nterminal 1.2.89 → 1.2.91

package/dist/server/accounts/accountService.js

@@ -0,0 +1,765 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from 'node:crypto';
+import { chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import os from 'node:os';
+import path from 'node:path';
+const VAULT_DIRECTORY = 'credential-vault';
+const VAULT_INDEX = 'index.json';
+const VAULT_KEY = 'key';
+const REFRESH_WINDOW_MS = 15 * 60_000;
+const REFRESH_INTERVAL_MS = 60_000;
+const CODEX_TOKEN_URL = 'https://auth.openai.com/oauth/token';
+const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hr';
+const CLAUDE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+export class AccountServiceError extends Error {
+    code;
+    constructor(code, message = code) {
+        super(message);
+        this.code = code;
+        this.name = 'AccountServiceError';
+    }
+    get statusCode() {
+        if (this.code === 'preview_mode')
+            return 403;
+        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending'].includes(this.code))
+            return 409;
+        return 400;
+    }
+}
+export class AccountService {
+    config;
+    terminalManager;
+    vaultPath;
+    homeDir;
+    now;
+    refreshTimer = null;
+    refreshInFlight = false;
+    operationInFlight = false;
+    disposed = false;
+    retryAfter = new Map();
+    processProbe;
+    constructor(config, terminalManager, options = {}) {
+        this.config = config;
+        this.terminalManager = terminalManager;
+        this.homeDir = options.homeDir ?? os.homedir();
+        // Keep the vault with NTerminal runtime state. Production defaults to
+        // ~/.nterminal; preview and explicitly relocated runtimes get an isolated
+        // vault instead of touching production account metadata.
+        this.vaultPath = path.join(path.dirname(config.statePath), VAULT_DIRECTORY);
+        this.now = options.now ?? (() => new Date());
+        this.processProbe = options.processProbe ?? providerProcessRunning;
+    }
+    // Reject overlapping mutations instead of accumulating requests behind OAuth I/O.
+    async mutate(operation) {
+        if (this.config.previewMode)
+            throw new AccountServiceError('preview_mode');
+        if (this.disposed || this.operationInFlight)
+            throw new AccountServiceError('account_operation_busy');
+        this.operationInFlight = true;
+        try {
+            return await operation();
+        }
+        finally {
+            this.operationInFlight = false;
+        }
+    }
+    async synchronize() {
+        return this.mutate(async () => {
+            const index = await this.readIndex();
+            await this.captureActiveCredentials(index);
+        });
+    }
+    select(provider, profileId) {
+        return this.mutate(() => this.selectUnlocked(provider, profileId));
+    }
+    remove(provider, profileId) {
+        return this.mutate(() => this.removeUnlocked(provider, profileId));
+    }
+    beginLogin(provider) {
+        return this.mutate(() => this.beginLoginUnlocked(provider));
+    }
+    completeLogin(provider, label) {
+        return this.mutate(() => this.completeLoginUnlocked(provider, label));
+    }
+    cancelLogin(provider) {
+        return this.mutate(() => this.cancelLoginUnlocked(provider));
+    }
+    refresh(provider, profileId) {
+        return this.mutate(() => this.refreshUnlocked(provider, profileId));
+    }
+    async status() {
+        const refreshed = await this.readIndex();
+        const running = this.runningPanes();
+        const pendingReady = new Map();
+        await Promise.all(['codex', 'claude'].map(async (provider) => {
+            pendingReady.set(provider, Boolean(refreshed.pending[provider] && await this.readCredentialFile(provider)));
+        }));
+        return {
+            providers: ['codex', 'claude'].map((provider) => this.providerStatus(refreshed, provider, running, pendingReady.get(provider) === true))
+        };
+    }
+    async selectUnlocked(provider, profileId) {
+        const index = await this.readIndex();
+        await this.assertNoRunningPanes(provider);
+        if (index.pending[provider])
+            throw new AccountServiceError('account_login_already_pending');
+        await this.captureActiveCredentials(index);
+        const profile = index.profiles.find((candidate) => candidate.id === profileId && candidate.provider === provider);
+        if (!profile)
