@adecore/agents 0.0.1 → 0.17.0-beta.2

package/dist/providers/accounts/service.js

@@ -0,0 +1,538 @@
+import { existsSync, statSync } from 'node:fs';
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { AgentKindSchema } from '@adecore/agent-contracts';
+import { ClientSinks } from '../../client-sinks.js';
+import { errorText } from '../../error-text.js';
+import { accountEnv, accountFolder, canContinue, defaultFolder, expandHome, isDefaultAccount, isKnownKind, transcriptFolder } from './accounts.js';
+import { AccountError, isDefaultAccountOf } from './launch.js';
+import { prepareShadowHome } from './shadow-home.js';
+import { askAccountAs } from './status.js';
+import { acceptAccounts, accountsPath, InvalidAccountError, readAccounts, wireAccounts, writeAccounts } from './store.js';
+import { DEFAULT_ACCOUNTS_HOST, platformSecrets, secretKey, SecretsUnavailableError } from './variables.js';
+import { DEFAULT_CODEX_CLIENT } from '../../chat/codex-transport.js';
+/* Who is signed in changes by hand and rarely; often enough to notice, rarely enough not to start CLIs all day. */
+const CHECK_INTERVAL_MS = 15 * 60_000;
+const MAX_BACKOFF_MS = 60 * 60_000;
+// A login in a terminal is a browser round trip: quick enough to notice at once, and given up on after a while.
+const LOGIN_POLL_MS = 3_000;
+const LOGIN_WATCH_MS = 5 * 60_000;
+// Asked on every start of a CLI under an account, which is one stat and never worth an await in the way of a spawn.
+function isFolder(path) {
+    return statSync(path, { throwIfNoEntry: false })?.isDirectory() === true;
+}
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms).unref();
+    });
+}
+/* The part of a label an id can hold: `Work (EU)` becomes `work-eu`. */
+function slugOf(label) {
+    return label
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+function sensitiveNames(entry) {
+    const variables = typeof entry === 'object' && entry !== null ? entry.env : undefined;
+    if (!Array.isArray(variables)) {
+        return [];
+    }
+    return variables.flatMap((variable) => {
+        const { name, sensitive } = (variable ?? {});
+        return sensitive === true && typeof name === 'string' ? [name] : [];
+    });
+}
+/* A status without the moment it was drawn, to tell whether anything a person reads changed. */
+function sameStatus(left, right) {
+    return JSON.stringify({ ...left, checkedAt: 0 }) === JSON.stringify({ ...right, checkedAt: 0 });
+}
+/*
+ * The accounts of every agent CLI on this machine: the list a person keeps in `providers.json`, and
+ * what each CLI says about who is signed in there. The list is the person's; the statuses are only
+ * ever the CLI's answer, held in memory and asked again on a slow clock.
+ */
+export class ProviderAccountsService {
+    path;
+    home;
+    host;
+    providers;
+    env;
+    ask;
+    prepareShadow;
+    folderExists;
+    install;
+    secrets;
+    // The sensitive values by `secretKey`, read from the keychain once, since a spawn asks for them without waiting.
+    secretValues = new Map();
+    now;
+    sleep;
+    watches = new Map();
+    writes = Promise.resolve();
+    sinks = new ClientSinks();
+    listeners = new Set();
+    // When a CLI last started under each account, by id; kept in memory, so a restart forgets it.
