@event4u/agent-switch 2.1.0 → 2.3.0

package/dist/profiles.js

@@ -1,10 +1,11 @@
 /** Profile roots, per-provider state, layout migration, and shared helpers. */
+import { withFileLockSync } from "./locks.js";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { PROVIDER_IDS, provider, isProviderId } from "./providers.js";
 import { credentialStore } from "./credentials.js";
-import { DEFAULT_GUARD_POLICY, isGuardPolicy } from "./single-load.js";
+import { DEFAULT_GUARD_POLICY, FRESH_INSTALL_GUARD_POLICY, isGuardPolicy } from "./single-load.js";
 export const HOME = os.homedir();
 export const ROOT = process.env.AGENT_SWITCH_HOME ?? path.join(HOME, ".agent-switch");
 export const STATE_FILE = path.join(ROOT, "state.json");
@@ -13,6 +14,11 @@ export const PROFILE_LABELS = ["Work", "Personal", "Other"];
 export function isProfileLabel(v) {
     return typeof v === "string" && PROFILE_LABELS.includes(v);
 }
+/** The account colours the GUI offers (its swatches use the same names). */
+export const PROFILE_COLORS = ["orange", "red", "yellow", "green", "teal", "blue", "purple", "pink"];
+export function isProfileColor(v) {
+    return typeof v === "string" && PROFILE_COLORS.includes(v);
+}
 export const DEFAULT_AUTOSWITCH = { enabled: false, threshold: 95, tag: "all" };
 /**
  * Providers enabled out of the box. Everything else is available but off by
@@ -33,7 +39,13 @@ export function die(msg) {
     process.exit(1);
 }
 export function ensureRoot() {
+    // A fresh install pins its fresh-install defaults (guard: warn) on the first
+    // write, so the first profile it gets cannot flip it into looking like an
+    // upgraded 2.1.0 install (profiles, no state.json → block).
+    const fresh = !fs.existsSync(STATE_FILE) && listAllProfiles().length === 0;
     fs.mkdirSync(ROOT, { recursive: true, mode: 0o700 });
+    if (fresh)
+        fs.writeFileSync(STATE_FILE, JSON.stringify(readState(), null, 2) + "\n", { mode: 0o600 });
 }
 function validateName(name) {
     if (!/^[A-Za-z0-9_-]+$/.test(name))
@@ -59,6 +71,20 @@ export function configDir(providerId, name) {
 export function browserDir(providerId, name) {
     return path.join(profileDir(providerId, name), "browser");
 }
+/** Present in a profile dir when `import` seeded it with the default install's
+ *  credential: both now share one OAuth lineage, and whichever side refreshes
+ *  first signs the other out. Holds a date only, never a credential. */
+export const SHARED_LOGIN_MARKER = "shares-default-login";
+export function sharesDefaultLogin(providerId, name) {
+    return fs.existsSync(path.join(profileDir(providerId, name), SHARED_LOGIN_MARKER));
+}
+export function setSharesDefaultLogin(providerId, name, on) {
+    const file = path.join(profileDir(providerId, name), SHARED_LOGIN_MARKER);
+    if (!on)
+        return void fs.rmSync(file, { force: true });
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `imported ${new Date().toISOString()}\n`, { mode: 0o600 });
+}
 export function profileExists(providerId, name) {
     return fs.existsSync(configDir(providerId, name));
 }
@@ -102,6 +128,16 @@ function normalizeLabels(raw) {
     }
     return out;
 }
+function normalizeColors(raw) {
+    const out = {};
+    if (raw && typeof raw === "object") {
+        for (const [k, v] of Object.entries(raw)) {
+            if (isProfileColor(v))
+                out[k] = v;
+        }
+    }
+    return out;
+}
 function normalizeAutoSwitch(raw) {
     const r = (raw ?? {});
     const threshold = typeof r.threshold === "number" && r.threshold >= 1 && r.threshold <= 100 ? Math.round(r.threshold) : DEFAULT_AUTOSWITCH.threshold;
@@ -168,6 +204,8 @@ export function readState() {
     try {
         const raw = JSON.parse(fs.readFileSync(STATE_FILE, "utf8"));
         const labels = normalizeLabels(raw?.labels);
+        const colors = normalizeColors(raw?.colors);
+        const disabled = Array.isArray(raw?.disabled) ? raw.disabled.filter((k) => typeof k === "string") : [];
         const autoSwitch = normalizeAutoSwitchMap(raw?.autoSwitch);
         const providers = normalizeProvidersMap(raw?.providers);
         const binaryPaths = normalizeBinaryPaths(raw?.binaryPaths);
@@ -176,25 +214,31 @@ export function readState() {
         const guard = normalizeGuard(raw?.guard);
         // v1: { active: "<name>" } — a single Claude profile.
