@event4u/agent-switch 2.0.0 → 2.2.0

package/dist/rebind.js

@@ -13,9 +13,10 @@
  *
  * Move-semantics + safety: the target account's credential is moved INTO the
  * running profile's store and the target's own store is emptied, so the family
- * is live in exactly one store. Both original credentials are stashed in a
- * per-profile binding-marker BEFORE any mutation, so `--restore` fully reverses
- * it and a crash leaves a recoverable marker. Nothing is deleted without a stash.
+ * is live in exactly one store. Both original credentials are stashed in the
+ * Keychain BEFORE any mutation and a per-profile binding-marker names those
+ * entries (never the tokens), so `--restore` fully reverses it and a crash
+ * leaves a recoverable marker. Nothing is deleted without a stash.
  *
  * Deferred to later Phase-2 slices (see road-to-live-rebind.md), not built here:
  * live pid/process auto-detection, a global cross-profile binding registry +
@@ -365,15 +366,30 @@ export function readBinding(cfgDir, d = defaultDeps()) {
         return null;
     try {
         const m = JSON.parse(raw);
-        if (m && typeof m.boundToProfile === "string" && typeof m.runningOwnCredential === "string" && typeof m.targetOrigCredential === "string") {
+        if (!m || typeof m.boundToProfile !== "string")
+            return null;
+        const stashed = typeof m.runningOwnStash === "string" && typeof m.targetOrigStash === "string";
+        const legacy = typeof m.runningOwnCredential === "string" && typeof m.targetOrigCredential === "string";
+        if (stashed || legacy)
             return m;
-        }
     }
     catch {
         /* corrupt marker → treat as none */
     }
     return null;
 }
+/** Keychain services that hold a binding's originals while the rebind is live. */
+function stashServices(pConfig, d) {
+    const base = d.serviceNameFor(pConfig);
+    return { own: `${base}-agent-switch-rebind-own`, target: `${base}-agent-switch-rebind-target` };
+}
+/** The two original credentials a binding needs for restore — from the Keychain
+ *  stash, or inline for a marker written before D16. Null when unreadable. */
+export function bindingCredentials(m, d = defaultDeps()) {
+    const runningOwn = m.runningOwnStash ? d.kcGet(m.runningOwnStash) : (m.runningOwnCredential ?? null);
+    const targetOrig = m.targetOrigStash ? d.kcGet(m.targetOrigStash) : (m.targetOrigCredential ?? null);
+    return runningOwn && targetOrig ? { runningOwn, targetOrig } : null;
+}
 export class RebindError extends Error {
 }
 /**
@@ -615,12 +631,21 @@ async function performRebind(opts, d) {
             // All guards passed — commit the global binding record.
             reg[account] = { runningProfile: profile, boundAt: new Date(d.now()).toISOString() };
             writeRegistry(reg, d);
-            // 1. Recovery point BEFORE any store mutation: stash both originals.
+            // 1. Recovery point BEFORE any store mutation: stash both originals in the
+            //    Keychain (never in the marker file), then point the marker at them.
+            const stash = stashServices(pConfig, d);
+            if (!d.kcAdd(stash.own, pCred) || !d.kcAdd(stash.target, credToMove)) {
+                d.kcDelete(stash.own);
+                d.kcDelete(stash.target);
+                delete reg[account];
+                writeRegistry(reg, d);
+                throw new RebindError(`could not stash the original credentials in the Keychain — no swap performed.`);
+            }
             const marker = {
                 boundToProfile: account,
                 boundAt: new Date(d.now()).toISOString(),
-                runningOwnCredential: pCred,
-                targetOrigCredential: credToMove,
+                runningOwnStash: stash.own,
+                targetOrigStash: stash.target,
                 targetFileMoved: false,
                 // Snapshot the running profile's OWN identity stamp before the swap: from
                 // here on Claude Code will overwrite it with the borrowed account's.
