@event4u/agent-switch 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 event4u.app
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,383 @@
+# agent-switch
+
+Switch between multiple Claude Code accounts on macOS, Linux, and Windows with a single shell command — no repeated login/logout, no browser round-trips after the initial setup.
+
+```
+$ asw work        # switch active account
+$ claude         # runs on the "work" account
+$ asw            # list all profiles, active one marked *
+* work             matze@company.example
+  privat           matze@personal.example
+  event4u          dev@event4u.example
+```
+
+## Why not keychain snapshot swapping?
+
+Most naive switchers snapshot the macOS Keychain entry (`Claude Code-credentials`) per account and restore it on switch. This breaks: Claude Code's OAuth **refresh tokens rotate on every refresh**, so a stored snapshot goes stale within hours and you're back to browser logins.
+
+`agent-switch` uses **`CLAUDE_CONFIG_DIR` isolation** instead. Each profile gets its own config directory under `~/.agent-switch/<name>/config`. Claude Code derives a *separate* keychain entry per config dir, so every account stays logged in **live and independently**. Switching only changes which directory new `claude` invocations point at — nothing is snapshotted, nothing goes stale, and each account logs in via browser exactly once.
+
+## Install
+
+**npm / npx** (any OS — needs Node ≥ 18). The package is published as
+`@event4u/agent-switch` (the bare name `agent-switch` on npm is an unrelated
+project):
+
+```bash
+npm install -g @event4u/agent-switch    # puts `agent-switch` on your PATH
+# or run without installing:
+npx @event4u/agent-switch --help
+npx @event4u/agent-switch setup
+```
+
+`npx` is handy for a one-off or first run; for daily use install globally so the
+`agent-switch` / `asw` commands and the shell wrapper are always on PATH.
+
+From source (for development):
+
+```bash
+npm install          # or: npm ci
+npm run build
+npm link             # puts `agent-switch` on your PATH (npm creates a .cmd shim on Windows)
+```
+
+Native package managers (Homebrew / Scoop / winget) are planned; `npm i -g`
+above is the supported install path on every OS in the meantime.
+
+Then add the shell integration — `agent-switch shellenv` auto-detects your shell,
+or pass `--shell`:
+
+| Shell | One-time setup |
+|---|---|
+| **zsh** (macOS default) | add `eval "$(agent-switch shellenv)"` to `~/.zshrc` |
+| **bash** | add `eval "$(agent-switch shellenv)"` to `~/.bashrc` |
+| **fish** | add `agent-switch shellenv --shell fish \| source` to `~/.config/fish/config.fish` |
+| **PowerShell** (Windows) | add `agent-switch shellenv --shell powershell \| Out-String \| Invoke-Expression` to `$PROFILE` |
+| **cmd.exe** | no wrapper — use `agent-switch run <name>` directly (see below) |
+
+This defines:
+- a `claude` wrapper that injects the active profile's `CLAUDE_CONFIG_DIR`
+- `asw <name>` as shorthand for `agent-switch use <name>`, and bare `asw` for `agent-switch list`
+
+Open a new terminal afterwards, then run `agent-switch doctor` to self-check the setup.
+
+**cmd.exe has no function-wrapper story**, so there is no `claude` shadow there:
+run a profile explicitly with `agent-switch run <name>` (which sets
+`CLAUDE_CONFIG_DIR` for that one invocation). PowerShell is the recommended
+Windows shell.