         if (typeof raw?.active === "string") {
-            return { active: { ...emptyActive(), claude: raw.active }, labels, autoSwitch, providers, binaryPaths, osNotifications, rebind, guard };
+            return { active: { ...emptyActive(), claude: raw.active }, labels, colors, disabled, autoSwitch, providers, binaryPaths, osNotifications, rebind, guard };
         }
         if (raw?.active && typeof raw.active === "object") {
-            return { active: { ...emptyActive(), ...raw.active }, labels, autoSwitch, providers, binaryPaths, osNotifications, rebind, guard };
+            return { active: { ...emptyActive(), ...raw.active }, labels, colors, disabled, autoSwitch, providers, binaryPaths, osNotifications, rebind, guard };
         }
-        return { active: emptyActive(), labels, autoSwitch, providers, binaryPaths, osNotifications, rebind, guard };
+        return { active: emptyActive(), labels, colors, disabled, autoSwitch, providers, binaryPaths, osNotifications, rebind, guard };
     }
     catch {
         /* absent / unparsable → default */
     }
-    return { active: emptyActive(), labels: {}, autoSwitch: emptyAutoSwitch(), providers: emptyProviders(), binaryPaths: {}, osNotifications: false, rebind: { ...DEFAULT_REBIND_STATE }, guard: DEFAULT_GUARD_POLICY };
+    // Fresh = nothing at all yet. `add` without `use` writes no state.json, so a
+    // 2.1.0 install can have profiles and no state file — that user must keep the
+    // pre-2.2 default (block), not be treated as new.
+    const fresh = !fs.existsSync(STATE_FILE) && listAllProfiles().length === 0;
+    return { active: emptyActive(), labels: {}, colors: {}, disabled: [], autoSwitch: emptyAutoSwitch(), providers: emptyProviders(), binaryPaths: {}, osNotifications: false, rebind: { ...DEFAULT_REBIND_STATE }, guard: fresh ? FRESH_INSTALL_GUARD_POLICY : DEFAULT_GUARD_POLICY };
 }
 export function readOsNotifications() {
     return readState().osNotifications;
 }
 export function setOsNotifications(on) {
-    const state = readState();
-    state.osNotifications = on;
-    writeState(state);
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        state.osNotifications = on;
+        writeState(state);
+    });
 }
 // ---------- single-load guard policy ----------
 /** How the single-load guard reacts to a second load of one profile. */
@@ -203,9 +247,11 @@ export function readGuard() {
 }
 /** Persist the guard policy. */
 export function setGuard(policy) {
-    const state = readState();
-    state.guard = policy;
-    writeState(state);
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        state.guard = policy;
+        writeState(state);
+    });
 }
 // ---------- rebind kill-switch / circuit-breaker (ADR-003) ----------
 /** Current rollback/circuit-breaker state for the `rebind` write path. */
@@ -214,42 +260,97 @@ export function readRebindKillSwitch() {
 }
 /** Persist the rebind kill-switch state (breaker counter + disabled flag). */
 export function writeRebindKillSwitch(next) {
-    const state = readState();
-    state.rebind = normalizeRebindState(next);
-    writeState(state);
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        state.rebind = normalizeRebindState(next);
+        writeState(state);
+    });
 }
 /** Re-enable `rebind`: clear `disabled` + reset the failure counter (`--reset`). */
 export function resetRebindKillSwitch() {
     writeRebindKillSwitch({ ...DEFAULT_REBIND_STATE });
 }
+/** Keys this version does not know are carried over: an older CLI still on
+ *  PATH must not drop a newer one's settings (2.1.0 dropped `disabled`, which
+ *  silently re-enabled disabled accounts). */
 export function writeState(state) {
     ensureRoot();
-    fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
+    let previous = {};
+    try {