+            throw new AccountServiceError('account_not_found');
+        if (index.active[provider] === profile.id)
+            return this.status();
+        const credentials = await this.readVaultCredentials(profile.id);
+        const current = await this.archiveActiveCredential(index, provider);
+        const previousId = index.active[provider];
+        try {
+            await this.writeCredentialFile(provider, credentials);
+            index.active[provider] = profile.id;
+            await this.writeIndex(index);
+        }
+        catch (error) {
+            if (current)
+                await this.writeCredentialFile(provider, current);
+            else
+                await this.removeCredentialFile(provider);
+            if (previousId)
+                await rm(this.profilePath(previousId), { force: true });
+            throw error;
+        }
+        await rm(this.profilePath(profile.id), { force: true });
+        return this.status();
+    }
+    async removeUnlocked(provider, profileId) {
+        const index = await this.readIndex();
+        if (index.pending[provider])
+            throw new AccountServiceError('account_login_already_pending');
+        await this.captureActiveCredentials(index);
+        const profile = index.profiles.find((candidate) => candidate.id === profileId && candidate.provider === provider);
+        if (!profile)
+            throw new AccountServiceError('account_not_found');
+        if (index.active[provider] === profile.id) {
+            throw new AccountServiceError('cannot_remove_active_account');
+        }
+        index.profiles = index.profiles.filter((candidate) => candidate.id !== profile.id);
+        await this.writeIndex(index);
+        await rm(this.profilePath(profile.id), { force: true });
+        this.retryAfter.delete(profile.id);
+        return this.status();
+    }
+    async beginLoginUnlocked(provider) {
+        const index = await this.readIndex();
+        await this.assertNoRunningPanes(provider);
+        if (index.pending[provider])
+            throw new AccountServiceError('account_login_already_pending');
+        await this.captureActiveCredentials(index);
+        const current = await this.archiveActiveCredential(index, provider);
+        index.pending[provider] = {
+            provider,
+            previousProfileId: index.active[provider] ?? null,
+            startedAt: this.now().toISOString()
+        };
+        delete index.active[provider];
+        await this.writeIndex(index);
+        let terminal;
+        try {
+            if (current)
+                await this.removeCredentialFile(provider);
+            terminal = await this.terminalManager.createTerminal({ cwd: this.config.workspaceRoot, cols: 100, rows: 30 });
+            const command = provider === 'codex' ? 'codex login' : 'claude auth login';
+            const wrote = await this.terminalManager.writeToTerminal(terminal.id, `${command}\r`);
+            if (!wrote)
+                throw new AccountServiceError('account_login_terminal_unavailable');
+            return { terminal, command };
+        }
+        catch (error) {
+            if (terminal)
+                await this.terminalManager.closeTerminal(terminal.id);
+            if (current)
+                await this.writeCredentialFile(provider, current);
+            if (index.active[provider] === undefined && index.pending[provider]?.previousProfileId) {
+                index.active[provider] = index.pending[provider].previousProfileId;
+            }
+            delete index.pending[provider];
+            await this.writeIndex(index);
+            const restoredId = index.active[provider];
+            if (restoredId)
+                await rm(this.profilePath(restoredId), { force: true });
+            throw error;
+        }
+    }
+    async completeLoginUnlocked(provider, label) {
+        const index = await this.readIndex();
+        const pending = index.pending[provider];
+        if (!pending)
+            throw new AccountServiceError('account_login_not_pending');
+        await this.assertNoRunningPanes(provider);
+        const credentials = await this.readCredentialFile(provider);
+        if (!credentials)
+            throw new AccountServiceError('account_login_not_complete');
+        const profile = await this.storeProfile(index, provider, credentials, label || defaultLabel(provider, index.profiles));