+
+## Setup your accounts
+
+```bash
+# Adopt your existing default install as the first profile (keeps history/settings):
+agent-switch import privat
+agent-switch run privat        # then /login once so this profile owns its own credential
+
+# Add the other accounts — each opens Claude Code for a one-time login:
+agent-switch add work
+agent-switch add event4u
+```
+
+## Daily use
+
+| Command | Effect |
+|---|---|
+| `asw work` | switch active account (new sessions) |
+| `asw` | list profiles (live sessions shown) |
+| `agent-switch run event4u` | one-shot session on another account **without** switching — all accounts can run in parallel |
+| `agent-switch run work -- --resume` | pass any flags through to `claude` |
+| `agent-switch status` | identity + 5h/7d usage for every profile |
+| `agent-switch map work ~/projects/kunde-a` | `claude` in that repo always uses this account — no switching |
+| `agent-switch share on` | one settings/skills/commands/agents tree for all profiles |
+| `agent-switch sessions` | recent + live Claude sessions per profile |
+| `agent-switch takeover <id> --to work` | move a session to another account and resume it there (see below) |
+| `agent-switch web work` | claude.ai in a persistent per-profile browser (see below) |
+| `agent-switch remove old --force` | delete a profile incl. its keychain entry |
+| `agent-switch label work Work` | tag a profile (`Work` / `Personal` / `Other`, or `none` to clear) |
+| `agent-switch providers status` | which providers are enabled (default: Claude + Codex; others off) |
+| `agent-switch providers enable --provider gemini` | enable a provider (or `disable`; `--surface cli\|ui` for one surface) |
+| `agent-switch autoswitch on --threshold 90` | opt-in auto-switch on limit (Claude-only; globally off by default; see below) |
+| `agent-switch uninstall --force` | remove all agent-switch data, keychain entries, and the daemon |
+| `agent-switch doctor` | per-OS self-check (claude on PATH, config, creds, share links) |
+
+## Per-repo accounts (directory mappings)
+
+```bash
+agent-switch map work ~/projects/firma
+agent-switch map privat ~/projects/hobby
+```
+
+The `claude` shell wrapper resolves the current directory to the nearest mapped
+ancestor. Precedence: **mapping > active profile > default**. `agent-switch mappings`
+lists, `agent-switch unmap` removes.
+
+## Shared settings across accounts
+
+```bash
+agent-switch share on             # settings.json, CLAUDE.md, skills/, commands/, agents/
+agent-switch share on --history   # additionally share conversation history + plans/ (--resume, POSIX only)
+agent-switch share sync           # re-link any file a /config edit forked (see below)
+agent-switch share off            # removes only agent-switch-created links
+```
+
+Sharing links from `~/.claude` (or `--source <profile>`) into each profile.
+Two behaviors, because Claude Code's settings writer writes atomically:
+
+- **Directories** (`skills/`, `commands/`, `agents/`) write **through** the link
+  — an edit in any profile lands in the shared source. This is the payoff.
+  Linked as a symlink on macOS/Linux, a junction on Windows (no admin needed).
+- **Files** (`settings.json`, `keybindings.json`, `CLAUDE.md`) are linked too,
+  but an in-profile `/config` edit **forks** the file (the atomic rename
+  replaces the link). Run `agent-switch share sync` to push a fork back into the
+  shared source and re-link it (last sync wins across profiles). On Windows,
+  file symlinks need Developer Mode or admin; without it, only the directories
+  are shared and files are skipped with a message.
+
+Account-scoped state (credentials, `.claude.json`, plugins) always stays per
+profile.
+
+## Session handoff between accounts (takeover)
+
+Switching the account should not cost the conversation. A Claude Code session is
+a transcript file scoped to its project directory — and an *account* handoff
+keeps that directory constant, so the session can move between profiles:
+
+```bash
+agent-switch sessions                       # recent + live sessions, per profile (* = live)
+agent-switch takeover <session-id> --to work        # move it, then resume on "work"
+agent-switch takeover <session-id> --to work --keep-source   # copy + fork instead (source keeps its own)
+```
+
+- **Move by default.** The transcript is transferred copy→verify→delete; the
+  original account no longer owns the session afterwards (no same-id divergence).
+- **`--keep-source` forks.** The target resumes with `--fork-session` (fresh
+  session id there); the source's transcript stays untouched. Session-scoped
+  permission approvals do not carry into a fork — Claude asks once more.
+- **Guard rails.** Takeover refuses when the source profile has live sessions
+  (close them first, or `--force`), never overwrites an existing transcript on
+  the target, and detects `share on --history` (nothing to move — profiles
+  already see one history tree).
+- In an interactive terminal the takeover resumes the session directly; use
+  `--print-only` to just print the resume command. Transcripts are treated as
+  opaque blobs — moved whole, never parsed or rewritten.
+
+## Context monitoring
+
+See how full each live session's context window is *before* the "97% of context
+used" wall, get warned at a threshold, and act — all from own-session data read
+locally (no API calls, own-profile only, never a cross-account comparison).
