbtUpMNY/Oi0Ml1XgfR4flOdq+AA=="],
- "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.5.6", "", { "os": "win32", "cpu": "x64" }, "sha512-WN05KwXnTO/2J45RQPvzZMXf7tZUIofHoR35xIPfCo7pQ2RFidxI8sfb5mGsaTxdMmEOzHzOPRCdA5/fCpc7xQ=="],
+ "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.5.8", "", { "os": "win32", "cpu": "x64" }, "sha512-I2czzXTY61f3nFJxXoMDq80t7MivxDEnCjE+8sDKoFfcKMaoQdkqhIFQ3KyY0XLzeSpUBYeNAXgD+iOV/BU0VA=="],
"@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
@@ -79,7 +79,7 @@
"bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
- "preact": ["preact@10.29.7", "", { "peerDependencies": { "preact-render-to-string": ">=5" }, "optionalPeers": ["preact-render-to-string"] }, "sha512-DCHYrK/B10yUD3ZjLfhZ3WIE/9Vf9VFUODcRE2dRomTYDpJk6z6L9wecSfhfE6M9ZTHUdyQkoC46arIDhEV84Q=="],
+ "preact": ["preact@10.29.8", "", { "peerDependencies": { "preact-render-to-string": ">=5" }, "optionalPeers": ["preact-render-to-string"] }, "sha512-ej2aVZ+vZ8WO7tvlQWRM9N63A0KzF9q4mWJfDUHgYaIofWY9hu74QdnQrjoPMmZi2/nZ5gN0bJCQF49xQqx09Q=="],
"typescript": ["typescript@7.0.2", "", { "optionalDependencies": { "@typescript/typescript-aix-ppc64": "7.0.2", "@typescript/typescript-darwin-arm64": "7.0.2", "@typescript/typescript-darwin-x64": "7.0.2", "@typescript/typescript-freebsd-arm64": "7.0.2", "@typescript/typescript-freebsd-x64": "7.0.2", "@typescript/typescript-linux-arm": "7.0.2", "@typescript/typescript-linux-arm64": "7.0.2", "@typescript/typescript-linux-loong64": "7.0.2", "@typescript/typescript-linux-mips64el": "7.0.2", "@typescript/typescript-linux-ppc64": "7.0.2", "@typescript/typescript-linux-riscv64": "7.0.2", "@typescript/typescript-linux-s390x": "7.0.2", "@typescript/typescript-linux-x64": "7.0.2", "@typescript/typescript-netbsd-arm64": "7.0.2", "@typescript/typescript-netbsd-x64": "7.0.2", "@typescript/typescript-openbsd-arm64": "7.0.2", "@typescript/typescript-openbsd-x64": "7.0.2", "@typescript/typescript-sunos-x64": "7.0.2", "@typescript/typescript-win32-arm64": "7.0.2", "@typescript/typescript-win32-x64": "7.0.2" }, "bin": { "tsc": "bin/tsc" } }, "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA=="],
diff --git a/icon.png b/icon.png
index 34f6d9c..eab848e 100644
Binary files a/icon.png and b/icon.png differ
diff --git a/package.json b/package.json
index 7ea1893..659a2ec 100644
--- a/package.json
+++ b/package.json
@@ -1,59 +1,73 @@
{
- "author": {
- "name": "Ragaeeb Haq",
- "url": "https://github.com/ragaeeb"
- },
- "bin": {
- "dondo": "src/server.ts",
- "dondo-donuts": "src/server.ts"
- },
- "bugs": {
- "url": "https://github.com/ragaeeb/dondo/issues"
- },
- "dependencies": {
- "preact": "^10.29.7"
- },
- "description": "Minimal local UI for switching Antigravity, Codex, and Cline accounts.",
- "devDependencies": {
- "@biomejs/biome": "^2.5.6",
- "@types/bun": "^1.3.14",
- "typescript": "^7.0.2"
- },
- "engines": {
- "bun": ">=1.3.14"
- },
- "files": [
- "LICENSE",
- "README.md",
- "icon.png",
- "icon.svg",
- "src"
- ],
- "homepage": "https://github.com/ragaeeb/dondo",
- "keywords": [
- "antigravity",
- "cline",