+        index.active[provider] = profile.id;
+        delete index.pending[provider];
+        await this.writeIndex(index);
+        await rm(this.profilePath(profile.id), { force: true });
+        return this.status();
+    }
+    async cancelLoginUnlocked(provider) {
+        const index = await this.readIndex();
+        const pending = index.pending[provider];
+        if (!pending)
+            return this.status();
+        await this.assertNoRunningPanes(provider);
+        if (pending.previousProfileId) {
+            const credentials = await this.readVaultCredentials(pending.previousProfileId);
+            await this.writeCredentialFile(provider, credentials);
+            index.active[provider] = pending.previousProfileId;
+        }
+        else {
+            await this.removeCredentialFile(provider);
+        }
+        delete index.pending[provider];
+        await this.writeIndex(index);
+        const restoredId = index.active[provider];
+        if (restoredId)
+            await rm(this.profilePath(restoredId), { force: true });
+        return this.status();
+    }
+    async refreshUnlocked(provider, profileId) {
+        const index = await this.readIndex();
+        if (index.pending[provider])
+            throw new AccountServiceError('account_login_already_pending');
+        await this.captureActiveCredentials(index);
+        const targetId = profileId ?? index.active[provider];
+        const profile = targetId ? index.profiles.find((candidate) => candidate.id === targetId && candidate.provider === provider) : undefined;
+        if (!profile)
+            throw new AccountServiceError('account_not_found');
+        await this.refreshProfile(index, profile);
+        await this.writeIndex(index);
+        return this.status();
+    }
+    start() {
+        if (this.refreshTimer || this.config.previewMode || this.disposed)
+            return;
+        this.refreshTimer = setInterval(() => void this.refreshExpiringProfiles(), REFRESH_INTERVAL_MS);
+        this.refreshTimer.unref();
+        void this.refreshExpiringProfiles();
+    }
+    dispose() {
+        this.disposed = true;
+        if (this.refreshTimer)
+            clearInterval(this.refreshTimer);
+        this.refreshTimer = null;
+    }
+    async refreshExpiringProfiles() {
+        if (this.refreshInFlight || this.disposed || this.config.previewMode || this.operationInFlight)
+            return;
+        this.refreshInFlight = true;
+        try {
+            await this.synchronize();
+            const candidates = (await this.readIndex()).profiles;
+            for (const candidate of candidates) {
+                if (this.disposed)
+                    break;
+                if (candidate.expiresAt === null || (this.retryAfter.get(candidate.id) ?? 0) > this.now().getTime())
+                    continue;
+                const profile = candidate;
+                const expiresAt = Date.parse(candidate.expiresAt);
+                if (!Number.isFinite(expiresAt) || expiresAt - this.now().getTime() > REFRESH_WINDOW_MS)
+                    continue;
+                try {
+                    await this.mutate(async () => {
+                        const index = await this.readIndex();
+                        if (index.pending[profile.provider])
+                            return;
+                        await this.captureActiveCredentials(index);
+                        const current = index.profiles.find((entry) => entry.id === profile.id);
+                        if (!current || current.expiresAt === null || Date.parse(current.expiresAt) - this.now().getTime() > REFRESH_WINDOW_MS)
+                            return;
+                        if (current.refreshTokenExpiresAt && Date.parse(current.refreshTokenExpiresAt) <= this.now().getTime())
+                            return;
+                        await this.refreshProfile(index, current);
+                        await this.writeIndex(index);
+                    });
+                }
+                catch (error) {
+                    if (!(error instanceof AccountServiceError) || !['provider_panes_running', 'account_operation_busy'].includes(error.code)) {
+                        this.retryAfter.set(profile.id, this.now().getTime() + 15 * 60_000);
+                    }
+                }
+            }
+        }
+        catch {
+            // Background filesystem failures must not become unhandled rejections.