+        const raw = JSON.parse(fs.readFileSync(STATE_FILE, "utf8"));
+        if (raw && typeof raw === "object" && !Array.isArray(raw))
+            previous = raw;
+    }
+    catch {
+        /* absent / unparsable — nothing to keep */
+    }
+    const tmp = `${STATE_FILE}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ ...previous, ...state }, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, STATE_FILE);
 }
 export function activeFor(providerId) {
     return readState().active[providerId];
 }
 export function setActive(providerId, name) {
-    const state = readState();
-    state.active[providerId] = name;
-    writeState(state);
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        state.active[providerId] = name;
+        writeState(state);
+    });
 }
 export function labelFor(providerId, name) {
     return readState().labels[labelKey(providerId, name)] ?? null;
 }
 /** Set (or clear, with null) a profile's label. */
 export function setLabel(providerId, name, label) {
-    const state = readState();
-    const key = labelKey(providerId, name);
-    if (label)
-        state.labels[key] = label;
-    else
-        delete state.labels[key];
-    writeState(state);
-}
-/** Drop a removed profile's label so it can't linger as an orphan. */
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        const key = labelKey(providerId, name);
+        if (label)
+            state.labels[key] = label;
+        else
+            delete state.labels[key];
+        writeState(state);
+    });
+}
+/** Drop a removed profile's label, colour and disabled flag so they can't
+ *  linger as orphans (a reused name starts clean). */
 export function clearLabel(providerId, name) {
     setLabel(providerId, name, null);
+    setColor(providerId, name, null);
+    setDisabled(providerId, name, false);
+}
+export function isDisabled(providerId, name) {
+    return readState().disabled.includes(labelKey(providerId, name));
+}
+/** Disable (or re-enable) a profile. Disabling the active one clears the slot. */
+export function setDisabled(providerId, name, disabled) {
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        const key = labelKey(providerId, name);
+        state.disabled = state.disabled.filter((k) => k !== key);
+        if (disabled) {
+            state.disabled.push(key);
+            if (state.active[providerId] === name)
+                state.active[providerId] = null;
+        }
+        writeState(state);
+    });
+}
+export function colorOf(providerId, name) {
+    return readState().colors[labelKey(providerId, name)] ?? null;
+}
+/** Set (or clear, with null) a profile's colour. */
+export function setColor(providerId, name, color) {
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        const key = labelKey(providerId, name);
+        if (color)
+            state.colors[key] = color;
+        else
+            delete state.colors[key];
+        writeState(state);
+    });
 }
 /**
  * Rename a profile: move its config dir, carry its Claude credential across the
@@ -267,32 +368,39 @@ export function clearLabel(providerId, name) {
  * keychain ops are no-ops, so the re-seed is a harmless same-content rewrite.
  */
 export function renameProfile(providerId, from, to, store = credentialStore()) {
-    if (!profileExists(providerId, from))
-        throw new Error(`profile "${from}" does not exist`);
-    if (profileExists(providerId, to))
-        throw new Error(`profile "${to}" already exists`);
-    const fromConfig = configDir(providerId, from);
-    const toConfig = configDir(providerId, to);
-    // Capture the credential while the old path (and thus the darwin keychain hash)
-    // still resolves. Only Claude uses this store; codex/antigravity keep auth inside
-    // the config dir, which simply moves with the rename.
