nterminal 1.3.7 → 1.3.8

package/dist/server/accounts/accountService.js

@@ -4,6 +4,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import os from 'node:os';
 import path from 'node:path';
+import { accountReloginReason } from '../../shared/accountRelogin.js';
 import { ProviderRequestError, requestAccountUsage, requestTokenRefresh, unavailableUsage } from './providerRequests.js';
 const VAULT_DIRECTORY = 'credential-vault';
 const VAULT_INDEX = 'index.json';
@@ -210,7 +211,12 @@ export class AccountService {
         await Promise.all(['codex', 'claude'].map(async (provider) => {
             try {
                 const representedPanes = new Set(running.filter((pane) => pane.provider === provider).map((pane) => pane.terminalId));
-                processes.set(provider, (await this.processLister(provider))
+                const listed = await this.processLister(provider);
+                const daemonHelpers = daemonDescendants(listed);
+                processes.set(provider, listed
+                    // Helpers the shared daemon spawns (e.g. codex-code-mode-host) are part
+                    // of the daemon entry, not separate sessions.
+                    .filter((entry) => !daemonHelpers.has(entry.pid))
                     .filter((entry) => isCodexDaemon(entry) || !representedPanes.has(paneProcesses.get(entry.pid) ?? ''))
                     .map((entry) => ({ pid: entry.pid, provider, command: entry.command, ...(isCodexDaemon(entry) ? { role: 'daemon' } : {}) })));
             }
@@ -227,9 +233,15 @@ export class AccountService {
             providers: ['codex', 'claude'].map((provider) => this.providerStatus(refreshed, provider, running, processes.get(provider) ?? [], processCheckUnavailable, pendingReady.get(provider) === true))
         };
     }
+    // Providers with at least one saved login that needs a new sign-in. Cheap
+    // (index metadata only), so the server list can poll it with system stats.
+    async reloginRequired() {
+        const index = await this.readIndex();
+        const now = this.now().getTime();
+        return ['codex', 'claude'].filter((provider) => index.profiles.some((profile) => profile.provider === provider && accountReloginReason(profile, now) !== null));
+    }
     async selectUnlocked(provider, profileId) {
         const index = await this.readIndex();
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (index.pending[provider])
             throw new AccountServiceError('account_login_already_pending');
         await this.captureActiveCredentials(index, provider);
@@ -237,6 +249,8 @@ export class AccountService {
         if (!profile)
             throw new AccountServiceError('account_not_found');
         if (index.active[provider] === profile.id) {
+            if (clearExternalSwitch(index, provider))
+                await this.writeIndex(index);
             this.clearTerminationAcknowledgement(provider);
             return this.status();
         }
@@ -246,6 +260,7 @@ export class AccountService {
         try {
             await this.writeCredentialFile(provider, credentials);
             index.active[provider] = profile.id;
+            clearExternalSwitch(index, provider);
             await this.writeIndex(index);
         }
         catch (error) {
@@ -253,11 +268,10 @@ export class AccountService {
                 await this.writeCredentialFile(provider, current);
             else
                 await this.removeCredentialFile(provider);
-            if (previousId)
-                await rm(this.profilePath(previousId), { force: true });
             throw error;
         }
-        await rm(this.profilePath(profile.id), { force: true });
+        // The selected profile's vault copy is exactly what was just published, so
+        // it already is the active backup. The previous account kept its archive.
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
@@ -273,6 +287,8 @@ export class AccountService {
             throw new AccountServiceError('cannot_remove_active_account');
         }
         index.profiles = index.profiles.filter((candidate) => candidate.id !== profile.id);
+        if (index.externalSwitch?.[provider]?.fromProfileId === profile.id)
+            clearExternalSwitch(index, provider);
         await this.writeIndex(index);
         await rm(this.profilePath(profile.id), { force: true });
         this.retryAfter.delete(profile.id);
@@ -282,7 +298,6 @@ export class AccountService {
     }
     async beginLoginUnlocked(provider) {
         const index = await this.readIndex();
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (index.pending[provider])
             throw new AccountServiceError('account_login_already_pending');
         await this.captureActiveCredentials(index, provider);
@@ -319,9 +334,6 @@ export class AccountService {
             }
             delete index.pending[provider];
             await this.writeIndex(index);
-            const restoredId = index.active[provider];
-            if (restoredId)
-                await rm(this.profilePath(restoredId), { force: true });
             throw error;
         }
     }
@@ -330,15 +342,16 @@ export class AccountService {
         const pending = index.pending[provider];
         if (!pending)
             throw new AccountServiceError('account_login_not_pending');
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         const credentials = await this.readCredentialFile(provider);
         if (!credentials)
             throw new AccountServiceError('account_login_not_complete');
         const profile = await this.storeProfile(index, provider, credentials, label);
+        // Back up the new active login before committing it as active.
