[andrebrait]

Closes #197.

Summary

Settings → API Keys & Providers → a subscription provider now lists every account omp stores for it, using omp's new get_logout_accounts / logout RPC commands (can1357/oh-my-pi#14588):

• Each account shows its label (email, plus the org when omp reports one), the plan from omp usage when that email identifies exactly one account, and an API key marker for stored keys.
• Disconnect on a row removes that one credential after a confirmation. The other accounts stay connected, and omp keeps choosing and rotating between them.
• The sign-in button of a connected provider now reads Add account. The status line explains that signing in with another account adds it, while signing in with a connected account refreshes it.

omp stays responsible for credentials, selection and rotation. omp-web never touches agent.db. omp's per-account active flag is not shown: omp computes it against the settings utility process's throwaway session, so it does not say which account any chat uses.

Compatibility

This needs omp 18.7.0 or later, the first release with can1357/oh-my-pi#14588. With older omp, GET /api/auth/accounts/[provider] returns supported: false, so the panel keeps the read-only list from omp usage and explains how to disconnect from a terminal. DELETE returns 501 logout_unsupported.

Changes

• New app/api/auth/accounts/[provider]/route.ts: GET lists accounts, re-projecting only the known fields. DELETE ?credentialId= removes one account and invalidates the models cache.
• Removed the app/api/auth/logout/[provider] 501 stub and the provider-wide Disconnect button.
• components/ProviderAccounts.tsx renders the RPC list, falling back to the usage list on older omp. planForStoredAccount in lib/provider-accounts.ts joins usage plans to stored accounts.
• en / ja / zh-CN strings, CHANGELOG, AGENTS.md.

Verification

• tsc --noEmit, npm run lint (no new warnings), full npm test locally (0 failures), CI green on ubuntu and windows. New tests:
  • lib/auth-accounts-route.test.mjs: field allowlist, old-omp fallback, exact credential removal, unsafe id rejection, and error mapping.
  • lib/provider-accounts.test.mjs: a plan is matched only when one account has that email.
• Live smoke in headless Chromium against omp built from can1357/oh-my-pi main, using a disposable copy of the agent database with a second Anthropic account added: both accounts listed, and Disconnect on the second removed only that credential. The real database was untouched.
• Live smoke against released omp 18.6.2: read-only usage list plus the update/terminal hint; DELETE returns 501.
• One condensed adversarial review round, then Codex and CodeRabbit on the review companion ([companion] feat(auth): list and disconnect omp's stored provider accounts andrebrait/ompweb#82). All findings are fixed in follow-up commits, except mapping omp's "not stored" error to 404, which stays a 500 because the UI drops a removed row immediately and never requests it again.

[kahme247]

Review — approve (SHIP)

Verified by independent review with live route-handler probes against fake credentials.

Provider accounts (#222). No credential leak: a fixture with fake keys in every plausible omp field returns only allow-listed {credentialId, label, detail, type}. Disconnect is real server-side revocation (omp's shared logoutCredential helper — authStorage.credentials.removeById — plus invalidateModelsCache()), not UI hiding. Hostile provider strings inert (JSON-over-stdio, no shell/file sink). Old-omp degradation graceful (supported:false/501 with usage-list fallback, test-covered). Both redaction and validation mutations killed. Two optional non-blocking notes: redact key-like patterns from 500 passthroughs, and surface remainingSource when env-var auth keeps a provider connected.