+
+```bash
+agent-switch sessions                 # live sessions carry a context column: 67% · 134k/1000k
+agent-switch status                   # active profile's worst live session's context, one line
+agent-switch alerts on --threshold 80,95   # daemon records ONE coalesced notification per cycle on a crossing
+agent-switch compact work             # type /compact into work's agent-switch-managed tmux pane (idle-guarded)
+```
+
+- **Context %** is read from the session's own transcript (the last finalized
+  main-chain turn's input side, matching Claude Code's own `/context`); the
+  window (200k / 1M) comes from a small per-model table. Unknown model → raw
+  tokens, no guessed percentage. Codex context comes in-band from its rollout.
+- **Alerts** are **off by default** and, when on, name only the project +
+  percentage + a suggested `/compact` — never another profile. Enable per-session
+  liveness/compaction signals with `agent-switch hooks install` (adds additive,
+  reversible, share-aware hooks to the profile's `settings.json`).
+- **Compaction is never automatic.** `agent-switch compact <profile>` only types
+  into an agent-switch-*managed* tmux pane (`run --tmux`), refuses while a turn
+  is in flight (`--force` to override), and prints the manual command anywhere
+  else. `/clear` is gated behind `--force` (it discards the conversation).
+
+## Browser sessions (claude.ai) without re-login
+
+`agent-switch web <name>` launches a Playwright Chromium instance with a **persistent user-data-dir per profile** (`~/.agent-switch/<name>/browser`). You log in once per account; cookies and session live in that directory and are reused on every subsequent `agent-switch web <name>`. No cookie copying, no fragile session extraction — just isolated browser profiles.
+
+Requires the optional dependency:
+
+```bash
+npm install playwright && npx playwright install chromium
+```
+
+(Alternative without any tooling: separate Chrome profiles or Firefox containers achieve the same thing.)
+
+## GUI apps (experimental, macOS)
+
+Beyond the CLIs, agent-switch can launch **desktop/GUI clients** on an isolated
+profile. Two strategies, picked per app:
+
+- **env** — export the provider's config-dir env var (the same mechanism the
+  CLIs use, e.g. `CODEX_HOME`) when launching the app. Reuses the profile's
+  config dir.
+- **user-data-dir** — pass Chromium's `--user-data-dir` to an Electron app, so
+  each profile gets its own isolated data dir and profiles run **in parallel**.
+
+```bash
+agent-switch apps                 # list launchable GUI apps + installed state
+agent-switch open <app> [profile] # launch an app on a profile (active if omitted)
+```
+
+**Supported now:**
+
+- **Claude Desktop** (`agent-switch open claude-desktop <profile>`) —
+  `user-data-dir` strategy, parallel accounts.
+- **Codex desktop** (`agent-switch open codex-desktop <profile>`) — **two
+  layers** in one launch: `CODEX_HOME` (agent auth, reuses the codex profile) +
+  `--user-data-dir` (the ChatGPT web session).
+- **Codex in VS Code** (`agent-switch open codex-ide <profile>`) — `CODEX_HOME`
+  only (the extension reads it from the editor's env).
+
+More clients land via their roadmaps in `agents/roadmaps/`.
+
+Caveats (why this is experimental):
+- **macOS-only for now**; launched via the `open` command, not a Finder/Dock
+  double-click (a plain launch doesn't carry the flag/env → no isolation).
+- **Unofficial / version-fragile** — no vendor ships a built-in account
+  switcher; an app update can change launcher behaviour. Re-verify per app.
+- The profile's data dir is never swapped on a live app (that risks
+  SingletonLock/DB corruption); isolation is by launch flag/env only. Claude
+  Desktop's own default install (`~/Library/Application Support/Claude`) is
+  never touched — each profile gets its own dir.
+- **Claude Desktop login is a web session** (not a refreshable token): each
+  profile signs in once and expires on its own schedule. Because an OAuth
+  callback can reach the wrong live window, **quit other Claude windows before
+  signing into a new account.**
+- **Codex** — the desktop app lists only the *latest* session when a custom
+  `CODEX_HOME` is set (upstream openai/codex#14389; cosmetic, not an isolation
+  failure). For `codex-ide`, `CODEX_HOME` reaches a *newly launched* editor
+  process — if your editor is already running, quit it first so the new account
+  takes effect (also re-check openai/codex#7971 on your extension version).
