@event4u/agent-switch 1.0.0

package/dist/profiles.js

@@ -0,0 +1,376 @@
+/** Profile roots, per-provider state, layout migration, and shared helpers. */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { PROVIDER_IDS, provider, isProviderId } from "./providers.js";
+import { credentialStore } from "./credentials.js";
+export const HOME = os.homedir();
+export const ROOT = process.env.AGENT_SWITCH_HOME ?? path.join(HOME, ".agent-switch");
+export const STATE_FILE = path.join(ROOT, "state.json");
+/** Optional profile type/tag, to tell work vs personal accounts apart. */
+export const PROFILE_LABELS = ["Work", "Personal", "Other"];
+export function isProfileLabel(v) {
+    return typeof v === "string" && PROFILE_LABELS.includes(v);
+}
+export const DEFAULT_AUTOSWITCH = { enabled: false, threshold: 95, tag: "all" };
+export const DEFAULT_SWITCH_STRATEGY = "reset-first";
+/**
+ * Providers enabled out of the box. Everything else is available but off by
+ * default — the user opts it in from the Providers settings tab. A provider that
+ * already has profiles is also treated as enabled on first migration, so
+ * upgrading never hides an account the user already set up.
+ */
+export const PROVIDERS_ON_BY_DEFAULT = ["claude", "codex"];
+function emptyActive() {
+    return { claude: null, codex: null, antigravity: null };
+}
+function labelKey(providerId, name) {
+    return `${providerId}/${name}`;
+}
+export function die(msg) {
+    console.error(`error: ${msg}`);
+    process.exit(1);
+}
+export function ensureRoot() {
+    fs.mkdirSync(ROOT, { recursive: true, mode: 0o700 });
+}
+function validateName(name) {
+    if (!/^[A-Za-z0-9_-]+$/.test(name))
+        die(`invalid profile name "${name}" (use a-z, 0-9, -, _)`);
+}
+export function profileDir(providerId, name) {
+    validateName(name);
+    return path.join(ROOT, providerId, name);
+}
+/**
+ * The value exported as the provider's isolation env var
+ * (`<root>/<provider>/<name>/config`).
+ *
+ * IMPORTANT (macOS/claude): Claude Code derives its Keychain service name by
+ * hashing the *exact, unresolved* CLAUDE_CONFIG_DIR string. This function is
+ * the single source of that string — never pass a resolved/realpath variant.
+ * Changing this path for an existing profile changes the hash (see
+ * `migrateLegacyLayout`, which re-seeds the credential across the move).
+ */
+export function configDir(providerId, name) {
+    return path.join(profileDir(providerId, name), "config");
+}
+export function browserDir(providerId, name) {
+    return path.join(profileDir(providerId, name), "browser");
+}
+export function profileExists(providerId, name) {
+    return fs.existsSync(configDir(providerId, name));
+}
+/** Profile names for one provider (dirs with a `config/` subdir), sorted. */
+export function listProfiles(providerId) {
+    const dir = path.join(ROOT, providerId);
+    if (!fs.existsSync(dir))
+        return [];
+    return fs
+        .readdirSync(dir, { withFileTypes: true })
+        .filter((e) => e.isDirectory() && fs.existsSync(path.join(dir, e.name, "config")))
+        .map((e) => e.name)
+        .sort();
+}
+/** Every profile across all providers. */
+export function listAllProfiles() {
+    return PROVIDER_IDS.flatMap((p) => listProfiles(p).map((name) => ({ provider: p, name })));
+}
+export function requireProfile(providerId, name, cmd) {