-    const cred = providerId === "claude" ? store.read(fromConfig) : null;
-    fs.renameSync(profileDir(providerId, from), profileDir(providerId, to));
-    if (cred) {
-        store.clearStale(toConfig); // a stale hashed entry at the new path would shadow the seed (darwin)
-        fs.writeFileSync(path.join(toConfig, ".credentials.json"), cred, { mode: 0o600 });
-        store.removeEntry(fromConfig); // drop the orphaned old-path keychain entry (darwin)
-    }
-    const state = readState();
-    if (state.active[providerId] === from)
-        state.active[providerId] = to;
-    const fromKey = labelKey(providerId, from);
-    const toKey = labelKey(providerId, to);
-    if (state.labels[fromKey] !== undefined) {
-        state.labels[toKey] = state.labels[fromKey];
-        delete state.labels[fromKey];
-    }
-    writeState(state);
+    return withFileLockSync(STATE_FILE, () => {
+        if (!profileExists(providerId, from))
+            throw new Error(`profile "${from}" does not exist`);
+        if (profileExists(providerId, to))
+            throw new Error(`profile "${to}" already exists`);
+        const fromConfig = configDir(providerId, from);
+        const toConfig = configDir(providerId, to);
+        // Capture the credential while the old path (and thus the darwin keychain hash)
+        // still resolves. Only Claude uses this store; codex/antigravity keep auth inside
+        // the config dir, which simply moves with the rename.
+        const cred = providerId === "claude" ? store.read(fromConfig) : null;
+        fs.renameSync(profileDir(providerId, from), profileDir(providerId, to));
+        if (cred) {
+            store.clearStale(toConfig); // a stale hashed entry at the new path would shadow the seed (darwin)
+            fs.writeFileSync(path.join(toConfig, ".credentials.json"), cred, { mode: 0o600 });
+            store.removeEntry(fromConfig); // drop the orphaned old-path keychain entry (darwin)
+        }
+        const state = readState();
+        if (state.active[providerId] === from)
+            state.active[providerId] = to;
+        const fromKey = labelKey(providerId, from);
+        const toKey = labelKey(providerId, to);
+        if (state.labels[fromKey] !== undefined) {
+            state.labels[toKey] = state.labels[fromKey];
+            delete state.labels[fromKey];
+        }
+        if (state.colors[fromKey] !== undefined) {
+            state.colors[toKey] = state.colors[fromKey];
+            delete state.colors[fromKey];
+        }
+        state.disabled = state.disabled.map((k) => (k === fromKey ? toKey : k));
+        writeState(state);
+    });
 }
 export function readAutoSwitch(providerId) {
     return readState().autoSwitch[providerId];
@@ -302,10 +410,12 @@ export function readAutoSwitchAll() {
     return readState().autoSwitch;
 }
 export function setAutoSwitch(providerId, cfg) {
-    const state = readState();
-    state.autoSwitch[providerId] = normalizeAutoSwitch({ ...state.autoSwitch[providerId], ...cfg });
-    writeState(state);
-    return state.autoSwitch[providerId];
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        state.autoSwitch[providerId] = normalizeAutoSwitch({ ...state.autoSwitch[providerId], ...cfg });
+        writeState(state);
+        return state.autoSwitch[providerId];
+    });
 }
 // ---------- provider enable/disable (per surface) ----------
 /** Every provider's enabled surfaces (for `providers status` / the GUI tab). */
@@ -324,10 +434,12 @@ export function enabledProviders(surface = "cli") {
 }
 /** Enable/disable one surface of a provider; returns its new surface state. */
 export function setProviderSurface(providerId, surface, enabled) {
-    const state = readState();
-    state.providers[providerId] = { ...state.providers[providerId], [surface]: enabled };
-    writeState(state);
-    return state.providers[providerId];
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        state.providers[providerId] = { ...state.providers[providerId], [surface]: enabled };
+        writeState(state);
+        return state.providers[providerId];
+    });
 }
 // ---------- linked binary paths (provider CLI not on PATH) ----------
 /** The user-linked absolute path to a provider's CLI binary, or null. */
@@ -340,12 +452,14 @@ export function readBinaryPaths() {
 }
 /** Link (set) or unlink (null) a provider's CLI binary path. */
 export function setBinaryPath(providerId, binPath) {
-    const state = readState();
-    if (binPath)
-        state.binaryPaths[providerId] = binPath;
-    else
-        delete state.binaryPaths[providerId];
-    writeState(state);
+    return withFileLockSync(STATE_FILE, () => {
+        const state = readState();
+        if (binPath)
+            state.binaryPaths[providerId] = binPath;
+        else
+            delete state.binaryPaths[providerId];
+        writeState(state);
+    });
 }
 // ---------- layout migration: v1 <ROOT>/<name> → <ROOT>/claude/<name> ----------
 /**

package/dist/protection.js

@@ -0,0 +1,100 @@
+/**
+ * Session protection — a per-profile policy, separate from the near-limit
+ * notifications (`autoswitch`, 95 %) and the context alerts. Default ON at 98 %
+ * for every profile, including ones that existed before this file did: a
+ * profile with no stored entry simply reads the default.