+        await this.writeVaultCredentials(profile.id, credentials);
         index.active[provider] = profile.id;
         delete index.pending[provider];
+        clearExternalSwitch(index, provider);
         await this.writeIndex(index);
-        await rm(this.profilePath(profile.id), { force: true });
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
@@ -347,7 +360,6 @@ export class AccountService {
         const pending = index.pending[provider];
         if (!pending)
             return this.status();
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (pending.previousProfileId) {
             const credentials = await this.readVaultCredentials(pending.previousProfileId);
             await this.writeCredentialFile(provider, credentials);
@@ -358,9 +370,6 @@ export class AccountService {
         }
         delete index.pending[provider];
         await this.writeIndex(index);
-        const restoredId = index.active[provider];
-        if (restoredId)
-            await rm(this.profilePath(restoredId), { force: true });
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
@@ -487,6 +496,7 @@ export class AccountService {
             processCheckUnavailable,
             terminationAcknowledged: this.hasTerminationAcknowledgement(provider),
             pendingLogin: pending ? { startedAt: pending.startedAt, ready: pendingReady, terminalId: pending.terminalId ?? null } : null,
+            lastExternalSwitch: index.externalSwitch?.[provider] ?? null,
             credentialPresent: Boolean(profile || pending || false)
         };
     }
@@ -498,12 +508,10 @@ export class AccountService {
             return provider ? [{ terminalId: terminal.id, provider, title: terminal.title, cwd: terminal.cwd }] : [];
         });
     }
-    async assertNoRunningPanes(provider, options = {}) {
-        const acknowledged = options.allowTerminationAcknowledgement === true && this.hasTerminationAcknowledgement(provider);
-        if ((!acknowledged && this.runningPanes().some((pane) => pane.provider === provider)) || await this.processProbe(provider)) {
-            throw new AccountServiceError('provider_panes_running');
-        }
-    }
+    // Running provider sessions are advisory for account changes: the dialog lists
+    // them, and they keep the account they started with until restarted. Only
+    // refreshing the ACTIVE account's credential stays guarded, because rotating
+    // its refresh token would invalidate the running CLI's copy.
     async terminateProviderSessionsUnlocked(provider) {
         const processes = await this.processLister(provider);
         this.clearTerminationAcknowledgement(provider);
@@ -559,51 +567,102 @@ export class AccountService {
         }
         if (JSON.stringify(index) !== before)
             await this.writeIndex(index);
-        // Only metadata is retained for active accounts. A duplicate can exist
-        // briefly during a switch, until the source file and index are committed.
-        for (const provider of providers) {
-            const id = index.active[provider];
-            if (id)
-                await rm(this.profilePath(id), { force: true });
-        }
     }
+    // The live CLI file is the source of truth for the active account. Every
+    // newer live credential NTerminal observes is also copied into the active
+    // profile's encrypted vault backup, so an external overwrite (another login,
+    // or a stale CLI writing its old account back) never loses the account that
+    // was active: it stays in the vault and can be selected again.
     async captureActiveCredential(index, provider) {
         const credentials = await this.readCredentialFile(provider);
         const previousId = index.active[provider];
         if (!credentials) {
+            if (!previousId)
+                return;
             delete index.active[provider];
-            await this.removeUnavailableProfile(index, previousId);
+            await this.deactivateProfile(index, provider, previousId, null);
             return;
         }
         const fingerprint = fingerprintFor(provider, credentials);
         const credentialHash = hashCredential(credentials);
         const existing = index.profiles.find((profile) => profile.provider === provider && (profile.fingerprint === fingerprint || profile.credentialHash === credentialHash));
+        if (existing && existing.id === previousId) {
+            if (existing.credentialHash !== credentialHash) {
+                // The active account's CLI rotated or re-wrote it: the live file wins.
+                await this.updateProfile(existing, provider, credentials);
+                await this.backupLiveCredential(existing, credentials, false);
+            }
+            else if (!await this.hasVaultCredentials(existing.id)) {
+                // Vaults written before active backups existed: create it once.
+                await this.writeVaultCredentials(existing.id, credentials);
+            }
+            return;
+        }
+        // The live file now holds a different account than the index says.