- "codex",
- "account-switcher",
- "bun",
- "keychain"
- ],
- "license": "MIT",
- "name": "dondo-donuts",
- "os": [
- "darwin"
- ],
- "packageManager": "bun@1.3.14",
- "repository": {
- "type": "git",
- "url": "git+https://github.com/ragaeeb/dondo.git"
- },
- "scripts": {
- "format": "biome check . --write && biome lint . --write",
- "lint": "biome lint .",
- "start": "bun src/server.ts",
- "typecheck": "tsc --noEmit"
- },
- "type": "module",
- "version": "0.3.0"
+ "author": {
+ "name": "Ragaeeb Haq",
+ "url": "https://github.com/ragaeeb"
+ },
+ "bin": {
+ "dondo": "src/server.ts",
+ "dondo-donuts": "src/server.ts"
+ },
+ "bugs": {
+ "url": "https://github.com/ragaeeb/dondo/issues"
+ },
+ "dependencies": {
+ "preact": "10.29.8"
+ },
+ "description": "Encrypted local account switcher for Antigravity, Codex, Cline, Kiro, and MiniMax on macOS.",
+ "devDependencies": {
+ "@biomejs/biome": "2.5.8",
+ "@types/bun": "1.3.14",
+ "typescript": "7.0.2"
+ },
+ "engines": {
+ "bun": ">=1.3.14"
+ },
+ "files": [
+ "LICENSE",
+ "README.md",
+ "CONTRIBUTING.md",
+ "icon.png",
+ "icon.svg",
+ "scripts/*.ts",
+ "!scripts/*.test.ts",
+ "src/**/*.css",
+ "src/**/*.ts",
+ "src/**/*.tsx",
+ "!src/**/*.test.ts",
+ "!src/**/*.test.tsx"
+ ],
+ "homepage": "https://github.com/ragaeeb/dondo",
+ "keywords": [
+ "antigravity",
+ "cline",
+ "codex",
+ "kiro",
+ "minimax",
+ "account-switcher",
+ "bun",
+ "encrypted-vault",
+ "keychain",
+ "macos"
+ ],
+ "license": "MIT",
+ "name": "dondo-donuts",
+ "os": [
+ "darwin"
+ ],
+ "packageManager": "bun@1.3.14",
+ "repository": {
+ "type": "git",
+ "url": "git+https://github.com/ragaeeb/dondo.git"
+ },
+ "scripts": {
+ "build": "bun scripts/build.ts",
+ "dev": "bun scripts/dev.ts",
+ "fix": "biome check . --write --enforce-assist=true",
+ "format": "biome format . --write",
+ "lint": "biome check . --enforce-assist=true --error-on-warnings",
+ "start": "bun src/server.ts",
+ "typecheck": "tsc --noEmit"
+ },
+ "type": "module",
+ "version": "0.4.0"
}
diff --git a/scripts/build.test.ts b/scripts/build.test.ts
new file mode 100644
index 0000000..edebdf1
--- /dev/null
+++ b/scripts/build.test.ts
@@ -0,0 +1,68 @@
+import { expect, it } from 'bun:test';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildDistribution } from './build.ts';
+
+const startedServerUrl = async (child: Bun.Subprocess<'ignore', 'pipe', 'pipe'>) => {
+ const reader = child.stdout.getReader();
+ const decoder = new TextDecoder('utf-8', { fatal: true });
+ let output = '';
+ const timeout = setTimeout(() => child.kill('SIGKILL'), 5_000);
+ try {
+ for (;;) {
+ const next = await reader.read();
+ if (next.done) {
+ const error = await new Response(child.stderr).text();
+ throw new Error(`Built server exited before startup: ${error}`);
+ }
+ output += decoder.decode(next.value, { stream: true });
+ const url = output.match(/Dondo running at (http:\/\/127\.0\.0\.1:\d+)/u)?.[1];
+ if (url) {
+ return url;
+ }
+ if (Buffer.byteLength(output, 'utf8') > 4 * 1024) {
+ throw new Error('Built server startup output exceeded 4 KiB');
+ }
+ }
+ } finally {