+ *
+ * What it does today: the daemon WARNS when a polled profile reaches its
+ * threshold. It does not pause anything. A real pause needs the provider to
+ * hold the session (Claude Code's own auto-continue), which agent-switch cannot
+ * verify from here, so every notice says "warn" — never "paused".
+ */
+import { withFileLockSync } from "./locks.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ROOT, ensureRoot } from "./profiles.js";
+export const PROTECTION_FILE = path.join(ROOT, "protection.json");
+export const DEFAULT_PROTECTION = { enabled: true, thresholdPct: 98 };
+function key(providerId, name) {
+    return `${providerId}/${name}`;
+}
+function validThreshold(v) {
+    return typeof v === "number" && Number.isInteger(v) && v >= 1 && v <= 100;
+}
+function load(file) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        return raw && typeof raw.profiles === "object" && raw.profiles ? raw.profiles : {};
+    }
+    catch {
+        return {};
+    }
+}
+function save(profiles, file) {
+    if (file === PROTECTION_FILE)
+        ensureRoot();
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ schema: 1, profiles }, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+function normalize(raw) {
+    return {
+        enabled: typeof raw?.enabled === "boolean" ? raw.enabled : DEFAULT_PROTECTION.enabled,
+        thresholdPct: validThreshold(raw?.thresholdPct) ? raw.thresholdPct : DEFAULT_PROTECTION.thresholdPct,
+    };
+}
+export function readProtection(providerId, name, file = PROTECTION_FILE) {
+    return normalize(load(file)[key(providerId, name)]);
+}
+export function setProtection(providerId, name, patch, file = PROTECTION_FILE) {
+    return withFileLockSync(file, () => {
+        if (patch.thresholdPct !== undefined && !validThreshold(patch.thresholdPct)) {
+            throw new Error("threshold must be a whole number between 1 and 100");
+        }
+        const all = load(file);
+        const next = normalize({ ...normalize(all[key(providerId, name)]), ...patch });
+        all[key(providerId, name)] = next;
+        save(all, file);
+        return next;
+    });
+}
+/** Carry a profile's policy across a rename; drop it on remove. */
+export function renameProtection(providerId, from, to, file = PROTECTION_FILE) {
+    return withFileLockSync(file, () => {
+        const all = load(file);
+        if (!(key(providerId, from) in all))
+            return;
+        all[key(providerId, to)] = all[key(providerId, from)];
+        delete all[key(providerId, from)];
+        save(all, file);
+    });
+}
+export function forgetProtection(providerId, name, file = PROTECTION_FILE) {
+    return withFileLockSync(file, () => {
+        const all = load(file);
+        if (!(key(providerId, name) in all))
+            return;
+        delete all[key(providerId, name)];
+        save(all, file);
+    });
+}
+/**
+ * The threshold warning for one profile, or null. Pure. Fires once per reset
+ * cycle of the window that crossed (`lastCycle` = what was announced before).
+ */
+export function protectionNotice(target, snap, policy, lastCycle) {
+    if (!policy.enabled)
+        return null;
+    const hit = snap.windows.find((w) => typeof w.utilization === "number" && w.utilization >= policy.thresholdPct);
+    if (!hit)
+        return null;
+    const cycle = `${hit.key}@${hit.resetsAt ?? ""}`;
+    if (cycle === lastCycle)
+        return null;
+    return {
+        cycle,
+        title: "Session protection: limit almost reached",
+        message: `${target} reached ${hit.utilization}% of its ${hit.label} limit (protection threshold ${policy.thresholdPct}%). ` +
+            `This is a warning only — agent-switch does not pause running sessions.`,
+    };
+}