+
+Verify a candidate Electron app honours `--user-data-dir` on your machine:
+
+```bash
+open -n -a "<App>" --args --user-data-dir="$HOME/Library/Application Support/<App>-test"
+pgrep -lf "<App>.app/Contents/MacOS"        # ≥2 processes ⇒ parallel instances
+ls "$HOME/Library/Application Support/<App>-test"   # populated ⇒ flag honoured
+```
+
+## Platform support
+
+Every command works on macOS, Linux, and Windows, or degrades with an explicit
+message. `agent-switch doctor` reports the live status for your machine.
+
+| Capability | macOS | Linux | Windows |
+|---|---|---|---|
+| Profiles, switch, run, status, mappings | ✅ | ✅ | ✅ |
+| Credential store | Keychain (per-dir), file fallback | plaintext file per profile | plaintext file per profile |
+| `import` (login-free) | ✅ | ✅ | ✅ |
+| Share **directories** (skills/commands/agents) | ✅ symlink | ✅ symlink | ✅ junction (no admin) |
+| Share **files** (settings.json, …) | ✅ (forks on edit → `share sync`) | ✅ (same) | ⚠️ needs Developer Mode/admin; else skipped |
+| `share --history` | ✅ | ✅ | ❌ POSIX-only |
+| Shell wrapper | zsh/bash | zsh/bash/fish | PowerShell (cmd.exe → `run`) |
+| `web` (claude.ai browser) | ✅ | ✅ desktop session | ✅ |
+
+Full per-mechanism contract (verified/degraded/broken with sources) lives in
+[`ADOPTED.md`](ADOPTED.md#per-os-contract-matrix).
+
+## Notes & gotchas
+
+- **Never use `claude auth logout` to switch** — it revokes the token server-side. Switching via `agent-switch` never touches the other accounts' credentials.
+- **Running sessions are unaffected by a switch.** Claude Code reads its config at startup; only *new* sessions pick up the new profile. Restart a session if you want it on the other account.
+- `agent-switch remove` deletes the config dir **and** the profile's hashed keychain entry, and prunes its directory mappings.
+- After `agent-switch import`, the imported profile and the old default login share one OAuth lineage — the first side to refresh wins. Stop using the bare default login afterwards.
+- Profiles are fully isolated by default; use `agent-switch share on` for a managed shared-settings setup.
+- Override the profile root with `AGENT_SWITCH_HOME` if you don't want `~/.agent-switch`.
+- **`CLAUDE_CONFIG_DIR` relocates only the config home, not the OS state dir.** On Linux, Claude Code may also write to `~/.local/state/claude/` (XDG state), which is *not* per-profile — so any state kept there (not credentials, which live in each profile's config dir) is effectively shared across all profiles. Impact is limited and the exact contents vary by version; flagged here so a surprising cross-profile artifact there is not mistaken for a leak of account data. Credentials, `.claude.json`, and history stay per profile.
+- **VS Code extension ignores `CLAUDE_CONFIG_DIR`** (upstream #30538) — the extension always uses the default `~/.claude`. Use the CLI (`agent-switch run` / the `claude` wrapper) for per-profile sessions; the extension is out of scope.
+
+## Background service & tray GUI (optional)
+
+The CLI is fully usable on its own. Two optional layers add convenience:
+
+- **Usage daemon** — a background service polls each profile's **own** usage
+  (only profiles with a live session + the active one), caches it, and notifies
+  on the active profile's threshold crossings (75% / 90% by default):
+
+  ```bash
+  agent-switch service install    # launchd (macOS) / systemd --user (Linux) / Task Scheduler (Windows)
+  agent-switch service status     # health, last poll, cached profiles
+  agent-switch service start|stop # manual control (no install)
+  ```
+
+- **Tray/menubar GUI** (`gui/`, Tauri) — a small panel to see per-profile usage
+  and switch/open sessions. It is a **client of the CLI** (`agent-switch <cmd>
+  --json`) and never re-implements profile logic; the CLI core stays
+  dependency-free. See [`gui/README.md`](gui/README.md).
+
+Usage readout is per-provider: Claude exposes an OAuth `/usage` endpoint;
+**Codex and Gemini have no usage readout**, so they show identity only (never a
+fabricated number).
+
+### Installing the desktop app (unsigned builds)
+
+The tray GUI ships as native installers on the project's GitHub Releases —
+`.dmg`/`.app` (macOS, universal), `.deb`/`.rpm`/`.AppImage` (Linux), and
+`.msi`/`.exe` (Windows). They are **not code-signed or notarized yet**, so the
+OS blocks the first launch. This is expected; here is how to open them.