+ clearTimeout(timeout);
+ reader.releaseLock();
+ }
+};
+
+it('builds a runnable distribution with its browser assets', async () => {
+ const root = await mkdtemp(join(tmpdir(), 'dondo-build-smoke-'));
+ const outdir = join(root, 'dist');
+ let child: Bun.Subprocess<'ignore', 'pipe', 'pipe'> | undefined;
+ try {
+ await buildDistribution(outdir);
+ child = Bun.spawn(['bun', join(outdir, 'server.js')], {
+ env: {
+ ...globalThis.process.env,
+ DONDO_DATA_DIR: join(root, 'data'),
+ DONDO_PORT: '32000',
+ },
+ stderr: 'pipe',
+ stdin: 'ignore',
+ stdout: 'pipe',
+ });
+ const serverUrl = await startedServerUrl(child);
+ const response = await fetch(serverUrl);
+ expect(response.status).toBe(200);
+ expect(await response.text()).toContain('Dondo');
+ const [appJs, css, icon] = await Promise.all([
+ fetch(`${serverUrl}/assets/app.js`),
+ fetch(`${serverUrl}/assets/styles.css`),
+ fetch(`${serverUrl}/icon.png`),
+ ]);
+ expect([appJs.status, css.status, icon.status]).toEqual([200, 200, 200]);
+ expect((await appJs.text()).length).toBeGreaterThan(1_000);
+ expect((await css.text()).length).toBeGreaterThan(1_000);
+ expect((await icon.bytes()).byteLength).toBeGreaterThan(1_000);
+ } finally {
+ child?.kill('SIGKILL');
+ await child?.exited.catch(() => undefined);
+ await rm(root, { force: true, recursive: true });
+ }
+});
diff --git a/scripts/build.ts b/scripts/build.ts
new file mode 100644
index 0000000..6f0c431
--- /dev/null
+++ b/scripts/build.ts
@@ -0,0 +1,109 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, rename, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, dirname, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { waitForAll } from '../src/async-queue.ts';
+
+const PROJECT_ROOT = fileURLToPath(new URL('../', import.meta.url));
+const DEFAULT_OUTDIR = join(PROJECT_ROOT, 'dist');
+
+const buildFailure = (label: string, logs: readonly { message: string }[]) => {
+ return new Error(`${label} failed:\n${logs.map((log) => log.message).join('\n') || 'Unknown build error'}`);
+};
+
+const assertBuild = (label: string, result: Awaited>) => {
+ if (!result.success) {
+ throw buildFailure(label, result.logs);
+ }
+ return result;
+};
+
+const prepareOutput = async (outdir: string) => {
+ const resolved = resolve(outdir);
+ const temporaryRoot = resolve(tmpdir());
+ if (
+ basename(resolved) !== 'dist' ||
+ (resolved !== resolve(DEFAULT_OUTDIR) && !resolved.startsWith(`${temporaryRoot}${sep}`))
+ ) {
+ throw new Error('Distribution output must be the project dist directory or a temporary dist directory');
+ }
+ const staged = join(dirname(resolved), `.dist-${process.pid}-${randomUUID()}`);
+ await rm(staged, { force: true, recursive: true });
+ await mkdir(join(staged, 'assets'), { recursive: true });
+ return { resolved, staged };
+};
+
+export const buildDistribution = async (outdir = DEFAULT_OUTDIR) => {
+ const { resolved, staged } = await prepareOutput(outdir);
+ const backup = join(dirname(resolved), `.dist-${process.pid}-${randomUUID()}.backup`);
+ let hasBackup = false;
+ try {
+ const ui = assertBuild(