+        }
+        finally {
+            this.refreshInFlight = false;
+        }
+    }
+    providerStatus(index, provider, running, pendingReady) {
+        const activeId = index.active[provider] ?? null;
+        const profile = activeId ? index.profiles.find((candidate) => candidate.id === activeId) ?? null : null;
+        const pending = index.pending[provider];
+        return {
+            provider,
+            activeProfileId: activeId,
+            profiles: index.profiles.filter((candidate) => candidate.provider === provider).map(toPublicProfile),
+            runningPanes: running.filter((pane) => pane.provider === provider),
+            pendingLogin: pending ? { startedAt: pending.startedAt, ready: pendingReady } : null,
+            credentialPresent: Boolean(profile || pending || false)
+        };
+    }
+    runningPanes() {
+        return this.terminalManager.listTerminals().flatMap((terminal) => {
+            if (terminal.status !== 'running')
+                return [];
+            const provider = providerForTerminal(terminal.currentCommand, terminal.agentStatus?.provider);
+            return provider ? [{ terminalId: terminal.id, provider, title: terminal.title, cwd: terminal.cwd }] : [];
+        });
+    }
+    async assertNoRunningPanes(provider) {
+        if (this.runningPanes().some((pane) => pane.provider === provider) || await this.processProbe(provider)) {
+            throw new AccountServiceError('provider_panes_running');
+        }
+    }
+    async captureActiveCredentials(index) {
+        const before = JSON.stringify(index);
+        for (const provider of ['codex', 'claude']) {
+            if (!index.pending[provider])
+                await this.captureActiveCredential(index, provider);
+        }
+        if (JSON.stringify(index) !== before)
+            await this.writeIndex(index);
+        // Only metadata is retained for active accounts. A duplicate can exist
+        // briefly during a switch, until the source file and index are committed.
+        for (const id of Object.values(index.active)) {
+            if (id)
+                await rm(this.profilePath(id), { force: true });
+        }
+    }
+    async captureActiveCredential(index, provider) {
+        const credentials = await this.readCredentialFile(provider);
+        const previousId = index.active[provider];
+        if (!credentials) {
+            delete index.active[provider];
+            await this.removeUnavailableProfile(index, previousId);
+            return;
+        }
+        const fingerprint = fingerprintFor(provider, credentials);
+        const credentialHash = hashCredential(credentials);
+        const existing = index.profiles.find((profile) => profile.provider === provider && (profile.fingerprint === fingerprint || profile.credentialHash === credentialHash));
+        if (existing) {
+            if (existing.credentialHash !== credentialHash)
+                await this.updateProfile(existing, provider, credentials);
+            index.active[provider] = existing.id;
+            if (previousId !== existing.id)
+                await this.removeUnavailableProfile(index, previousId);
+            return;
+        }
+        const profile = await this.storeProfile(index, provider, credentials, defaultLabel(provider, index.profiles));
+        index.active[provider] = profile.id;
+        if (previousId !== profile.id)
+            await this.removeUnavailableProfile(index, previousId);
+    }
+    async removeUnavailableProfile(index, id) {
+        if (!id)
+            return;
+        try {
+            await stat(this.profilePath(id));
+        }
+        catch (error) {
+            if (!isNotFound(error))
+                throw error;
+            index.profiles = index.profiles.filter((profile) => profile.id !== id);
+            this.retryAfter.delete(id);
+        }
+    }
+    async archiveActiveCredential(index, provider) {
+        const credentials = await this.readCredentialFile(provider);
+        const profile = index.profiles.find((entry) => entry.id === index.active[provider]);
+        if (!credentials)
+            return null;
+        if (!profile || profile.credentialHash !== hashCredential(credentials))
+            throw new AccountServiceError('account_credential_changed');
+        await this.writeVaultCredentials(profile.id, credentials);
+        return credentials;
+    }
+    async storeProfile(index, provider, credentials, label) {