+
+**macOS** — Gatekeeper shows *"'agent-switch.app' can't be opened because Apple
+cannot check it for malicious software."* Pick one:
+
+- **Recommended:** open **System Settings → Privacy & Security**, scroll to the
+  message about `agent-switch`, and click **Open Anyway**, then confirm. On
+  macOS 15 (Sequoia) and later this is the only reliable route.
+- **macOS 14 and earlier:** right-click (Control-click) the app in Finder →
+  **Open** → **Open** in the dialog. (Double-clicking only offers "Move to
+  Trash" — you must use the right-click menu to get an "Open" button.)
+- **Terminal:** strip the quarantine flag directly —
+  `xattr -dr com.apple.quarantine /Applications/agent-switch.app`.
+
+You only do this once per install; subsequent launches open normally.
+
+**Windows** — SmartScreen shows *"Windows protected your PC."* Click **More
+info → Run anyway**.
+
+**Linux** — no Gatekeeper equivalent; for the AppImage, mark it executable
+(`chmod +x agent-switch_*.AppImage`) before running.
+
+To remove these prompts entirely, the builds need Apple Developer-ID signing +
+notarization (macOS) and an Authenticode certificate (Windows) — wired via
+release secrets when certificates are available.
+
+### Automatic account rotation (opt-in, off by default)
+
+By default `agent-switch` only switches when **you** ask, and shows **your own**
+usage per profile (the same information the vendors' native `/usage` surfaces
+show). It never nags or ranks unless you turn rotation on.
+
+> **Usage-policy warning.** Quota-triggered rotation across accounts can violate
+> the providers' usage policies: it pools separate subscriptions to route around
+> per-account rate limits. Enabling it is your decision — but the risk is real,
+> and this notice states it plainly. Plain per-context profile switching
+> (private / work / client) and viewing your own usage are **not** affected;
+> this warning is specific to automated quota-driven rotation.
+
+Auto-switch is **globally off by default** and must be explicitly enabled. It is
+available **only for Claude** — the one provider with a usage readout to trigger
+on; Codex and Gemini have none, so they are profile-switch only and never show an
+auto-switch control. When enabled (`agent-switch autoswitch on [--threshold N]`),
+the background daemon moves the active Claude profile to the account with the most
+headroom once the active one hits the threshold. Switching only affects **new**
+sessions; running ones keep their environment.
+
+**On the record:** this capability was reviewed and **rejected** — first in the
+v1 adoption analysis, then in a two-round AI-council review that was **unanimous**
+that quota-triggered cross-account rotation crosses the providers' usage policies
+and recommended removal. It ships here anyway, off by default, as a deliberate
+decision that **overrode** that recommendation — not a relitigation that resolved
+it. The full rejection rationale is preserved verbatim in
+[`agents/roadmaps/skipped/road-to-agent-switch-autoswitch-rejected.md`](agents/roadmaps/skipped/road-to-agent-switch-autoswitch-rejected.md);
+read it before enabling.
+
+## Layout
+
+```
+~/.agent-switch/
+  state.json               # { "active": "work" }
+  work/
+    config/                # CLAUDE_CONFIG_DIR for this account (.claude.json, settings, history)
+    browser/               # persistent Playwright profile for claude.ai
+  privat/
+    config/
+  event4u/
+    config/
+```

package/dist/agy-keychain.js

@@ -0,0 +1,70 @@
+/**
+ * Per-profile macOS keychain isolation for the Antigravity CLI (`agy`).
+ *
+ * `agy` stores its OAuth login token in the macOS keychain via the Go library
+ * zalando/go-keyring, under a FIXED key (service "gemini" / account
+ * "antigravity") on the session's DEFAULT keychain. go-keyring shells out to
+ * `/usr/bin/security` by absolute path with no keychain argument, so there is no
+ * shim and no per-call override — the only lever is which keychain is "default".
+ *
+ * Verified behaviour (the load-bearing fact this module relies on): the keychain
+ * default + search list that `/usr/bin/security` reads are resolved from
+ * `$HOME/Library/Preferences/com.apple.security.plist` — they are HOME-SCOPED.