+ 'Browser build',
+ await Bun.build({
+ entrypoints: [join(PROJECT_ROOT, 'src', 'ui', 'client.tsx')],
+ jsx: { importSource: 'preact', runtime: 'automatic' },
+ target: 'browser',
+ }),
+ );
+ const appJs = ui.outputs.find((output) => output.path.endsWith('.js'));
+ if (!appJs) {
+ throw new Error('Browser build did not produce JavaScript');
+ }
+ await waitForAll([
+ Bun.write(join(staged, 'assets', 'app.js'), appJs),
+ Bun.write(join(staged, 'assets', 'styles.css'), Bun.file(join(PROJECT_ROOT, 'src', 'ui', 'styles.css'))),
+ Bun.write(join(staged, 'icon.png'), Bun.file(join(PROJECT_ROOT, 'icon.png'))),
+ Bun.write(join(staged, 'icon.svg'), Bun.file(join(PROJECT_ROOT, 'icon.svg'))),
+ ]);
+ assertBuild(
+ 'Server build',
+ await Bun.build({
+ define: { DONDO_BUNDLED_ASSETS: 'true' },
+ entrypoints: [join(PROJECT_ROOT, 'src', 'server.ts')],
+ outdir: staged,
+ target: 'bun',
+ }),
+ );
+ await rm(backup, { force: true, recursive: true });
+ try {
+ await stat(resolved);
+ await rename(resolved, backup);
+ hasBackup = true;
+ } catch (error) {
+ if ((error as { code?: unknown }).code !== 'ENOENT') {
+ throw error;
+ }
+ }
+ try {
+ await rename(staged, resolved);
+ } catch (error) {
+ await rm(staged, { force: true, recursive: true });
+ if (hasBackup) {
+ await rm(resolved, { force: true, recursive: true });
+ await rename(backup, resolved);
+ hasBackup = false;
+ }
+ throw error;
+ }
+ if (hasBackup) {
+ await rm(backup, { force: true, recursive: true });
+ hasBackup = false;
+ }
+ } catch (error) {
+ await rm(staged, { force: true, recursive: true });
+ if (hasBackup) {
+ await rm(resolved, { force: true, recursive: true });
+ await rename(backup, resolved);
+ }
+ throw error;
+ } finally {
+ await rm(backup, { force: true, recursive: true }).catch(() => {});
+ }
+};
+
+if (import.meta.main) {
+ await buildDistribution();
+ console.log('Built runnable distribution in dist');
+}
diff --git a/scripts/dev.test.ts b/scripts/dev.test.ts
new file mode 100644
index 0000000..ff97c1e
--- /dev/null
+++ b/scripts/dev.test.ts
@@ -0,0 +1,11 @@
+import { expect, it } from 'bun:test';
+import { isRuntimeSource } from './dev.ts';
+
+it('should restart development only for runtime source changes', () => {
+ for (const path of ['server.ts', 'ui/client.tsx', 'ui/styles.css', 'storage/vault.ts']) {
+ expect(isRuntimeSource(path)).toBe(true);
+ }
+ for (const path of ['server.test.ts', 'ui/client.test.tsx', 'notes.md', 'generated.js']) {
+ expect(isRuntimeSource(path)).toBe(false);
+ }
+});
diff --git a/scripts/dev.ts b/scripts/dev.ts
new file mode 100644
index 0000000..e9aa7f6
--- /dev/null
+++ b/scripts/dev.ts
@@ -0,0 +1,91 @@
+import { type FSWatcher, watch } from 'node:fs';
+
+const RESTART_DELAY_MS = 75;
+const SHUTDOWN_GRACE_MS = 1_000;
+const ROOT_RUNTIME_FILES = new Set(['icon.png', 'icon.svg', 'package.json']);
+
+export const isRuntimeSource = (path: string) => {
+ return !path.endsWith('.test.ts') && !path.endsWith('.test.tsx') && /\.(?:css|ts|tsx)$/u.test(path);
+};
+
+let child: ReturnType | undefined;
+let restartTimer: ReturnType | undefined;