+    launches = new Map();
+    states = new Map();
+    stored = {};
+    accounts = wireAccounts({});
+    passes = Promise.resolve();
+    timer = null;
+    constructor(options) {
+        this.path = accountsPath(options.home);
+        this.home = options.home;
+        this.host = options.host ?? DEFAULT_ACCOUNTS_HOST;
+        this.providers = options.providers;
+        this.env = options.env ?? process.env;
+        this.ask = options.ask ?? askAccountAs(options.client ?? DEFAULT_CODEX_CLIENT);
+        this.prepareShadow = options.prepareShadow ?? prepareShadowHome;
+        this.folderExists = options.folderExists ?? isFolder;
+        this.install = options.install;
+        this.secrets = options.secrets === undefined ? platformSecrets(this.host, options.home) : options.secrets;
+        this.now = options.now ?? Date.now;
+        this.sleep = options.sleep ?? sleep;
+    }
+    async load() {
+        this.stored = await readAccounts(this.path, (kind) => this.providers.get(kind), this.env, this.host);
+        this.accounts = wireAccounts(this.stored);
+        await this.readSecrets();
+    }
+    subscribe(clientId, sink) {
+        return this.sinks.subscribe(clientId, sink);
+    }
+    snapshot() {
+        const loginCommands = {};
+        for (const kind of AgentKindSchema.options) {
+            const command = this.providers.get(kind).home?.loginCommand;
+            if (command !== undefined) {
+                loginCommands[kind] = command;
+            }
+        }
+        return {
+            accounts: this.accounts,
+            statuses: Object.entries(this.accounts).map(([id, account]) => this.statusOf(id, account)),
+            secretsAvailable: this.secrets !== null,
+            loginCommands
+        };
+    }
+    /* The account under an id, for a launch; null for an id this machine does not have. */
+    get(id) {
+        return this.accounts[id] ?? null;
+    }
+    /*
+     * The environment a CLI of this kind runs in under this account. An account that cannot be used
+     * refuses the start, since falling back on the default account would run it on someone else's costs.
+     */
+    envFor(kind, id, baseEnv) {
+        const key = id ?? kind;
+        const refuse = (why) => new AccountError('account-unavailable', `The account '${this.labelOf(key)}' is not available on this machine: ${why}.`);
+        const provider = this.providers.get(kind);
+        const variables = (account) => {
+            const { values, missing } = this.variablesOf(key, account);
+            if (missing !== null) {
+                throw refuse(`the keychain does not give the value of ${missing}`);
+            }
+            return values;
+        };
+        if (isDefaultAccountOf(kind, id)) {
+            const account = this.accounts[kind] ?? { kind };
+            return accountEnv(kind, account, provider, baseEnv, variables(account));
+        }
+        const account = this.accounts[key];
+        if (account === undefined) {
+            throw refuse('no account on it has that id');
+        }
+        if (account.kind !== kind) {
+            throw refuse(`it is an account of ${isKnownKind(account.kind) ? this.providers.get(account.kind).name : account.kind}, not of ${provider.name}`);
+        }
+        if (account.enabled === false) {
+            throw refuse('it is turned off');
+        }
+        if (provider.home === undefined || account.home === undefined) {
+            throw refuse(`${provider.name} has no setting for its config folder`);
+        }
+        for (const folder of [account.home, account.shadowHome]) {
+            if (folder !== undefined && !this.folderExists(expandHome(folder, this.env))) {
+                throw refuse(`its folder ${folder} is missing`);
+            }
+        }
+        return accountEnv(key, account, provider, baseEnv, variables(account));
+    }
+    transcriptFolder(kind, id) {
+        const key = id ?? kind;
+        const account = this.accounts[key];
+        if (account === undefined || account.kind !== kind) {
+            return null;
+        }
+        return transcriptFolder(key, account, this.providers.get(kind), this.env);
+    }
+    homeFolder(kind, id) {
+        const key = id ?? kind;
+        const account = this.accounts[key];
+        if (account === undefined || account.kind !== kind) {
+            return null;
+        }
+        return accountFolder(key, account, this.providers.get(kind), this.env);
+    }
+    canContinue(kind, from, to) {
+        const fromId = from ?? kind;
+        const toId = to ?? kind;
+        const fromAccount = this.accounts[fromId];
+        const toAccount = this.accounts[toId];
+        if (fromId === toId) {
+            return true;
+        }
+        if (fromAccount === undefined || toAccount === undefined || fromAccount.kind !== kind) {
+            return false;
+        }
+        return canContinue({ id: fromId, account: fromAccount }, { id: toId, account: toAccount }, (each) => this.providers.get(each), this.env);
+    }
+    labelOf(id) {
+        return this.accounts[id]?.label ?? id;
+    }
+    launched(kind, id) {
+        this.launches.set(id ?? kind, this.now());
+    }
+    /* When a CLI last started under this account; null when none did since the host started. */
+    lastLaunchAt(id) {
+        return this.launches.get(id) ?? null;
+    }
+    /* Told whenever the accounts or what their CLIs said changed, after the clients were. */
+    listen(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    /* Checks every account once at once, and the ones due on the clock after that. */
+    start() {
+        this.timer ??= setInterval(() => void this.queue(false), CHECK_INTERVAL_MS);
+        void this.queue(false);
+    }
+    stop() {
+        if (this.timer !== null) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    /* Answers at once; an account that changed reads `checking` until its CLI answered, which arrives as `accounts.changed`. */
+    save(accounts) {
+        return this.serial(() => this.commit(accounts, this.folderExists));
+    }
+    /*
+     * An account in a folder of its own under `<home>/accounts`, signed in by nobody yet. A
+     * Codex account is a shadow home over the CLI's own folder, so its threads go on under the other.