+    if (!name)
+        die(`usage: agent-switch ${cmd} <profile>`);
+    if (!profileExists(providerId, name)) {
+        const existing = listProfiles(providerId).join(", ") || "(none)";
+        die(`profile "${name}" not found for ${providerId}. Existing: ${existing}`);
+    }
+    return name;
+}
+/** Best-effort account identity for a profile, via its provider. */
+export function identity(providerId, name) {
+    const p = provider(providerId);
+    return p.readIdentity(p.configDirFor(configDir(providerId, name)));
+}
+// ---------- state (per-provider active), with v1 → v2 migration ----------
+function normalizeLabels(raw) {
+    const out = {};
+    if (raw && typeof raw === "object") {
+        for (const [k, v] of Object.entries(raw)) {
+            if (isProfileLabel(v))
+                out[k] = v;
+        }
+    }
+    return out;
+}
+function normalizeAutoSwitch(raw) {
+    const r = (raw ?? {});
+    const threshold = typeof r.threshold === "number" && r.threshold >= 1 && r.threshold <= 100 ? Math.round(r.threshold) : DEFAULT_AUTOSWITCH.threshold;
+    const tag = r.tag === "all" || isProfileLabel(r.tag) ? r.tag : DEFAULT_AUTOSWITCH.tag;
+    return { enabled: r.enabled === true, threshold, tag };
+}
+function emptyAutoSwitch() {
+    return { claude: { ...DEFAULT_AUTOSWITCH }, codex: { ...DEFAULT_AUTOSWITCH }, antigravity: { ...DEFAULT_AUTOSWITCH } };
+}
+function normalizeAutoSwitchMap(raw) {
+    const r = (raw ?? {});
+    // Migration: a single global `{ enabled, threshold }` (the old shape) applies
+    // to every provider, so turning per-provider on doesn't silently disable it.
+    if ("enabled" in r || "threshold" in r) {
+        const one = normalizeAutoSwitch(r);
+        return { claude: { ...one }, codex: { ...one }, antigravity: { ...one } };
+    }
+    const out = emptyAutoSwitch();
+    for (const p of PROVIDER_IDS)
+        out[p] = normalizeAutoSwitch(r[p]);
+    return out;
+}
+/** Default enabled-state for a provider when its config key is absent: on when
+ *  in the default set OR when it already has profiles (never hide existing). */
+function defaultSurfaces(id) {
+    const on = PROVIDERS_ON_BY_DEFAULT.includes(id) || listProfiles(id).length > 0;
+    return { cli: on, ui: on };
+}
+function normalizeSurfaces(raw, id) {
+    const r = (raw ?? {});
+    const d = defaultSurfaces(id);
+    return {
+        cli: typeof r.cli === "boolean" ? r.cli : d.cli,
+        ui: typeof r.ui === "boolean" ? r.ui : d.ui,
+    };
+}
+function emptyProviders() {
+    return Object.fromEntries(PROVIDER_IDS.map((p) => [p, defaultSurfaces(p)]));
+}
+function normalizeProvidersMap(raw) {
+    const r = (raw ?? {});
+    const out = emptyProviders();
+    for (const p of PROVIDER_IDS)
+        out[p] = normalizeSurfaces(r[p], p);
+    return out;
+}
+export function readState() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(STATE_FILE, "utf8"));
+        const labels = normalizeLabels(raw?.labels);
+        const autoSwitch = normalizeAutoSwitchMap(raw?.autoSwitch);
+        const providers = normalizeProvidersMap(raw?.providers);
+        const switchStrategy = raw?.switchStrategy === "rotation-first" ? "rotation-first" : DEFAULT_SWITCH_STRATEGY;
+        const osNotifications = raw?.osNotifications === true;
+        // v1: { active: "<name>" } — a single Claude profile.