+let restartQueue = Promise.resolve();
+let shuttingDown = false;
+const watchers: FSWatcher[] = [];
+
+const startServer = () => {
+ child = Bun.spawn([process.execPath, 'src/server.ts'], {
+ stderr: 'inherit',
+ stdin: 'inherit',
+ stdout: 'inherit',
+ });
+};
+
+const stopServer = async (server: ReturnType) => {
+ server.kill('SIGTERM');
+ const stopped = await Promise.race([
+ server.exited.then(() => true),
+ Bun.sleep(SHUTDOWN_GRACE_MS).then(() => false),
+ ]);
+ if (!stopped) {
+ server.kill('SIGKILL');
+ await server.exited.catch(() => undefined);
+ }
+};
+
+const restartServer = async () => {
+ const previous = child;
+ child = undefined;
+ if (previous) {
+ await stopServer(previous);
+ }
+ if (!shuttingDown) {
+ startServer();
+ }
+};
+
+const scheduleRestart = () => {
+ clearTimeout(restartTimer);
+ restartTimer = setTimeout(() => {
+ restartQueue = restartQueue.then(restartServer, restartServer);
+ }, RESTART_DELAY_MS);
+};
+
+const shutdown = async (exitCode: number) => {
+ if (shuttingDown) {
+ return;
+ }
+ shuttingDown = true;
+ clearTimeout(restartTimer);
+ for (const watcher of watchers) {
+ watcher.close();
+ }
+ await restartQueue;
+ if (child) {
+ await stopServer(child);
+ }
+ process.exit(exitCode);
+};
+
+export const startDevWatcher = () => {
+ startServer();
+ watchers.push(
+ watch('src', { recursive: true }, (_event, filename) => {
+ if (!filename || isRuntimeSource(String(filename))) {
+ scheduleRestart();
+ }
+ }),
+ watch('.', (_event, filename) => {
+ if (!filename || ROOT_RUNTIME_FILES.has(String(filename))) {
+ scheduleRestart();
+ }
+ }),
+ );
+ process.once('SIGINT', () => void shutdown(130));
+ process.once('SIGTERM', () => void shutdown(143));
+};
+
+if (import.meta.main) {
+ startDevWatcher();
+}
diff --git a/src/account-state.test.ts b/src/account-state.test.ts
new file mode 100644
index 0000000..5e35483
--- /dev/null
+++ b/src/account-state.test.ts
@@ -0,0 +1,105 @@
+import { expect, it } from 'bun:test';
+import { boundedMap, selectRefreshEntries, sortAccountEntries, stateVersion } from './account-state.ts';
+import type { LimitCache } from './types.ts';
+
+it('produces fixed-size deterministic state versions', () => {
+ const first = stateVersion({ auth: 'credential', updatedAt: 'now' });
+
+ expect(first).toHaveLength(64);
+ expect(stateVersion({ auth: 'credential', updatedAt: 'now' })).toBe(first);
+ expect(stateVersion({ auth: 'replacement', updatedAt: 'now' })).not.toBe(first);
+});
+
+it('maps every bounded input in order, including undefined values', async () => {
+ let active = 0;
+ let maximumActive = 0;
+ const result = await boundedMap(
+ [3, undefined, 1, 2],
+ async (value, index) => {
+ active += 1;
+ maximumActive = Math.max(maximumActive, active);
+ await Bun.sleep((4 - index) * 2);
+ active -= 1;
+ return `${index}:${String(value)}`;
+ },
+ 2,
+ );
+
+ expect(result).toEqual(['0:3', '1:undefined', '2:1', '3:2']);
+ expect(maximumActive).toBe(2);
+});
+
+it('normalizes invalid bounded-map concurrency to one worker', async () => {
+ let active = 0;