+     */
+    create(payload) {
+        return this.serial(async () => {
+            const { kind, label, color } = payload;
+            const provider = this.providers.get(kind);
+            if (provider.home === undefined) {
+                throw new InvalidAccountError(`${provider.name} has no setting for its config folder, so it only has its default account`);
+            }
+            const id = this.mintId(kind, label);
+            const folder = join(this.accountsFolder(), id);
+            await mkdir(this.accountsFolder(), { recursive: true, mode: 0o700 });
+            await mkdir(folder, { mode: 0o700 });
+            const folders = kind === 'codex' ? { home: defaultFolder(provider, this.env), shadowHome: folder } : { home: folder };
+            const account = { kind, label, ...(color === undefined ? {} : { color }), ...folders };
+            await this.prepare(id, kind, account);
+            const snapshot = await this.commit({ ...this.accounts, [id]: account }, (path) => path === folder || this.folderExists(path));
+            return { ...snapshot, id };
+        });
+    }
+    /*
+     * Asks the CLI of one account again every few seconds, for a login running in a terminal, until
+     * it is signed in or a few minutes passed. Resolves when the watch ends; a second call for the
+     * same account only moves the end.
+     */
+    watchLogin(id) {
+        if (this.accounts[id] === undefined) {
+            throw new AccountError('account-unavailable', `The account '${id}' is not available on this machine: no account on it has that id.`);
+        }
+        const deadline = this.now() + LOGIN_WATCH_MS;
+        const running = this.watches.get(id);
+        if (running !== undefined) {
+            running.deadline = deadline;
+            return running.done;
+        }
+        const watch = { deadline, done: Promise.resolve() };
+        watch.done = this.runWatch(id, watch).finally(() => this.watches.delete(id));
+        this.watches.set(id, watch);
+        return watch.done;
+    }
+    /* Asks every CLI again, and answers once they all did. */
+    async refresh() {
+        await this.queue(true);
+        return this.snapshot();
+    }
+    async runWatch(id, watch) {
+        while (this.now() < watch.deadline) {
+            await this.sleep(LOGIN_POLL_MS);
+            if (this.accounts[id] === undefined) {
+                return;
+            }
+            await this.queue(true, id);
+            if (this.states.get(id)?.status.state === 'ready') {
+                return;
+            }
+        }
+    }
+    /* One change of the file at a time: a create and a save both read what the other just wrote. */
+    serial(work) {
+        const next = this.writes.then(work);
+        this.writes = next.catch(() => undefined);
+        return next;
+    }
+    async commit(accounts, isDirectory) {
+        const stored = acceptAccounts(accounts, this.stored, (kind) => this.providers.get(kind), this.env, isDirectory, this.host);
+        const { writes, removals } = this.planSecrets(stored);
+        for (const [key, value] of writes) {
+            await this.requireSecrets().write(key, value);
+            this.secretValues.set(key, value);
+        }
+        await writeAccounts(this.path, stored);
+        this.stored = stored;
+        this.accounts = wireAccounts(stored);
+        for (const key of removals) {
+            this.secretValues.delete(key);
+            await this.secrets?.remove(key).catch((e) => console.error(`Could not remove ${key} from the keychain:`, errorText(e)));
+        }
+        const rewritten = new Set([...writes.keys()].map((key) => key.slice(0, key.indexOf('/'))));
+        for (const id of this.states.keys()) {
+            // A new secret can be a new login, which the account as the file holds it does not show.
+            if (this.accounts[id] === undefined || rewritten.has(id)) {
+                this.states.delete(id);
+            }
+        }
+        this.emit();
+        void this.queue(false);
+        return this.snapshot();
+    }
+    /*
+     * Takes every sensitive value out of the accounts about to be written, leaving the redacted form
+     * the file keeps. Answers which values go into the keychain and which keys no account has any more.