@@ -648,6 +673,57 @@ async function performRebind(opts, d) {
             `Restore with: agent-switch rebind --restore --profile ${profile}`,
     };
 }
+/**
+ * Drop an active rebind on `profile` WITHOUT restoring it — the `remove --force`
+ * path, where the running profile is about to be deleted. Deletes both Keychain
+ * stash entries (they would otherwise outlive the profile), releases the
+ * registry entry and the marker, and hands the borrowed account back to its own
+ * profile: the stashed original goes back into that store only while it is
+ * empty (a store that holds a login again is never overwritten), and a lent
+ * plaintext file is returned. Returns false when there was no rebind.
+ */
+export function discardBinding(profile, d = defaultDeps()) {
+    const pConfig = configDir("claude", profile);
+    const marker = readBinding(pConfig, d);
+    if (!marker)
+        return false;
+    const originals = bindingCredentials(marker, d);
+    const aConfig = configDir("claude", marker.boundToProfile);
+    const aSvc = d.serviceNameFor(aConfig);
+    if (originals && d.kcGet(aSvc) === null)
+        d.kcAdd(aSvc, originals.targetOrig);
+    const aFile = credFile(aConfig);
+    if (marker.targetFileMoved && d.exists(aFile + LENT_SUFFIX) && !d.exists(aFile))
+        d.renameFile(aFile + LENT_SUFFIX, aFile);
+    const stash = stashServices(pConfig, d);
+    d.kcDelete(marker.runningOwnStash ?? stash.own);
+    d.kcDelete(marker.targetOrigStash ?? stash.target);
+    const reg = readRegistry(d);
+    if (reg[marker.boundToProfile]?.runningProfile === profile) {
+        delete reg[marker.boundToProfile];
+        writeRegistry(reg, d);
+    }
+    d.removeFile(markerFile(pConfig));
+    return true;
+}
+/** The profile currently serving `account`'s login through a rebind, or null. */
+export function borrowerOf(account, d = defaultDeps()) {
+    return readRegistry(d)[account]?.runningProfile ?? null;
+}
+/**
+ * Before `account`'s profile is deleted (`remove --force`): put the profile
+ * borrowing it back on its own login through the normal restore path, so both
+ * stores stay consistent and the stash is cleared. Restore's provenance checks
+ * still apply — a refusal propagates and nothing is released. Returns the
+ * borrower that was restored, or null when nothing borrowed the account.
+ */
+export async function releaseBorrowedAccount(account, d = defaultDeps()) {
+    const holder = borrowerOf(account, d);
+    if (!holder)
+        return null;
+    await restoreRebind({ profile: holder }, d);
+    return holder;
+}
 /** Reverse an active rebind on `profile`: restore both profiles' own credentials. */
 export async function restoreRebind(opts, d = defaultDeps()) {
     const { profile } = opts;
@@ -658,6 +734,11 @@ export async function restoreRebind(opts, d = defaultDeps()) {
     const marker = readBinding(pConfig, d);
     if (!marker)
         throw new RebindRefused(`no active rebind on profile "${profile}".`);
+    const originals = bindingCredentials(marker, d);
+    if (!originals) {
+        throw new RebindRefused(`the stashed credentials for profile "${profile}"'s rebind are not readable — refusing restore (no mutation). ` +
+            `The binding marker is left in place for manual recovery.`);
+    }
     const aConfig = configDir("claude", marker.boundToProfile);
     const pSvc = d.serviceNameFor(pConfig);
     const aSvc = d.serviceNameFor(aConfig);
@@ -672,7 +753,7 @@ export async function restoreRebind(opts, d = defaultDeps()) {
             // account we bound INTO it. If someone re-logged the running profile, its
             // store now holds a DIFFERENT account — never clobber that fresh login.
             const liveRunning = readCred(pConfig, d);
-            const branch = await compareAccounts(marker.targetOrigCredential, liveRunning, d);
+            const branch = await compareAccounts(originals.targetOrig, liveRunning, d);
             if (branch === "unparseable") {
                 throw new RebindRefused(`running profile "${profile}"'s live credential is missing or unparseable — refusing restore (no mutation). ` +
                     `The binding marker is left in place for manual recovery.`);
@@ -691,11 +772,23 @@ export async function restoreRebind(opts, d = defaultDeps()) {
             }
             // "same" / "rotated" → the bound account is still there → restore normally.