+ let maximumActive = 0;
+ await boundedMap(
+ [1, 2],
+ async () => {
+ active += 1;
+ maximumActive = Math.max(maximumActive, active);
+ await Bun.sleep(1);
+ active -= 1;
+ },
+ Number.NaN,
+ );
+ expect(maximumActive).toBe(1);
+});
+
+it('waits for every bounded worker to settle before propagating a failure', async () => {
+ let delayedFinished = false;
+ await expect(
+ boundedMap(
+ ['failed', 'delayed'],
+ async (value) => {
+ if (value === 'failed') {
+ throw new Error('mapper failed');
+ }
+ await Bun.sleep(10);
+ delayedFinished = true;
+ },
+ 2,
+ ),
+ ).rejects.toThrow('mapper failed');
+ expect(delayedFinished).toBe(true);
+});
+
+it('selects only stale refresh entries unless a forced target is requested', () => {
+ const data = { cached: { token: 'one' }, fresh: { token: 'two' }, stale: { token: 'three' } };
+ const cachedLimit: LimitCache = {
+ fetchedAt: '2026-01-01T00:00:00.000Z',
+ quota: { error: 'unavailable', ok: false },
+ };
+ const limits = { cached: cachedLimit, fresh: cachedLimit };
+
+ expect(selectRefreshEntries(data, limits, { force: false }).map(([key]) => key)).toEqual(['stale']);
+ expect(selectRefreshEntries(data, limits, { force: true, targetKey: 'fresh' }).map(([key]) => key)).toEqual([
+ 'fresh',
+ ]);
+});
+
+it('sorts active accounts first and depleted accounts last without mutating input', () => {
+ const available = {
+ expires: '',
+ models: { quota: { displayName: 'Quota', percentage: 50, resetTime: '' } },
+ ok: true as const,
+ tier: '',
+ };
+ const depleted = {
+ expires: '',
+ models: { quota: { displayName: 'Quota', percentage: 0, resetTime: '' } },
+ ok: true as const,
+ tier: '',
+ };
+ const entries = [
+ { active: false, key: 'depleted', quota: depleted },
+ { active: false, key: 'available', quota: available },
+ { active: true, key: 'active', quota: depleted },
+ ];
+ const originalOrder = entries.map(({ key }) => key);
+ const sorted = sortAccountEntries(entries, (quota) =>
+ quota?.ok === true ? Object.values(quota.models).every((model) => model.percentage <= 0) : false,
+ );
+
+ expect(sorted.map(({ key }) => key)).toEqual(['active', 'available', 'depleted']);
+ expect(entries.map(({ key }) => key)).toEqual(originalOrder);
+});
diff --git a/src/account-state.ts b/src/account-state.ts
new file mode 100644
index 0000000..7a52111
--- /dev/null
+++ b/src/account-state.ts
@@ -0,0 +1,79 @@
+import { createHash } from 'node:crypto';
+import { waitForAll } from './async-queue.ts';
+import type { LimitCache, LimitResult } from './types.ts';
+
+const DEFAULT_REFRESH_CONCURRENCY = 3;
+
+type AccountEntry = {
+ active: boolean;
+ key: string;
+ quota: LimitResult | null;
+};
+
+type RefreshOptions = {
+ force: boolean;
+ targetKey?: string;
+};
+
+export const CORRUPTED_ACCOUNT_ERROR = 'Saved account data is corrupted';
+
+export const stateVersion = (value: unknown) => {
+ return createHash('sha256')
+ .update(JSON.stringify(value) ?? 'undefined')
+ .digest('hex');
+};
+
+export const boundedMap = async (
+ inputs: readonly Input[],
+ mapper: (input: Input, index: number) => Promise