+        if (typeof raw?.active === "string") {
+            return { active: { ...emptyActive(), claude: raw.active }, labels, autoSwitch, providers, switchStrategy, osNotifications };
+        }
+        if (raw?.active && typeof raw.active === "object") {
+            return { active: { ...emptyActive(), ...raw.active }, labels, autoSwitch, providers, switchStrategy, osNotifications };
+        }
+        return { active: emptyActive(), labels, autoSwitch, providers, switchStrategy, osNotifications };
+    }
+    catch {
+        /* absent / unparsable → default */
+    }
+    return { active: emptyActive(), labels: {}, autoSwitch: emptyAutoSwitch(), providers: emptyProviders(), switchStrategy: DEFAULT_SWITCH_STRATEGY, osNotifications: false };
+}
+export function readSwitchStrategy() {
+    return readState().switchStrategy;
+}
+export function setSwitchStrategy(strategy) {
+    const state = readState();
+    state.switchStrategy = strategy;
+    writeState(state);
+}
+export function readOsNotifications() {
+    return readState().osNotifications;
+}
+export function setOsNotifications(on) {
+    const state = readState();
+    state.osNotifications = on;
+    writeState(state);
+}
+export function writeState(state) {
+    ensureRoot();
+    fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
+}
+export function activeFor(providerId) {
+    return readState().active[providerId];
+}
+export function setActive(providerId, name) {
+    const state = readState();
+    state.active[providerId] = name;
+    writeState(state);
+}
+export function labelFor(providerId, name) {
+    return readState().labels[labelKey(providerId, name)] ?? null;
+}
+/** Set (or clear, with null) a profile's label. */
+export function setLabel(providerId, name, label) {
+    const state = readState();
+    const key = labelKey(providerId, name);
+    if (label)
+        state.labels[key] = label;
+    else
+        delete state.labels[key];
+    writeState(state);
+}
+/** Drop a removed profile's label so it can't linger as an orphan. */
+export function clearLabel(providerId, name) {
+    setLabel(providerId, name, null);
+}
+/**
+ * Rename a profile: move its config dir, carry its Claude credential across the
+ * path change, and carry its state (active pointer + label) to the new name.
+ * Throws if the source is missing or the target already exists — the caller
+ * validates the new name first.
+ *
+ * Credential carry-over (mirrors `migrateLegacyLayout`): Claude on darwin keys
+ * its Keychain credential by a hash of the *exact* config-dir string, so the
+ * rename would otherwise orphan it (keychain miss at the new path → no token →
+ * usage/limits stop updating). Read it from the old path BEFORE the move, then
+ * re-seed a plaintext `.credentials.json` at the new path (Claude Code migrates
+ * it back into a hashed entry on first use) and drop the stale old-path entry.
+ * On linux/win the credential is a file that moves with the dir and the store's
+ * keychain ops are no-ops, so the re-seed is a harmless same-content rewrite.
+ */
+export function renameProfile(providerId, from, to, store = credentialStore()) {
+    if (!profileExists(providerId, from))
+        throw new Error(`profile "${from}" does not exist`);
+    if (profileExists(providerId, to))
+        throw new Error(`profile "${to}" already exists`);
+    const fromConfig = configDir(providerId, from);
+    const toConfig = configDir(providerId, to);
+    // Capture the credential while the old path (and thus the darwin keychain hash)
+    // still resolves. Only Claude uses this store; codex/antigravity keep auth inside
+    // the config dir, which simply moves with the rename.
+    const cred = providerId === "claude" ? store.read(fromConfig) : null;
+    fs.renameSync(profileDir(providerId, from), profileDir(providerId, to));
+    if (cred) {
+        store.clearStale(toConfig); // a stale hashed entry at the new path would shadow the seed (darwin)
+        fs.writeFileSync(path.join(toConfig, ".credentials.json"), cred, { mode: 0o600 });
+        store.removeEntry(fromConfig); // drop the orphaned old-path keychain entry (darwin)
+    }
+    const state = readState();
+    if (state.active[providerId] === from)
+        state.active[providerId] = to;
+    const fromKey = labelKey(providerId, from);
+    const toKey = labelKey(providerId, to);
+    if (state.labels[fromKey] !== undefined) {
+        state.labels[toKey] = state.labels[fromKey];
+        delete state.labels[fromKey];
+    }
+    writeState(state);
+}
+export function readAutoSwitch(providerId) {
+    return readState().autoSwitch[providerId];
+}
+/** All providers' auto-switch configs (for `status` / the GUI tab dots). */
+export function readAutoSwitchAll() {
+    return readState().autoSwitch;
+}
+export function setAutoSwitch(providerId, cfg) {
+    const state = readState();
+    state.autoSwitch[providerId] = normalizeAutoSwitch({ ...state.autoSwitch[providerId], ...cfg });
+    writeState(state);
+    return state.autoSwitch[providerId];
+}
+// ---------- provider enable/disable (per surface) ----------
+/** Every provider's enabled surfaces (for `providers status` / the GUI tab). */
+export function readProviders() {
+    return readState().providers;
+}
+/** Is a provider enabled? With a surface, that specific surface; without, either. */
+export function providerEnabled(providerId, surface) {
+    const s = readState().providers[providerId];
+    return surface ? s[surface] : s.cli || s.ui;
+}
+/** Provider ids whose given surface is enabled (default `cli`), in canonical order. */
+export function enabledProviders(surface = "cli") {
+    const cfg = readState().providers;
+    return PROVIDER_IDS.filter((p) => cfg[p][surface]);
+}
+/** Enable/disable one surface of a provider; returns its new surface state. */
+export function setProviderSurface(providerId, surface, enabled) {
+    const state = readState();
+    state.providers[providerId] = { ...state.providers[providerId], [surface]: enabled };
+    writeState(state);
+    return state.providers[providerId];
+}
+// ---------- layout migration: v1 <ROOT>/<name> → <ROOT>/claude/<name> ----------
+/**
+ * One-time migration of v1 Claude profiles (`<ROOT>/<name>/config`) into the
+ * provider-scoped layout (`<ROOT>/claude/<name>/config`). Copy-then-verify;
+ * aborts a single profile on verify failure and keeps the original.