+        const fingerprint = fingerprintFor(provider, credentials);
+        const existing = index.profiles.find((profile) => profile.provider === provider && profile.fingerprint === fingerprint);
+        const now = this.now().toISOString();
+        const timing = credentialTiming(provider, credentials);
+        const profile = existing ?? {
+            id: randomUUID(), provider, label: sanitizeLabel(label), createdAt: now, updatedAt: now,
+            expiresAt: timing.expiresAt, refreshTokenExpiresAt: timing.refreshTokenExpiresAt, fingerprint
+        };
+        profile.label = sanitizeLabel(label || profile.label);
+        profile.updatedAt = now;
+        profile.expiresAt = timing.expiresAt;
+        profile.refreshTokenExpiresAt = timing.refreshTokenExpiresAt;
+        profile.fingerprint = fingerprint;
+        profile.credentialHash = hashCredential(credentials);
+        if (!existing)
+            index.profiles.push(profile);
+        return profile;
+    }
+    async updateProfile(profile, provider, credentials) {
+        const timing = credentialTiming(provider, credentials);
+        profile.updatedAt = this.now().toISOString();
+        profile.expiresAt = timing.expiresAt;
+        profile.refreshTokenExpiresAt = timing.refreshTokenExpiresAt;
+        profile.credentialHash = hashCredential(credentials);
+        return profile;
+    }
+    async refreshProfile(index, profile) {
+        const active = index.active[profile.provider] === profile.id;
+        if (active)
+            await this.assertNoRunningPanes(profile.provider);
+        const credentials = active
+            ? await this.readCredentialFile(profile.provider)
+            : await this.readVaultCredentials(profile.id);
+        if (!credentials || (active && profile.credentialHash !== hashCredential(credentials))) {
+            throw new AccountServiceError('account_credential_changed');
+        }
+        const refreshToken = refreshTokenFor(profile.provider, credentials);
+        if (!refreshToken)
+            throw new AccountServiceError('refresh_token_unavailable');
+        if (profile.refreshTokenExpiresAt && Date.parse(profile.refreshTokenExpiresAt) <= this.now().getTime()) {
+            throw new AccountServiceError('account_refresh_failed');
+        }
+        const body = new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: profile.provider === 'codex' ? CODEX_CLIENT_ID : CLAUDE_CLIENT_ID });
+        let response;
+        try {
+            response = await fetch(profile.provider === 'codex' ? CODEX_TOKEN_URL : CLAUDE_TOKEN_URL, {
+                method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body, signal: AbortSignal.timeout(15_000)
+            });
+        }
+        catch {
+            throw new AccountServiceError('account_refresh_unavailable');
+        }
+        if (!response.ok)
+            throw new AccountServiceError('account_refresh_failed');
+        let refreshed;
+        try {
+            refreshed = await response.json();
+        }
+        catch {
+            throw new AccountServiceError('account_refresh_failed');
+        }
+        if (!refreshed || typeof refreshed !== 'object')
+            throw new AccountServiceError('account_refresh_failed');
+        const next = applyRefresh(profile.provider, credentials, refreshed, this.now());
+        if (active) {
+            const live = await this.readCredentialFile(profile.provider);
+            if (!live || hashCredential(live) !== hashCredential(credentials)) {
+                // An external login can replace the active account during the request.
+                // Its new file wins; retain the refreshed old account only if identifiable
+                // as a different account, which is now inactive.
+                if (live && stableIdentity(profile.provider, credentials) && stableIdentity(profile.provider, live)
+                    && stableIdentity(profile.provider, credentials) !== stableIdentity(profile.provider, live)) {
+                    await this.writeVaultCredentials(profile.id, next);
+                    await this.updateProfile(profile, profile.provider, next);
+                    await this.captureActiveCredentials(index);
+                }
+                throw new AccountServiceError('account_credential_changed');
+            }
+            // Refresh was started while idle. Once it succeeds, commit the rotated
+            // token to its only source even if a CLI has since started reading it.