             // Restore the running profile to its own account.
-            d.kcAdd(pSvc, marker.runningOwnCredential);
+            if (!d.kcAdd(pSvc, originals.runningOwn)) {
+                throw new RebindError(`could not write profile "${profile}"'s own credential back to the Keychain — restore aborted. ` +
+                    `Nothing was changed; the marker and the stashed credentials are kept — retry the restore.`);
+            }
             // Restore the target profile's own store. On "rotated" the live credential
             // is the same account with a FRESHER (rotated) refresh token — hand that
             // back instead of the stale stash, or the target profile logs out.
-            d.kcAdd(aSvc, branch === "rotated" ? liveRunning : marker.targetOrigCredential);
+            if (!d.kcAdd(aSvc, branch === "rotated" ? liveRunning : originals.targetOrig)) {
+                // Put the running store back on the bound account, so the provenance
+                // check of a retry still sees the account it was rebound to (otherwise
+                // the retry would read its own credential as a foreign re-login).
+                const rolledBack = d.kcAdd(pSvc, liveRunning);
+                throw new RebindError(`could not write "${marker.boundToProfile}"'s credential back to the Keychain — restore aborted. ` +
+                    (rolledBack
+                        ? `Profile "${profile}" still serves "${marker.boundToProfile}"; the marker and the stashed credentials are kept — retry the restore.`
+                        : `Profile "${profile}" could not be rolled back either; the marker and the stashed credentials are kept for manual recovery.`));
+            }
             if (marker.targetFileMoved && d.exists(aFile + LENT_SUFFIX)) {
                 d.renameFile(aFile + LENT_SUFFIX, aFile);
             }
@@ -703,6 +796,10 @@ export async function restoreRebind(opts, d = defaultDeps()) {
             // Claude Code stamped into its `.claude.json` while it served the other account.
             await restoreStampedIdentity(pConfig, marker.runningOwnIdentity, d);
             d.removeFile(markerFile(pConfig));
+            if (marker.runningOwnStash)
+                d.kcDelete(marker.runningOwnStash);
+            if (marker.targetOrigStash)
+                d.kcDelete(marker.targetOrigStash);
             // Release the global binding-registry entry for the bound account.
             const reg = readRegistry(d);
             if (reg[marker.boundToProfile]) {

package/dist/release-notes.js

@@ -0,0 +1,154 @@
+/**
+ * Release-note normalisation — turn a GitHub release body into something a
+ * card or a terminal can show without it reading as broken.
+ *
+ * Mirrored in `gui/src/release-notes.ts` (same boundary reason as updates.ts:
+ * the GUI's tsconfig only includes `gui/src`, so pure helpers are duplicated
+ * rather than imported across it). `tests/release-notes.test.ts` byte-compares
+ * the two below their header comment, so a fix applied to one and not the other
+ * fails there — and it asserts against the real captured body
+ * (`tests/fixtures/agent-config-release-14.2.0.md`), which the GUI mirror's own
+ * suite cannot read: that project ships no `@types/node` on purpose.
+ *
+ * Why a normaliser and not `body.slice(0, 500)`: measured on agent-config
+ * 14.2.0, the first 500 characters are a heading, an HTML comment addressed to
+ * the release author, and five `_none_` placeholders. The shapes handled here
+ * are the ones that release template actually emits — headings, `*` items with
+ * a `**scope:**` prefix, `([sha](commit-url))` suffixes, `**bold**` / `_italic_`
+ * and horizontal rules. Everything is pure; no I/O, no markdown dependency.