+ *
+ * The config-dir path change alters the macOS Keychain service hash, so the
+ * credential is read from the old location and re-seeded as a plaintext
+ * `.credentials.json` (the supported path — Claude Code re-migrates it into the
+ * new hashed entry on first use). On linux/win the credential file simply moves
+ * with the dir. Idempotent: once every legacy dir is under `<provider>/`, a
+ * re-run does nothing. Returns the names migrated.
+ */
+/**
+ * One-time marker so migration is not re-scanned on every command launch.
+ * Limitation (accepted, low-risk): a v1-layout profile that appears AFTER the
+ * marker is written (e.g. a backup restored into ROOT) is not auto-migrated —
+ * re-scanning on every launch to catch that is exactly the startup tax the
+ * marker exists to avoid. Delete `.layout-v2` to force a re-scan.
+ */
+const LAYOUT_MARKER = path.join(ROOT, ".layout-v2");
+export function migrateLegacyLayout(store = credentialStore()) {
+    if (!fs.existsSync(ROOT))
+        return [];
+    if (fs.existsSync(LAYOUT_MARKER))
+        return []; // already migrated — cheap early-out
+    const moved = [];
+    for (const entry of fs.readdirSync(ROOT, { withFileTypes: true })) {
+        if (!entry.isDirectory() || isProviderId(entry.name))
+            continue; // already provider-scoped
+        const oldProfile = path.join(ROOT, entry.name);
+        const oldConfig = path.join(oldProfile, "config");
+        if (!fs.existsSync(oldConfig))
+            continue; // not a v1 profile dir
+        const newProfile = path.join(ROOT, "claude", entry.name);
+        if (fs.existsSync(newProfile))
+            continue; // name clash → leave for the user to resolve
+        // Capture the credential BEFORE the path (and thus the hash) changes.
+        const cred = store.read(oldConfig);
+        fs.mkdirSync(path.join(ROOT, "claude"), { recursive: true, mode: 0o700 });
+        fs.cpSync(oldProfile, newProfile, { recursive: true });
+        const newConfig = path.join(newProfile, "config");
+        if (!fs.existsSync(newConfig)) {
+            fs.rmSync(newProfile, { recursive: true, force: true }); // verify failed → abort this one
+            continue;
+        }
+        // Re-seed the credential so the new-path hash resolves it (macOS); on
+        // linux/win the file was copied already. Always OVERWRITE: `cred` was read
+        // keychain-first, so it is the freshest known credential — a stale
+        // `.credentials.json` relic that `cpSync` copied must not shadow it, or the
+        // profile would migrate onto a dead token (round-2 review F2).
+        if (cred) {
+            store.clearStale(newConfig);
+            fs.writeFileSync(path.join(newConfig, ".credentials.json"), cred, { mode: 0o600 });
+        }
+        store.removeEntry(oldConfig); // drop the stale old-path keychain entry (darwin)
+        fs.rmSync(oldProfile, { recursive: true, force: true });
+        moved.push(entry.name);
+    }
+    // Drop the marker only when no legacy profile dir remains (a name clash may
+    // have left one for the user to resolve — then re-scan next time).