+ * So by pointing HOME at the profile's config dir (which agent-switch already
+ * does for antigravity) AND seeding a keychain + default/search-list under that
+ * HOME's `Library/`, each profile gets its OWN keychain with agy's fixed-key
+ * entry — fully isolated, concurrent across profiles, and WITHOUT touching the
+ * user's real login keychain or global session state.
+ *
+ * This is why redirecting HOME alone produced macOS's "no keychain found to
+ * secure 'antigravity'" dialog: the profile HOME had no keychain yet. Seeding
+ * one here is the fix.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+/** The per-profile keychain file, under the profile HOME's `Library/Keychains`.
+ *  Named `login.keychain-db` so the isolated HOME looks like a normal macOS home
+ *  and `security` resolves it without complaint. */
+export function agyKeychainPath(home) {
+    return path.join(home, "Library", "Keychains", "login.keychain-db");
+}
+/**
+ * Ensure the profile HOME has an unlocked keychain set as its (HOME-scoped)
+ * default + sole search-list entry, so a subsequent `agy` launched with this
+ * HOME reads/writes its go-keyring token there. Idempotent and best-effort:
+ * macOS-only, and never throws — if setup fails, agy simply falls back to its
+ * own prompt rather than crashing the launch.
+ */
+export function ensureAgyKeychain(home) {
+    if (process.platform !== "darwin")
+        return;
+    try {
+        const kc = agyKeychainPath(home);
+        fs.mkdirSync(path.dirname(kc), { recursive: true, mode: 0o700 });
+        // com.apple.security.plist (the HOME-scoped default/search-list store) lives here.
+        fs.mkdirSync(path.join(home, "Library", "Preferences"), { recursive: true, mode: 0o700 });
+        // CFFIXED_USER_HOME is set alongside HOME: macOS CoreFoundation preference
+        // resolution (what `security` uses for the HOME-scoped default/search list)
+        // prefers CFFIXED_USER_HOME over HOME, so an ambient value would silently
+        // redirect the keychain out of the profile and break isolation. Pin it too.
+        const env = { ...process.env, HOME: home, CFFIXED_USER_HOME: home };
+        const sec = (args) => spawnSync("security", args, { env, stdio: "ignore", timeout: 10000 });
+        // Empty password: within agent-switch's threat model (it already stores
+        // plaintext credentials per profile) and the keychain is inside the
+        // per-profile dir. create is skipped once the file exists.
+        if (!fs.existsSync(kc))
+            sec(["create-keychain", "-p", "", kc]);
+        // Point this HOME's default + search list at the profile keychain (HOME-scoped
+        // writes — the real session is untouched).
+        sec(["default-keychain", "-d", "user", "-s", kc]);
+        sec(["list-keychains", "-d", "user", "-s", kc]);
+        sec(["unlock-keychain", "-p", "", kc]);
+        // No `-t`/`-l`: disable the auto-lock timeout and lock-on-sleep so agy's next
+        // read within a session never triggers a re-unlock prompt.
+        sec(["set-keychain-settings", kc]);
+    }
+    catch {
+        /* best-effort: never block the launch on keychain setup */
+    }
+}

package/dist/api.js

@@ -0,0 +1,154 @@
+/**
+ * Read-only OAuth endpoints for identity verification and usage display.
+ *
+ * Endpoints and header adopted from claude-swap (oauth.py):
+ *   GET https://api.anthropic.com/api/oauth/profile  — account identity
+ *   GET https://api.anthropic.com/api/oauth/usage    — 5h/7d windows
+ * both with `Authorization: Bearer <accessToken>` and the
+ * `anthropic-beta: oauth-2025-04-20` header.
+ *
+ * Deliberately NOT adopted from claude-swap: the token-refresh grant. Our
+ * profiles are live logins — Claude Code refreshes its own tokens per config
+ * dir. Refreshing from outside would rotate the refresh token underneath a
+ * running session for no benefit.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { credentialStore } from "./credentials.js";
+const BETA_HEADER = "oauth-2025-04-20";
+/** A Claude profile's live credential via the per-OS store (keychain-then-file
+ * on darwin, plaintext file on linux/win32), given its config dir. Claude-only:
+ * the OAuth identity/usage endpoints below are Anthropic's. null if unreadable. */
+export function readProfileCredential(configDir) {
+    return credentialStore().read(configDir);
+}
+export function accessTokenOf(credentials) {
+    try {
+        return JSON.parse(credentials)?.claudeAiOauth?.accessToken ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function oauthGet(pathname, token) {
+    // The usage/profile endpoints rate-limit (429) aggressively — a few near-
+    // simultaneous reads (e.g. the GUI polling every profile) trip it, which
+    // surfaced as a profile's usage intermittently coming back empty. Retry a 429
+    // with a short backoff (honouring Retry-After), capped, so one throttled read
+    // recovers instead of silently degrading to "no data".