+ */
+/** Drop HTML comments, including multi-line ones. This is what removes the
+ *  release template's author-facing instruction line ("fill before merge …") —
+ *  a comment is invisible on GitHub and must stay invisible here. */
+export function stripHtmlComments(md) {
+    return String(md).replace(/<!--[\s\S]*?-->/g, "");
+}
+/** Inline cleanup applied to every line's text: commit-link suffixes go, real
+ *  links collapse to their label, bold/italic markers are unwrapped, and runs
+ *  of whitespace collapse. Inline code keeps its backticks on purpose — they
+ *  mark a literal name, which is information, not noise. Pure. */
+export function normalizeInline(s) {
+    return String(s)
+        // ` ([abc1234](https://…/commit/abc…))` — the generated changelog's sha
+        // suffix. Removed before generic link handling, which would otherwise
+        // leave a bare `(abc1234)` behind.
+        .replace(/\s*\(\[[0-9a-f]{7,40}\]\([^)\s]*\)\)/gi, "")
+        // `[label](url)` → `label`
+        .replace(/\[([^\]]*)\]\([^)\s]*\)/g, "$1")
+        // `**bold**` / `__bold__` → bold
+        .replace(/\*\*([^*]+)\*\*/g, "$1")
+        .replace(/__([^_]+)__/g, "$1")
+        // `_italic_` → italic (this is what turns `_none_` into `none`).
+        // Underscore-delimited only at word boundaries so `snake_case_names` and
+        // `file_name.ts` survive untouched.
+        .replace(/(^|[\s(])_([^_]+)_(?=[\s).,;:!?]|$)/g, "$1$2")
+        .replace(/[ \t]{2,}/g, " ")
+        .trim();
+}
+/** True for a markdown horizontal rule (`---`, `***`, `___`). */
+function isHorizontalRule(line) {
+    return /^\s*([-*_])\s*(\1\s*){2,}$/.test(line);
+}
+/**
+ * Parse a release body into ordered blocks. Blank lines carry no block — the
+ * renderers space by `kind` instead, so a body with erratic blank runs comes
+ * out evenly spaced. An empty or comment-only body yields `[]`, which every
+ * caller must treat as "no notes" (render nothing — never a placeholder).
+ */
+export function releaseNoteBlocks(md) {
+    const blocks = [];
+    for (const raw of stripHtmlComments(md).split(/\r?\n/)) {
+        if (!raw.trim() || isHorizontalRule(raw))
+            continue;
+        const heading = /^\s*#{1,6}\s+(.*)$/.exec(raw);
+        if (heading) {
+            const text = normalizeInline(heading[1]);
+            if (text)
+                blocks.push({ kind: "heading", text });
+            continue;
+        }
+        const item = /^\s*[-*+]\s+(.*)$/.exec(raw);
+        if (item) {
+            const text = normalizeInline(item[1]);
+            if (text)
+                blocks.push({ kind: "item", text });
+            continue;
+        }
+        const text = normalizeInline(raw);
+        if (text)
+            blocks.push({ kind: "text", text });
+    }
+    return blocks;
+}
+/** A `_none_`-style empty value — the release template's way of saying "this
+ *  section genuinely has nothing", which must not be offered as a highlight. */
+function isEmptyValue(value) {
+    return /^(none|n\/a|-|—)$/i.test(value.trim());
+}
+/**
+ * The one line worth putting in a notification: the first non-empty bullet
+ * under a "highlights"-ish heading, else the first bullet in the body. Returns
+ * null when the body carries no bullet with content — callers then say nothing
+ * rather than inventing a summary. Pure.
+ */
+export function firstHighlight(blocks) {
+    const start = blocks.findIndex((b) => b.kind === "heading" && /highlight/i.test(b.text));
+    const scan = (from, stopAtHeading) => {
+        for (let i = from; i < blocks.length; i++) {
+            const b = blocks[i];
+            if (b.kind === "heading" && stopAtHeading && i > from)
+                return null;
+            if (b.kind !== "item")
+                continue;
+            // `Behaviour changes: none` → value `none`; a bullet with no colon is
+            // its own value.