+            await this.writeCredentialFile(profile.provider, next);
+        }
+        else {
+            await this.writeVaultCredentials(profile.id, next);
+        }
+        await this.updateProfile(profile, profile.provider, next);
+    }
+    async readIndex() {
+        try {
+            const text = await readFile(path.join(this.vaultPath, VAULT_INDEX), 'utf8');
+            const parsed = JSON.parse(text);
+            return {
+                version: 1,
+                profiles: Array.isArray(parsed.profiles) ? parsed.profiles.filter(isVaultProfile) : [],
+                active: isRecord(parsed.active) ? parsed.active : {},
+                pending: isRecord(parsed.pending) ? parsed.pending : {}
+            };
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return { version: 1, profiles: [], active: {}, pending: {} };
+            throw new AccountServiceError('account_vault_unavailable');
+        }
+    }
+    async writeIndex(index) {
+        await this.ensureVault();
+        await atomicWrite(path.join(this.vaultPath, VAULT_INDEX), JSON.stringify(index), 0o600);
+    }
+    profilePath(id) { return path.join(this.vaultPath, `${id}.enc`); }
+    async vaultKey(create = false) {
+        const keyPath = path.join(this.vaultPath, VAULT_KEY);
+        try {
+            const key = await readFile(keyPath);
+            if (key.byteLength === 32)
+                return key;
+            throw new AccountServiceError('account_vault_unavailable');
+        }
+        catch (error) {
+            if (!isNotFound(error))
+                throw error;
+        }
+        if (!create)
+            throw new AccountServiceError('account_vault_unavailable');
+        const key = randomBytes(32);
+        await this.ensureVault();
+        if ((await readdir(this.vaultPath)).some((name) => name.endsWith('.enc'))) {
+            throw new AccountServiceError('account_vault_unavailable');
+        }
+        await writeFile(keyPath, key, { mode: 0o600, flag: 'wx' });
+        return key;
+    }
+    async ensureVault() {
+        await mkdir(this.vaultPath, { recursive: true, mode: 0o700 });
+        await chmod(this.vaultPath, 0o700);
+    }
+    async writeVaultCredentials(profileId, credentials) {
+        const key = await this.vaultKey(true);
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', key, iv);
+        const plaintext = Buffer.from(JSON.stringify(credentials));
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const payload = Buffer.concat([iv, cipher.getAuthTag(), encrypted]);
+        await atomicWrite(this.profilePath(profileId), payload.toString('base64'), 0o600);
+    }
+    async readVaultCredentials(profileId) {
+        const key = await this.vaultKey();
+        let payload;
+        try {
+            payload = Buffer.from(await readFile(this.profilePath(profileId), 'utf8'), 'base64');
+        }
+        catch {
+            throw new AccountServiceError('account_vault_unavailable');
+        }
+        if (payload.byteLength < 29)
+            throw new AccountServiceError('account_vault_unavailable');
+        try {
+            const decipher = createDecipheriv('aes-256-gcm', key, payload.subarray(0, 12));
+            decipher.setAuthTag(payload.subarray(12, 28));
+            const decoded = JSON.parse(Buffer.concat([decipher.update(payload.subarray(28)), decipher.final()]).toString('utf8'));
+            if (!isRecord(decoded))
+                throw new Error('invalid');
+            return decoded;
+        }
+        catch {
+            throw new AccountServiceError('account_vault_unavailable');
+        }
+    }
+    credentialPath(provider) {
+        return provider === 'codex'
+            ? path.join(this.homeDir, '.codex', 'auth.json')
+            : path.join(this.homeDir, '.claude', '.credentials.json');
+    }
+    async readCredentialFile(provider) {
+        try {
+            const document = JSON.parse(await readFile(this.credentialPath(provider), 'utf8'));
+            if (!isRecord(document))
+                return null;
+            if (provider === 'claude') {
+                const settings = await this.readClaudeSettings();
+                // This envelope field stays in the encrypted vault, never in the CLI token file.