+    const stillLegacy = fs
+        .readdirSync(ROOT, { withFileTypes: true })
+        .some((e) => e.isDirectory() && !isProviderId(e.name) && fs.existsSync(path.join(ROOT, e.name, "config")));
+    if (!stillLegacy) {
+        try {
+            fs.writeFileSync(LAYOUT_MARKER, "2\n", { mode: 0o600 });
+        }
+        catch {
+            /* best-effort — a missing marker only costs a re-scan */
+        }
+    }
+    return moved;
+}
+export function readJson(p) {
+    try {
+        return JSON.parse(fs.readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}

package/dist/providers.js

@@ -0,0 +1,170 @@
+/**
+ * Provider abstraction — the per-CLI-assistant differences behind one interface.
+ *
+ * All three tools use the same isolation architecture (one config dir per
+ * account via an env var), but differ in:
+ *   - the env var name and what it points at (claude/codex: the dir itself;
+ *     antigravity: HOME, under which the CLI nests `.gemini/antigravity-cli`);
+ *   - where the credential/identity lives inside the config dir;
+ *   - the one-shot invocation.
+ *
+ * Contracts verified live against real installs:
+ *   claude       CLAUDE_CONFIG_DIR = dir  · Keychain (macOS)/.credentials.json · `claude -p`
+ *   codex        CODEX_HOME        = dir  · $dir/auth.json (0600)              · `codex exec`
+ *   antigravity  HOME              = home · $home/.gemini/{google_accounts,oauth_creds}.json · `agy --print`
+ *
+ * Everything is read-only + best-effort: unreadable identity returns null.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export const PROVIDER_IDS = ["claude", "codex", "antigravity"];
+export function isProviderId(s) {
+    return PROVIDER_IDS.includes(s);
+}
+function readJson(p) {
+    try {
+        return JSON.parse(fs.readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** Decode the `email` claim from a JWT id_token, best-effort. */
+function emailFromJwt(idToken) {
+    if (!idToken)
+        return null;
+    try {
+        const payload = idToken.split(".")[1];
+        if (!payload)
+            return null;
+        const json = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof json?.email === "string" ? json.email : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Extract the signed-in email from an `agy` go-keyring keychain value. go-keyring
+ * stores the token blob as `go-keyring-base64:<base64(JSON)>`; the JSON carries an
+ * OAuth `id_token` (JWT) whose `email` claim is the account. Pure + best-effort,
+ * so it is unit-testable and returns null on any shape it does not recognise.
+ */
+export function decodeGoKeyringEmail(raw) {
+    if (!raw)
+        return null;
+    try {
+        const prefix = "go-keyring-base64:";
+        const b64 = raw.startsWith(prefix) ? raw.slice(prefix.length) : raw;
+        const obj = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
+        const idToken = obj?.id_token ?? obj?.token?.id_token ?? obj?.tokens?.id_token;
+        return emailFromJwt(typeof idToken === "string" ? idToken : undefined);
+    }
+    catch {
+        return null;
+    }
+}
+const claude = {
+    id: "claude",
+    binary: "claude",
+    envVar: "CLAUDE_CONFIG_DIR",
+    configDirFor: (dir) => dir,
+    defaultConfigDir: () => path.join(os.homedir(), ".claude"),
+    credentialPath: (dir) => path.join(dir, ".credentials.json"),
+    readIdentity: (dir) => readJson(path.join(dir, ".claude.json"))?.oauthAccount?.emailAddress ?? null,
+    oneShotArgs: (prompt) => ["-p", prompt],
+    importFiles: [],
+    hasUsageReadout: true,
+};
+const codex = {
+    id: "codex",
+    binary: "codex",
+    envVar: "CODEX_HOME",
+    configDirFor: (dir) => dir,
+    defaultConfigDir: () => path.join(os.homedir(), ".codex"),
+    credentialPath: (dir) => path.join(dir, "auth.json"),
+    readIdentity: (dir) => {
+        const auth = readJson(path.join(dir, "auth.json"));
+        if (!auth)
+            return null;
+        // Prefer the id_token's email claim; fall back to the opaque account id.
