[MumuTW]

An explicit account change invalidates the CLI identity, but if the next ask fails, forget() still serves the previous user/plan/ok. Its disk entry can also restore that account on restart. This update clears the served fields and removes only that CLI's persisted identity; the other CLI's identity stays intact. An ordinary failed background refresh continues to preserve the last answer.

Refreshed against upstream a15e576564cb90d4d027e8b8cb7821472de0a3fc. The earlier unanswered-ask handling, including interpreting Devin output before its exit status, is already on current main (askDevinStatusAt). The update keeps that implementation and adds explicit signed-in/signed-out nonzero-exit coverage instead of reintroducing the old parser. The remaining production change is cliIdentity.forget, shared by the built-in Cursor and Devin identity caches; moved plugin accounts use their own identity paths.

Regression evidence: on unmodified current-main production code, TestCLIIdentityForgetThenUnanswered fails with forget followed by failed ask served old account: "old@example.com" "Pro" true; it passes after the fix. It also checks restart behavior and preservation of another CLI's disk entry. TestCLIIdentityForgetDropsInflightAnswer checks that a pre-invalidation ask cannot restore the old identity. The documented failure behavior is updated in docs/subsystems/providers-accounts.md.

The first complete suite failed only in internal/agent.TestPrimeAgent: it expects no detected agent before writing config, but Agent.Detected correctly finds an installed prime-agent on PATH. This was independently reproduced on untouched upstream a15e5765. A separate test-only commit isolates PATH for that config-detection fixture; the test then passes with -race. No Prime Agent production behavior changes.

Validation on the final tree, using Go 1.26.8:

• go test -tags nogui ./... -timeout=45m: PASS (exit 0, 892.1s).
• CLI identity / Devin status tests with -race: PASS.
• Isolated TestPrimeAgent with -race: PASS.
• go vet ./... (macOS), GOOS=linux go vet -tags nogui ./..., GOOS=windows go vet ./...: PASS. After the test-only isolation change, the affected agent package was vetted again for all three platforms: PASS.
• macOS, Linux nogui and Windows builds: PASS.
• Changed Go files formatted; git diff --check: clean.

The initial short-timeout full run was intentionally stopped, not counted as a pass. The next full run exposed the Prime Agent fixture issue above; the final complete run after its fix passed. Tests use an isolated HOME with Go caches pinned. No real vendor account or GUI test was run; there is no UI change. Cross-platform builds/vet do not establish native Linux or Windows runtime behavior.

---

🎬 界面预览

_{CI 用这个 PR 的代码构建并真实运行 magpie（沙盒环境，配置了真实的 DeepSeek key），按改动自动操作、截图和录屏 · 5c80760 · 运行记录}

这次没录成（skipped）。详见运行记录。

[yetone]

@MumuTW Thanks — this is a real bug and the approach (an ask that didn't answer leaves what was served, retried a minute later) is right. I reviewed 0aaae4c every line and ran it: go vet clean, the provider tests pass (the -race failure in TestKiroAccount is on main too), and in a sandbox with a stand-in devin on PATH, main vs this PR:

scenario	main	PR
fresh start, devin hangs	keeps {"ok":false}, later providers shows no Devin	nothing kept, Devin shows
kept signed in, then hang	overwritten ok:false	kept
kept signed in, then Not logged in. exit 0	ok:false	ok:false ✓
kept signed in, then Not logged in. exit 1	ok:false	kept signed in

Load: 40 concurrent requests with a failing devin spawn it once, once more ~60s later — no pile-up, never blocks.

Two things before I merge:

1. A sign-out that exits non-zero keeps the account forever. askDevinIdentity returns the error before looking at the output, so devin auth status printing Not logged in. with a non-zero exit (or failing because the token was revoked) never counts as an answer: the account stays shown and on disk while it can't be used. The exit code for signed-out isn't something we can rely on. Please read the output first — Not logged in → signed out, Logged in → parse — and only treat it as "didn't answer" when neither appears; a missing DevinCredentialsPath() file can also count as signed out whatever the exit code.
2. forget() then a failed ask serves the old account. forget() doesn't clear user/plan/ok, so after a sign-in/out a failed ask leaves the previous account served for another minute (and kept). Reproduced: keep old@example.com → forget() → ask returns an error → get() gives old@example.com ok=true (main: ok=false). Clearing them in forget() (or not keeping across a failed first ask after it) fixes it — a test for it would be good.

Not blocking, just so the description is accurate: cursor-agent's about returns userEmail: null with exit 0 when its own network call fails, so a signed-in Cursor offline is still recorded as signed out. If you want to cover it, null email plus a token from readCursorToken() could count as no answer.

Push an update and I'll run it again.