+    for (let attempt = 0;; attempt++) {
+        let res;
+        try {
+            res = await fetch(`https://api.anthropic.com${pathname}`, {
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    "anthropic-beta": BETA_HEADER,
+                    // Send an honest tool User-Agent. Some clients report the endpoint
+                    // rate-limits (429) without one; a real UA is good practice regardless.
+                    "User-Agent": "agent-switch/1.0 (+https://github.com/event4u-app/agent-switch)",
+                },
+                signal: AbortSignal.timeout(10_000),
+            });
+        }
+        catch {
+            return null; // network / timeout — stay snappy, don't retry
+        }
+        if (res.status === 429 && attempt < 3) {
+            const retryAfter = Number(res.headers.get("retry-after"));
+            const waitMs = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter * 1000, 5_000) : 800 * (attempt + 1);
+            await new Promise((r) => setTimeout(r, waitMs));
+            continue;
+        }
+        if (!res.ok)
+            return null;
+        try {
+            return await res.json();
+        }
+        catch {
+            return null;
+        }
+    }
+}
+export function fetchProfile(token) {
+    return oauthGet("/api/oauth/profile", token);
+}
+export function fetchUsage(token) {
+    return oauthGet("/api/oauth/usage", token);
+}
+/** Classify an HTTP status (null = network/timeout failure) into an auth state.
+ *  Pure — the testable core of `checkAuth`. 401/403 = credential present but
+ *  rejected (login expired); 2xx = valid; anything else / no response = unknown
+ *  (offline, transient, or an API change) — NEVER reported as "expired". */
+export function classifyAuthStatus(status) {
+    if (status === null)
+        return "unknown";
+    if (status === 401 || status === 403)
+        return "expired";
+    if (status >= 200 && status < 300)
+        return "ok";
+    return "unknown";
+}
+/** Read-only login check for a Claude profile: is the stored credential still
+ *  accepted by Anthropic? Never writes or refreshes a token. "no-credential"
+ *  when nothing is stored; otherwise the classified profile-endpoint probe. */
+export async function checkAuth(configDir) {
+    const creds = readProfileCredential(configDir);
+    const token = creds ? accessTokenOf(creds) : null;
+    if (!token)
+        return "no-credential";
+    let status = null;
+    try {
+        const res = await fetch("https://api.anthropic.com/api/oauth/profile", {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "anthropic-beta": BETA_HEADER,
+                "User-Agent": "agent-switch/1.0 (+https://github.com/event4u-app/agent-switch)",
+            },
+            signal: AbortSignal.timeout(10_000),
+        });
+        status = res.status;
+    }
+    catch {
+        status = null;
+    }
+    return classifyAuthStatus(status);
+}
+// Usage parsing/formatting moved to usage.ts (richer per-model + routines +
+// thresholds). api.ts stays the low-level fetch layer.
+// ---------------------------------------------------------------------------
+// Process detection — adopted from claude-swap (process_detection.py): Claude
+// Code writes session PID files to <config>/sessions/{pid}.json and IDE
+// lockfiles to <config>/ide/{port}.lock. Reading them is the same mechanism
+// Claude Code uses internally. Best-effort: absence of files ≠ proof of no
+// session on older versions.
+// ---------------------------------------------------------------------------
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err?.code === "EPERM"; // exists, not ours
+    }
+}
+/** PIDs of live Claude Code sessions running on a profile's config dir. */
+export function liveSessionPids(configDir) {
+    const sessionsDir = path.join(configDir, "sessions");
+    let entries;
+    try {
+        entries = fs.readdirSync(sessionsDir);
+    }
+    catch {
+        return [];
+    }
+    const pids = [];
+    for (const entry of entries) {
+        const m = /^(\d+)\.json$/.exec(entry);
+        if (!m)
+            continue;
+        const pid = Number(m[1]);
+        if (pidAlive(pid))
+            pids.push(pid);
+    }
+    return pids;
+}