+                document.nterminalAccountMetadata = isRecord(settings.oauthAccount) ? settings.oauthAccount : null;
+            }
+            return document;
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw new AccountServiceError('credential_file_unavailable');
+        }
+    }
+    async writeCredentialFile(provider, credentials) {
+        const target = this.credentialPath(provider);
+        await mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+        const { nterminalAccountMetadata, ...document } = credentials;
+        if (provider === 'claude') {
+            const previousSettings = await this.readClaudeSettings();
+            const settings = { ...previousSettings };
+            if (isRecord(nterminalAccountMetadata))
+                settings.oauthAccount = nterminalAccountMetadata;
+            else
+                delete settings.oauthAccount;
+            const settingsPath = path.join(this.homeDir, '.claude.json');
+            const changed = JSON.stringify(settings) !== JSON.stringify(previousSettings);
+            if (changed)
+                await atomicWrite(settingsPath, JSON.stringify(settings, null, 2), 0o600);
+            try {
+                await atomicWrite(target, JSON.stringify(document, null, 2), 0o600);
+            }
+            catch (error) {
+                if (changed)
+                    await atomicWrite(settingsPath, JSON.stringify(previousSettings, null, 2), 0o600);
+                throw error;
+            }
+            return;
+        }
+        await atomicWrite(target, JSON.stringify(document, null, 2), 0o600);
+    }
+    async readClaudeSettings() {
+        try {
+            const document = JSON.parse(await readFile(path.join(this.homeDir, '.claude.json'), 'utf8'));
+            if (!isRecord(document))
+                throw new AccountServiceError('credential_file_unavailable');
+            return document;
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return {};
+            throw new AccountServiceError('credential_file_unavailable');
+        }
+    }
+    async removeCredentialFile(provider) {
+        await rm(this.credentialPath(provider), { force: true });
+    }
+}
+function providerForTerminal(command, transcriptProvider) {
+    if (transcriptProvider)
+        return transcriptProvider;
+    const normalized = command?.toLowerCase() ?? '';
+    if (/(^|[\s/])codex(?:[-\s]|$)/.test(normalized))
+        return 'codex';
+    if (/(^|[\s/])claude(?:[-\s]|$)/.test(normalized))
+        return 'claude';
+    return null;
+}
+const execFileAsync = promisify(execFile);
+async function providerProcessRunning(provider) {
+    try {
+        if (!process.getuid)
+            throw new Error('unsupported');
+        const { stdout } = await execFileAsync('ps', ['-u', String(process.getuid()), '-o', 'comm=,args='], {
+            timeout: 3_000, maxBuffer: 4 * 1024 * 1024, encoding: 'utf8'
+        });
+        return stdout.split('\n').some((line) => {
+            const [command, executable, ...args] = line.trim().split(/\s+/);
+            if (providerForTerminal(command, undefined) === provider || providerForTerminal(executable, undefined) === provider)
+                return true;
+            // Inspect the script operand, not prompt text passed later in argv.
+            if (command === 'node' || command === 'nodejs') {
+                const script = args.find((arg) => !arg.startsWith('-'));
+                return Boolean(script && (script.includes(`/${provider}/`) || script.includes(`/${provider}-code/`) || providerForTerminal(script, undefined) === provider));
+            }
+            return false;
+        });
+    }
+    catch {
+        throw new AccountServiceError('account_process_check_unavailable');
+    }
+}
+function toPublicProfile(profile) {
+    return { id: profile.id, provider: profile.provider, label: profile.label, createdAt: profile.createdAt, updatedAt: profile.updatedAt, expiresAt: profile.expiresAt, refreshTokenExpiresAt: profile.refreshTokenExpiresAt };
+}
+function credentialTiming(provider, document) {
+    if (provider === 'claude') {
+        const oauth = isRecord(document.claudeAiOauth) ? document.claudeAiOauth : {};
+        return { expiresAt: isoTime(oauth.expiresAt), refreshTokenExpiresAt: isoTime(oauth.refreshTokenExpiresAt) };
+    }
+    const tokens = isRecord(document.tokens) ? document.tokens : {};
+    return { expiresAt: jwtExpiry(tokens.access_token), refreshTokenExpiresAt: null };
+}
+function refreshTokenFor(provider, document) {
+    const source = provider === 'claude' ? (isRecord(document.claudeAiOauth) ? document.claudeAiOauth : {}) : (isRecord(document.tokens) ? document.tokens : {});
+    const token = source.refreshToken ?? source.refresh_token;