+     */
+    planSecrets(stored) {
+        const writes = new Map();
+        const kept = new Set();
+        for (const [id, entry] of Object.entries(stored)) {
+            const kind = entry.kind;
+            if (!isKnownKind(kind)) {
+                for (const name of sensitiveNames(entry)) {
+                    kept.add(secretKey(id, name));
+                }
+                continue;
+            }
+            const account = entry;
+            if (account.env === undefined) {
+                continue;
+            }
+            const had = new Set(sensitiveNames(this.stored[id]));
+            const variables = account.env.map((variable) => {
+                if (!variable.sensitive) {
+                    return { name: variable.name, value: variable.value, sensitive: false };
+                }
+                const key = secretKey(id, variable.name);
+                this.requireSecrets();
+                if (variable.value !== '') {
+                    writes.set(key, variable.value);
+                }
+                else if (variable.valueRedacted !== true || !had.has(variable.name)) {
+                    throw new InvalidAccountError(`${id}: ${variable.name} has no value`);
+                }
+                kept.add(key);
+                return { name: variable.name, value: '', sensitive: true, valueRedacted: true };
+            });
+            const { env: _env, ...rest } = account;
+            stored[id] = variables.length === 0 ? rest : { ...rest, env: variables };
+        }
+        const removals = Object.entries(this.stored).flatMap(([id, entry]) => sensitiveNames(entry)
+            .map((name) => secretKey(id, name))
+            .filter((key) => !kept.has(key)));
+        return { writes, removals };
+    }
+    requireSecrets() {
+        if (this.secrets === null) {
+            throw new SecretsUnavailableError();
+        }
+        return this.secrets;
+    }
+    async readSecrets() {
+        if (this.secrets === null) {
+            return;
+        }
+        for (const [id, entry] of Object.entries(this.stored)) {
+            for (const name of sensitiveNames(entry)) {
+                const key = secretKey(id, name);
+                try {
+                    const value = await this.secrets.read(key);
+                    if (value !== null) {
+                        this.secretValues.set(key, value);
+                    }
+                }
+                catch (e) {
+                    console.error(`Could not read ${key} from the keychain:`, errorText(e));
+                }
+            }
+        }
+    }
+    /* The variables of an account as a CLI gets them, and the first sensitive one the keychain did not give. */
+    variablesOf(id, account) {
+        const values = {};
+        for (const variable of account.env ?? []) {
+            const value = variable.sensitive ? this.secretValues.get(secretKey(id, variable.name)) : variable.value;
+            if (value === undefined) {
+                return { values, missing: variable.name };
+            }
+            values[variable.name] = value;
+        }
+        return { values, missing: null };
+    }
+    accountsFolder() {
+        return join(this.home, 'accounts');
+    }
+    /* A free id for a new account; a folder a removed account left behind is never handed to another. */
+    mintId(kind, label) {
+        const base = `${kind}_${slugOf(label) || 'account'}`.slice(0, 60).replace(/-+$/, '');
+        const taken = (id) => this.accounts[id] !== undefined || this.stored[id] !== undefined || existsSync(join(this.accountsFolder(), id));
+        let id = base;
+        for (let suffix = 2; taken(id); suffix += 1) {
+            id = `${base}-${suffix}`;
+        }
+        return id;
+    }
+    /* One pass at a time, in the order they were asked for, so a save during a pass is checked after it. */
+    queue(force, only) {
+        const pass = this.passes.then(() => this.runAll(force, only));
+        this.passes = pass.catch((e) => console.error('Could not check the provider accounts:', errorText(e)));
+        return this.passes;
+    }
+    statusOf(id, account) {
+        const state = this.states.get(id);
+        if (state !== undefined && state.drawnFor === JSON.stringify(account)) {
+            return state.status;
+        }
+        return this.status(id, account, 'checking', { checkedAt: 0 });
+    }
+    status(id, account, state, fields = {}) {
+        const provider = isKnownKind(account.kind) ? this.providers.get(account.kind) : null;
+        const folder = provider === null ? '' : accountFolder(id, account, provider, this.env);
+        return {
+            id,
+            kind: account.kind,
+            state,
+            email: null,
+            plan: null,
+            organization: null,
+            home: folder,
+            ...(provider === null ? {} : { transcripts: transcriptFolder(id, account, provider, this.env) }),
+            message: null,
+            checkedAt: this.now(),
+            ...fields
+        };
+    }
+    async runAll(force, only) {
+        const installed = await this.providers.list();
+        const due = Object.entries(this.accounts).filter(([id, account]) => {
+            if (only !== undefined && id !== only) {
+                return false;
+            }
+            const state = this.states.get(id);
+            return force || state === undefined || state.drawnFor !== JSON.stringify(account) || this.now() >= state.nextAt;
+        });
+        const results = await Promise.all(due.map(async ([id, account]) => ({ id, account, status: await this.check(id, account, installed) })));
+        let changed = false;
+        for (const { id, account, status } of results) {
+            if (this.accounts[id] === undefined) {
+                continue;
+            }
+            const before = this.states.get(id);
+            const drawnFor = JSON.stringify(account);
+            const failed = status.state === 'failed';
+            const backoffMs = failed ? Math.min(MAX_BACKOFF_MS, (before?.backoffMs ?? CHECK_INTERVAL_MS / 2) * 2) : CHECK_INTERVAL_MS;
+            this.states.set(id, { status, drawnFor, backoffMs, nextAt: this.now() + backoffMs });
+            // An account a save changed read `checking` since, whatever it read before.