+            const colon = b.text.indexOf(":");
+            const value = colon >= 0 ? b.text.slice(colon + 1) : b.text;
+            if (!isEmptyValue(value))
+                return b.text;
+        }
+        return null;
+    };
+    return start >= 0 ? (scan(start + 1, true) ?? scan(0, false)) : scan(0, false);
+}
+/**
+ * Render blocks as terminal lines: a blank line before each heading (never as
+ * the first line), items bulleted, text as-is. `omitted` is how many lines the
+ * cap dropped, so the caller can print an honest "… N more" plus the release
+ * URL instead of silently truncating. Pure.
+ */
+export function releaseNotesText(blocks, opts = {}) {
+    const bullet = opts.bullet ?? "•";
+    const indent = opts.indent ?? "";
+    const all = [];
+    for (const b of blocks) {
+        if (b.kind === "heading") {
+            if (all.length)
+                all.push("");
+            all.push(`${indent}${b.text}`);
+        }
+        else if (b.kind === "item") {
+            all.push(`${indent}  ${bullet} ${b.text}`);
+        }
+        else {
+            all.push(`${indent}  ${b.text}`);
+        }
+    }
+    const max = opts.maxLines;
+    if (max === undefined || all.length <= max)
+        return { lines: all, omitted: 0 };
+    return { lines: all.slice(0, max), omitted: all.length - max };
+}
+/** Clamp to `max` characters on a word boundary, appending an ellipsis when
+ *  anything was cut. Used for the one-line notification summary, where a raw
+ *  bullet can run to several hundred characters. Pure. */
+export function clampText(s, max) {
+    const t = String(s).trim();
+    if (t.length <= max)
+        return t;
+    const cut = t.slice(0, max);
+    const space = cut.lastIndexOf(" ");
+    // Prefer the word boundary, but only when it still keeps at least half the
+    // budget — otherwise a long first word would collapse the summary to nothing.
+    return `${(space > max * 0.5 ? cut.slice(0, space) : cut).replace(/[\s,;:.\-]+$/, "")}…`;
+}

package/dist/service.js

@@ -68,21 +68,36 @@ export function schtasksCreateArgs(exec, args, label = LABEL) {
     return ["/create", "/tn", label, "/tr", cmd, "/sc", "onlogon", "/f"];
 }
 // ---------- manifest ----------
-function readManifest() {
+function readManifestRaw() {
     try {
         const d = JSON.parse(fs.readFileSync(MANIFEST, "utf8"));
-        return Array.isArray(d?.files) ? d.files : [];
+        const inv = d?.invocation;
+        const invocation = inv && typeof inv.exec === "string" && Array.isArray(inv.args) ? { exec: inv.exec, args: inv.args.map(String) } : null;
+        return { files: Array.isArray(d?.files) ? d.files : [], invocation };
     }
     catch {
-        return [];
+        return { files: [], invocation: null };
     }
 }
+function readManifest() {
+    return readManifestRaw().files;
+}
 function writeManifest(files) {
     fs.mkdirSync(ROOT, { recursive: true });
-    fs.writeFileSync(MANIFEST, JSON.stringify({ label: LABEL, files }, null, 2) + "\n", { mode: 0o600 });
+    // The invocation is what `activate` compares against to re-point the service.