+    return typeof token === 'string' && token ? token : null;
+}
+function applyRefresh(provider, document, response, now) {
+    const accessToken = stringValue(response.access_token);
+    const refreshToken = stringValue(response.refresh_token);
+    if (!accessToken)
+        throw new AccountServiceError('account_refresh_failed');
+    if (provider === 'claude') {
+        const oauth = isRecord(document.claudeAiOauth) ? { ...document.claudeAiOauth } : {};
+        oauth.accessToken = accessToken;
+        if (refreshToken)
+            oauth.refreshToken = refreshToken;
+        const expiresIn = numberValue(response.expires_in);
+        if (expiresIn)
+            oauth.expiresAt = now.getTime() + expiresIn * 1000;
+        return { ...document, claudeAiOauth: oauth };
+    }
+    const tokens = isRecord(document.tokens) ? { ...document.tokens } : {};
+    tokens.access_token = accessToken;
+    if (refreshToken)
+        tokens.refresh_token = refreshToken;
+    const idToken = stringValue(response.id_token);
+    if (idToken)
+        tokens.id_token = idToken;
+    return { ...document, tokens, last_refresh: now.toISOString() };
+}
+function defaultLabel(provider, profiles) {
+    return `${provider === 'codex' ? 'Codex' : 'Claude'} account ${profiles.filter((profile) => profile.provider === provider).length + 1}`;
+}
+function sanitizeLabel(value) { return value.trim().replace(/\s+/g, ' ').slice(0, 80) || 'Account'; }
+function fingerprintFor(provider, value) {
+    const identity = stableIdentity(provider, value);
+    return createHash('sha256').update(identity ?? JSON.stringify(value)).digest('hex');
+}
+function hashCredential(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+function stableIdentity(provider, value) {
+    if (provider === 'codex') {
+        const tokens = isRecord(value.tokens) ? value.tokens : {};
+        const accountId = stringValue(tokens.account_id);
+        if (accountId)
+            return `codex:${accountId}`;
+        return jwtSubject('codex', tokens.id_token) ?? jwtSubject('codex', tokens.access_token);
+    }
+    const oauth = isRecord(value.claudeAiOauth) ? value.claudeAiOauth : {};
+    const metadata = isRecord(value.nterminalAccountMetadata) ? value.nterminalAccountMetadata : {};
+    const accountId = stringValue(metadata.accountUuid);
+    if (accountId)
+        return `claude:${accountId}`;
+    return jwtSubject('claude', oauth.accessToken);
+}
+function jwtSubject(provider, value) {
+    if (typeof value !== 'string')
+        return null;
+    const part = value.split('.')[1];
+    if (!part)
+        return null;
+    try {
+        const decoded = JSON.parse(Buffer.from(part.replace(/-/g, '+').replace(/_/g, '/'), 'base64url').toString('utf8'));
+        const subject = stringValue(decoded.sub) ?? stringValue(decoded.email) ?? stringValue(decoded.account_id);
+        return subject ? `${provider}:${subject}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isRecord(value) { return Boolean(value) && typeof value === 'object' && !Array.isArray(value); }
+function isVaultProfile(value) { return isRecord(value) && typeof value.id === 'string' && (value.provider === 'codex' || value.provider === 'claude') && typeof value.label === 'string' && typeof value.createdAt === 'string' && typeof value.updatedAt === 'string' && (value.expiresAt === null || typeof value.expiresAt === 'string') && (value.refreshTokenExpiresAt === null || typeof value.refreshTokenExpiresAt === 'string') && typeof value.fingerprint === 'string'; }
+function stringValue(value) { return typeof value === 'string' && value ? value : null; }
+function numberValue(value) { return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null; }
+function isoTime(value) { if (typeof value === 'string' && Number.isFinite(Date.parse(value)))
+    return new Date(value).toISOString(); if (typeof value === 'number' && Number.isFinite(value))
+    return new Date(value).toISOString(); return null; }
+function jwtExpiry(value) { if (typeof value !== 'string')
+    return null; const part = value.split('.')[1]; if (!part)
+    return null; try {
+    const parsed = JSON.parse(Buffer.from(part.replace(/-/g, '+').replace(/_/g, '/'), 'base64url').toString('utf8'));
+    return typeof parsed.exp === 'number' ? new Date(parsed.exp * 1000).toISOString() : null;
+}
+catch {
+    return null;
+} }
+function isNotFound(error) { return Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT'); }
+async function atomicWrite(target, value, mode) {
+    const temp = `${target}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temp, value, { mode, flag: 'wx' });
+        await rename(temp, target);
+    }
+    finally {
+        await rm(temp, { force: true }).catch(() => undefined);
+    }
+}
+//# sourceMappingURL=accountService.js.map