+            changed ||= before === undefined || before.drawnFor !== drawnFor || !sameStatus(before.status, status);
+        }
+        if (changed) {
+            this.emit();
+        }
+    }
+    async check(id, account, installed) {
+        const kind = account.kind;
+        if (!isKnownKind(kind)) {
+            return this.status(id, account, 'unavailable', { message: `This version of ${this.host.name} does not know this CLI` });
+        }
+        const provider = this.providers.get(kind);
+        const isDefault = isDefaultAccount(id, account);
+        if (!isDefault && provider.home === undefined) {
+            return this.status(id, account, 'unavailable', {
+                message: `${provider.name} has no setting for its config folder, so it only has its default account`
+            });
+        }
+        if (account.enabled === false || this.providers.enabled?.(kind) === false) {
+            return this.status(id, account, 'disabled');
+        }
+        if (installed.find((info) => info.kind === kind)?.installed !== true) {
+            return this.status(id, account, 'not-found');
+        }
+        if (provider.home === undefined) {
+            return this.status(id, account, 'ready');
+        }
+        const folders = isDefault
+            ? []
+            : [account.home, account.shadowHome].filter((folder) => folder !== undefined).map((folder) => expandHome(folder, this.env));
+        for (const folder of folders) {
+            if (!this.folderExists(folder)) {
+                return this.status(id, account, 'folder-missing', { message: `${folder} does not exist` });
+            }
+        }
+        try {
+            const message = await this.prepare(id, kind, account);
+            const { values, missing } = this.variablesOf(id, account);
+            if (missing !== null) {
+                throw new Error(`The keychain does not give the value of ${missing}`);
+            }
+            const reading = await this.ask(kind, provider.command, accountEnv(id, account, provider, this.env, values));
+            return this.status(id, account, reading.signedIn ? 'ready' : 'signed-out', {
+                email: reading.email,
+                plan: reading.plan,
+                organization: reading.organization,
+                message
+            });
+        }
+        catch (e) {
+            return this.status(id, account, 'failed', { message: errorText(e) });
+        }
+    }
+    /*
+     * Puts the hooks in the account's folder and links a shadow home to the home it shares, before the
+     * CLI is asked anything: Codex writes its own files into a fresh home the moment it starts, and a
+     * real file there is one the host will never replace by a link. Answers what a person should
+     * know about the shadow home, and throws when it cannot be used.
