mirror of
https://github.com/stablyai/orca.git
synced 2026-09-29 16:02:50 +00:00
Merge Sim
57e368ee20
Isolating each account into its own config dir gives a foreign login somewhere to hide. Sign in as the wrong identity at a prompt in account A's pane and A's home now holds B's credentials: the switcher still says A, the usage numbers shown are B's, and the work runs against B's quota. Nothing is lost and signing in again recovers, but until you notice, Orca is telling you something false about which account you are on. Detection is read-only. It compares the identity record in the account's own home against the one Orca recorded, and reports match, foreign or unknown. It never rewrites either store - reverting a foreign login is what produced the defects the single-owner change removed. Precedence is strict rather than a fallback chain. When both sides expose the account UUID that comparison decides alone and the weaker fields are never consulted, so a shared or stale email cannot soften a genuine UUID mismatch. Only when the stronger field is missing on either side do we fall to the next. Deep equality is never used: the CLI rewrites cache fields in that record and comparing whole objects would badge a healthy account as foreign. `unknown` is not a soft `foreign`. A torn read, an unreadable record, or one exposing no stable field all report unknown and render nothing, because the user's only remedy for a badge is an unnecessary re-login. The verdict rides on the account summary as an OPTIONAL wire field. A client and a remote host update independently, so a newer client against an older host receives no field and must read that as unknown rather than a confident match. The status bar merges the host's value in by account id: previously the settings-derived summary won locally and silently dropped the verdict, which is the one case the badge exists for. Publishing needed its own path. `onChanged` is wired only to rate-limit state, so an identity change with no usage change would have sat in main and never reached the renderer. Only a transition publishes, so reopening panes does not push a snapshot each time.