+    fs.writeFileSync(MANIFEST, JSON.stringify({ label: LABEL, files, invocation: runInvocation() }, null, 2) + "\n", { mode: 0o600 });
+}
+/** Whether the installed service runs this very CLI. An install from before the
+ *  manifest recorded its invocation counts as another one. */
+export function serviceTarget() {
+    const m = readManifestRaw();
+    if (!m.files.length)
+        return "not-installed";
+    const me = runInvocation();
+    return m.invocation && m.invocation.exec === me.exec && m.invocation.args.join("\0") === me.args.join("\0") ? "this-cli" : "other-cli";
 }
 // ---------- install / uninstall ----------
-export function serviceInstall() {
+export function serviceInstall(log = console.log) {
     const { exec, args } = runInvocation();
     fs.mkdirSync(ROOT, { recursive: true });
     if (process.platform === "darwin") {
@@ -94,7 +109,7 @@ export function serviceInstall() {
         if (r.status !== 0)
             die(`launchctl load failed: ${r.stderr || r.stdout}`);
         writeManifest([plist]);
-        console.log(`Installed LaunchAgent ${plist} (loaded).`);
+        log(`Installed LaunchAgent ${plist} (loaded).`);
     }
     else if (process.platform === "linux") {
         const unit = path.join(os.homedir(), ".config", "systemd", "user", "agent-switch.service");
@@ -103,16 +118,16 @@ export function serviceInstall() {
         spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
         const r = spawnSync("systemctl", ["--user", "enable", "--now", "agent-switch.service"], { encoding: "utf8" });
         if (r.status !== 0)
-            console.log(`(note: \`systemctl --user enable --now\` returned nonzero — unit written to ${unit}; enable manually if needed)`);
+            log(`(note: \`systemctl --user enable --now\` returned nonzero — unit written to ${unit}; enable manually if needed)`);
         writeManifest([unit]);
-        console.log(`Installed systemd user unit ${unit}.`);
+        log(`Installed systemd user unit ${unit}.`);
     }
     else if (process.platform === "win32") {
         const r = spawnSync("schtasks", schtasksCreateArgs(exec, args), { encoding: "utf8" });
         if (r.status !== 0)
             die(`schtasks /create failed: ${r.stderr || r.stdout}`);
         writeManifest([`schtasks:${LABEL}`]); // a task, not a file
-        console.log(`Installed Task Scheduler logon task ${LABEL}.`);
+        log(`Installed Task Scheduler logon task ${LABEL}.`);
     }
     else {
         die(`service install is not supported on ${process.platform}`);

package/dist/sessions.js

@@ -10,7 +10,7 @@
  *
  * Iron rules (roadmap: road-to-session-handoff):
  *   - Transcripts are OPAQUE, version-unstable blobs FOR TRANSFER. The only
- *     read in THIS module is `readSessionHeader` — first line, capped,
+ *     read in THIS module is `readSessionHeader` — first 64 KiB, capped,
  *     try/catch. There are exactly TWO sanctioned body readers, both guarded +
  *     capped + fenced + degraded-mode, and NO others: read-only TELEMETRY
  *     (context/token counts, `src/telemetry.ts`, road-to-agent-switch-session-
@@ -33,9 +33,9 @@ import { liveSessionPids } from "./api.js";
 export function encodeProjectDir(cwd) {
     return cwd.replace(/[^A-Za-z0-9]/g, "-");
 }
-/** Best-effort metadata from a transcript's FIRST line only. The line is
- *  capped (a >64 KiB first line counts as unparseable), the parse is fenced,
- *  and absence degrades to nulls — the format is internal and version-unstable,
+/** Best-effort metadata (cwd, summary) from the complete lines in a
+ *  transcript's first 64 KiB. Each parse is fenced, a line cut by the cap is
+ *  ignored, and absence degrades to nulls — the format is internal and version-unstable,
  *  so a failed parse must never fail a listing. */
 const HEADER_CAP = 64 * 1024;
 export function readSessionHeader(file) {
@@ -51,15 +51,30 @@ export function readSessionHeader(file) {
         const buf = Buffer.alloc(HEADER_CAP);
         const n = fs.readSync(fd, buf, 0, HEADER_CAP, 0);
         const chunk = buf.subarray(0, n).toString("utf8");
-        const nl = chunk.indexOf("\n");
-        if (nl < 0 && n === HEADER_CAP)
-            return none; // first line larger than the cap
-        const line = nl >= 0 ? chunk.slice(0, nl) : chunk;
-        const parsed = JSON.parse(line);
-        return {
-            cwd: typeof parsed?.cwd === "string" ? parsed.cwd : null,
-            summary: typeof parsed?.summary === "string" ? parsed.summary : null,
-        };
+        // Claude Code 2.1.x opens with metadata lines that carry no cwd, so scan the
+        // complete lines inside the cap. A trailing partial line (cut by the cap) is
+        // dropped rather than guessed at.