+     */
+    async prepare(id, kind, account) {
+        if (isDefaultAccount(id, account) || account.home === undefined) {
+            return null;
+        }
+        const home = expandHome(account.home, this.env);
+        await this.install?.(kind, home).catch((e) => console.error(`Could not install hooks in ${home}:`, errorText(e)));
+        if (account.shadowHome === undefined) {
+            return null;
+        }
+        const report = await this.prepareShadow(home, expandHome(account.shadowHome, this.env));
+        if (report.sharedLogin) {
+            throw new Error('auth.json in the shadow home is a link, so this account would sign in as another one');
+        }
+        return report.unshared.length > 0 ? `Not shared with ${home}: ${report.unshared.join(', ')}` : null;
+    }
+    emit() {
+        this.sinks.emit({ event: 'accounts.changed', payload: this.snapshot() });
+        for (const listener of this.listeners) {
+            listener();
+        }
+    }
+}

package/dist/providers/accounts/shadow-home.d.ts

@@ -0,0 +1,8 @@
+export interface ShadowHomeReport {
+    linked: string[];
+    unshared: string[];
+    sharedLogin: boolean;
+}
+export declare class ShadowHomeError extends Error {
+}
+export declare function prepareShadowHome(home: string, shadow: string): Promise<ShadowHomeReport>;

package/dist/providers/accounts/shadow-home.js

@@ -0,0 +1,70 @@
+import { lstat, mkdir, readdir, readlink, symlink } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { isNotFound } from '../../fs.js';
+/*
+ * A Codex shadow home: a folder of its own for one login, sharing everything else with a Codex home
+ * by symlink, so two accounts continue each other's threads. Codex needs its login in `auth.json`
+ * (`cli_auth_credentials_store = "file"`) for this; a login in the keychain has no folder to be in.
+ */
+/* Made in the shared home before anything is linked, so the first thread of either account already lands there. */
+const SHARED_FOLDERS = ['sessions', 'archived_sessions', 'skills', 'rules'];
+/* The login, which is the whole point of the shadow home. */
+const PRIVATE_ENTRIES = new Set(['auth.json']);
+/*
+ * What one Codex process keeps for itself: what the models of this login are, caches, logs, and the
+ * sockets of an app-server that answers for the account that started it.
+ */
+const LOCAL_ENTRIES = new Set(['models_cache.json', 'cache', 'log', 'logs', 'tmp', '.tmp', 'app-server-daemon', 'app-server-control', 'ipc']);
+/* A SQLite journal comes and goes with its database, so a link to one would soon point at nothing. */
+function isJournal(name) {
+    return /-(wal|shm|journal)$/.test(name);
+}
+export class ShadowHomeError extends Error {
+}
+async function existing(path) {
+    try {
+        const stats = await lstat(path);
+        return stats.isSymbolicLink() ? { kind: 'link', target: await readlink(path) } : { kind: 'real' };
+    }
+    catch (e) {
+        if (isNotFound(e)) {
+            return { kind: 'missing' };
+        }
+        throw e;
+    }
+}
+/*
+ * Links every shared entry of `home` into `shadow` that is not there yet. Never overwrites and never
+ * removes anything, so it runs again whenever it likes and picks up what Codex added to `home` since.
+ * Both folders have to exist; the person makes them, the way they sign in.
+ */
+export async function prepareShadowHome(home, shadow) {
+    const shared = resolve(home);
+    const own = resolve(shadow);
+    if (shared === own) {
+        throw new ShadowHomeError('The shadow home has to be another folder than the config folder');
+    }
+    for (const folder of SHARED_FOLDERS) {
+        await mkdir(join(shared, folder), { recursive: true });
+    }
+    const report = { linked: [], unshared: [], sharedLogin: false };
+    for (const name of PRIVATE_ENTRIES) {
+        if ((await existing(join(own, name))).kind === 'link') {
+            report.sharedLogin = true;
+        }
+    }
+    const names = (await readdir(shared)).filter((name) => !PRIVATE_ENTRIES.has(name) && !LOCAL_ENTRIES.has(name) && !isJournal(name));
+    for (const name of names.sort()) {
+        const target = join(shared, name);
+        const link = join(own, name);
+        const found = await existing(link);
+        if (found.kind === 'missing') {
+            await symlink(target, link);
+            report.linked.push(name);
+        }
+        else if (found.kind === 'real' || resolve(own, found.target) !== target) {
+            report.unshared.push(name);
+        }
+    }
+    return report;
+}

package/dist/providers/accounts/status.d.ts

@@ -0,0 +1,12 @@
+import type { AgentKind } from '@adecore/agent-contracts';
+import { type CodexClientInfo } from '../../chat/codex-transport.ts';
+export interface AccountReading {
+    signedIn: boolean;
+    email: string | null;
+    plan: string | null;
+    organization: string | null;
+}
+export type AskAccount = (kind: AgentKind, command: readonly string[], env: Record<string, string | undefined>) => Promise<AccountReading>;
+export declare function readClaudeAuthStatus(output: string): AccountReading;
+export declare function readCodexAccount(answer: unknown): AccountReading;
+export declare function askAccountAs(client: CodexClientInfo): AskAccount;