+        return emailFromJwt(auth?.tokens?.id_token) ?? auth?.tokens?.account_id ?? null;
+    },
+    oneShotArgs: (prompt) => ["exec", prompt],
+    importFiles: ["auth.json"],
+    hasUsageReadout: true, // live via wham/usage (ChatGPT backend)
+};
+const antigravity = {
+    id: "antigravity",
+    binary: "agy",
+    // HOME is the isolation lever: agy keeps its config under $HOME/.gemini/ AND
+    // stores its OAuth token in the macOS keychain via go-keyring (fixed key
+    // service "gemini"/account "antigravity"). Because the keychain default +
+    // search list are HOME-scoped, pointing HOME at a per-profile dir — plus
+    // seeding a keychain there (see agy-keychain.ts) — isolates the token per
+    // account with no global keychain mutation.
+    envVar: "HOME",
+    // The exported dir IS the HOME; identity/keychain ops run `security` under it.
+    configDirFor: (dir) => dir,
+    defaultConfigDir: () => os.homedir(),
+    // The per-profile keychain file that holds agy's token (under the profile HOME).
+    credentialPath: (dir) => path.join(dir, "Library", "Keychains", "login.keychain-db"),
+    // Account identity: agy's token lives in the profile keychain; read it via
+    // `security` under this HOME and decode the email from its id_token.
+    readIdentity: (home) => {
+        if (process.platform !== "darwin")
+            return null;
+        const r = spawnSync("security", ["find-generic-password", "-s", "gemini", "-wa", "antigravity"], {
+            // Pin CFFIXED_USER_HOME with HOME so CoreFoundation reads the profile's
+            // keychain, not an ambient home (see agy-keychain.ts for the rationale).
+            env: { ...process.env, HOME: home, CFFIXED_USER_HOME: home },
+            encoding: "utf8",
+            timeout: 10000,
+        });
+        return decodeGoKeyringEmail(r.stdout?.trim() || null);
+    },
+    oneShotArgs: (prompt) => ["--print", prompt],
+    importFiles: [],
+    hasUsageReadout: false,
+};
+const PROVIDERS = { claude, codex, antigravity };
+export function provider(id) {
+    return PROVIDERS[id];
+}
+export function allProviders() {
+    return PROVIDER_IDS.map((id) => PROVIDERS[id]);
+}
+/** Where an installer may drop a binary off the default PATH. Some CLIs (e.g.
+ *  agy, installed via `curl … | bash`) land in ~/.local/bin, which a GUI app's
+ *  minimal PATH frequently omits. */
+function localBinary(binary) {
+    return path.join(os.homedir(), ".local", "bin", binary);
+}
+/**
+ * Resolve a CLI binary to an invocable command: its bare name when it is on
+ * PATH, otherwise its ~/.local/bin path when the binary lives there (GUI apps
+ * often run with a minimal PATH that omits it), otherwise the bare name so the
+ * caller surfaces a clean "not found" error.
+ */
+export function resolveBinary(binary) {
+    const probe = spawnSync(binary, ["--version"], { stdio: "ignore", timeout: 5000 });
+    if (probe.error?.code !== "ENOENT")
+        return binary;
+    const local = localBinary(binary);
+    return fs.existsSync(local) ? local : binary;
+}
+/**
+ * Best-effort: is this provider's CLI binary installed? Probes `<binary>
+ * --version` on PATH and treats only ENOENT as not-installed (a non-zero exit or
+ * a timeout still means the binary exists), then falls back to the ~/.local/bin
+ * install location. Used to gate enabling a provider the user hasn't installed.
+ */
+export function isProviderInstalled(id) {
+    const bin = PROVIDERS[id].binary;
+    const probe = spawnSync(bin, ["--version"], { stdio: "ignore", timeout: 5000 });
+    if (probe.error?.code !== "ENOENT")
+        return true;
+    return fs.existsSync(localBinary(bin));
+}