+        const lines = chunk.split("\n");
+        if (n === HEADER_CAP)
+            lines.pop();
+        let cwd = null;
+        let summary = null;
+        for (const line of lines) {
+            if (cwd !== null && summary !== null)
+                break;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (cwd === null && typeof parsed?.cwd === "string")
+                cwd = parsed.cwd;
+            if (summary === null && typeof parsed?.summary === "string")
+                summary = parsed.summary;
+        }
+        return { cwd, summary };
     }
     catch {
         return none;
@@ -68,6 +83,60 @@ export function readSessionHeader(file) {
         fs.closeSync(fd);
     }
 }
+/** Tools that always stop for the user's answer. Other tools can't be told
+ *  apart from one that is still running. */
+const QUESTION_TOOLS = new Set(["AskUserQuestion", "ExitPlanMode"]);
+const TAIL_CAP = 64 * 1024;
+/** Whether the transcript ends on an open question to the user. */
+export function awaitingAnswer(file) {
+    return openQuestion(file) !== null;
+}
+/**
+ * The id of the question the transcript ends on — an AskUserQuestion /
+ * ExitPlanMode call with no tool_result after it — or null. The id tells one
+ * question from the next, so two in a row are two moments. Reads only the
+ * last {@link TAIL_CAP} bytes.
+ */
+export function openQuestion(file) {
+    let text;
+    try {
+        const fd = fs.openSync(file, "r");
+        try {
+            const size = fs.fstatSync(fd).size;
+            const len = Math.min(size, TAIL_CAP);
+            const buf = Buffer.alloc(len);
+            fs.readSync(fd, buf, 0, len, size - len);
+            text = buf.toString("utf8");
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return null;
+    }
+    const open = new Set();
+    // The first line may be cut off by the tail window; it fails to parse and is skipped.
+    for (const line of text.split("\n")) {
+        let d;
+        try {
+            d = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const content = d?.message?.content;
+        if (!Array.isArray(content))
+            continue;
+        for (const p of content) {
+            if (p?.type === "tool_use" && p.id && p.name && QUESTION_TOOLS.has(p.name))
+                open.add(p.id);
+            else if (p?.type === "tool_result" && p.tool_use_id)
+                open.delete(p.tool_use_id);
+        }
+    }
+    return open.size ? [...open][open.size - 1] : null;
+}
 /** Recent sessions of one profile config dir, newest first, capped at `limit`.
  *  Pure directory scan — works on seeded fakes, shared trees, and win32. */
 export function listSessions(configDir, limit) {
@@ -174,6 +243,25 @@ export function markLive(configDir, rows, cwdOf = pidCwd) {
             row.live = true;
     }
 }
+/**
+ * Auto-detect which Claude profile has a live session, for `rebind`'s
+ * no-`--profile` resolution. A profile is "running" when its config dir carries
+ * a live session pid (`<configDir>/sessions/<pid>.json` whose pid is alive).
+ *
+ * Returns `single` ONLY when exactly one profile is running — rebind writes a
+ * credential store, so the caller must never guess a target across ambiguity;
+ * `none` / `ambiguous` leave the caller on its explicit-`--profile` / active
+ * fallback. Pure (`livePidsOf` injected) so every branch is unit-tested without
+ * touching real processes.
+ */
+export function detectRunningClaudeProfile(profiles, configDirOf, livePidsOf = liveSessionPids) {
+    const running = profiles.filter((p) => livePidsOf(configDirOf(p)).length > 0);
+    if (running.length === 1)
+        return { kind: "single", profile: running[0] };
+    if (running.length > 1)
+        return { kind: "ambiguous", profiles: running };
+    return { kind: "none" };
+}
 /** Where a session id lives inside ONE profile config dir, or null. */
 export function locateSession(configDir, sessionId) {
     const projects = path.join(configDir, "projects");