+        let profile;
         if (existing) {
             if (existing.credentialHash !== credentialHash)
                 await this.updateProfile(existing, provider, credentials);
-            index.active[provider] = existing.id;
-            if (previousId !== existing.id)
-                await this.removeUnavailableProfile(index, previousId);
-            return;
+            profile = existing;
         }
-        const profile = await this.storeProfile(index, provider, credentials);
+        else {
+            profile = await this.storeProfile(index, provider, credentials);
+        }
+        // A stale CLI may write back tokens older than this profile's vault copy
+        // (renewed while it was inactive); keep the newer copy for a later Use.
+        await this.backupLiveCredential(profile, credentials, true);
         index.active[provider] = profile.id;
-        if (previousId !== profile.id)
-            await this.removeUnavailableProfile(index, previousId);
-    }
-    async removeUnavailableProfile(index, id) {
-        if (!id)
+        if (previousId)
+            await this.deactivateProfile(index, provider, previousId, profile.id);
+    }
+    // Copies a live credential into the profile's vault backup. With
+    // keepNewerBackup, a backup that holds a strictly newer credential for the
+    // same account is kept instead. The live file itself is never changed here.
+    async backupLiveCredential(profile, live, keepNewerBackup) {
+        const backup = await this.readVaultCredentials(profile.id).catch(() => null);
+        if (backup && keepNewerBackup && stableIdentity(profile.provider, backup) === stableIdentity(profile.provider, live) && isOlderCredential(profile.provider, live, backup)) {
+            return backup;
+        }
+        if (!backup || hashCredential(backup) !== hashCredential(live))
+            await this.writeVaultCredentials(profile.id, live);
+        return live;
+    }
+    // A profile stops being active because the live file changed outside
+    // NTerminal. Its backup becomes its saved credential. Profiles without a
+    // backup (vaults from before active backups) cannot be restored and are
+    // dropped, as before.
+    async deactivateProfile(index, provider, id, toProfileId) {
+        const profile = index.profiles.find((entry) => entry.id === id);
+        if (!profile)
             return;
+        let backup;
         try {
-            await stat(this.profilePath(id));
+            backup = await this.readVaultCredentials(id);
         }
         catch (error) {
-            if (!isNotFound(error))
+            if (!(error instanceof AccountServiceError) || await this.hasVaultCredentials(id))
                 throw error;
-            index.profiles = index.profiles.filter((profile) => profile.id !== id);
+            index.profiles = index.profiles.filter((entry) => entry.id !== id);
             this.retryAfter.delete(id);
+            return;
         }
+        if (hashCredential(backup) !== profile.credentialHash)
+            await this.updateProfile(profile, provider, backup);
+        index.externalSwitch = { ...index.externalSwitch, [provider]: { at: this.now().toISOString(), fromProfileId: id, toProfileId } };
     }
+    async hasVaultCredentials(id) {
+        try {
+            await stat(this.profilePath(id));
+            return true;
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return false;
+            throw error;
+        }
+    }
+    // Before NTerminal itself replaces the live file (switch or new login), make
+    // sure the outgoing account's vault copy holds its newest credential.
     async archiveActiveCredential(index, provider) {
         const credentials = await this.readCredentialFile(provider);
         const profile = index.profiles.find((entry) => entry.id === index.active[provider]);
@@ -611,7 +670,12 @@ export class AccountService {
             return null;
         if (!profile || profile.credentialHash !== hashCredential(credentials))
             throw new AccountServiceError('account_credential_changed');
-        await this.writeVaultCredentials(profile.id, credentials);
+        // The live hash matches the last synchronization, so the backup can only
+        // differ if it was kept as newer when this account became live again.
+        const kept = await this.backupLiveCredential(profile, credentials, true);
+        // Inactive profiles describe their vault copy.
+        if (kept !== credentials)
+            await this.updateProfile(profile, provider, kept);
         return credentials;
     }
     // A blank label only names new profiles; re-authenticating an existing
@@ -665,7 +729,11 @@ export class AccountService {
         }
         // Idle describes a conversation, not the CLI's background auth work. Until
         // we can delegate to its native auth owner, never compete with a live CLI.
-        if (active)
+        // The same applies to an account an external write just displaced: CLIs
+        // started while it was active still hold its refresh token. The active
+        // account is always refreshed from the live file, never from its backup.
+        const displaced = index.externalSwitch?.[profile.provider]?.fromProfileId === profile.id;
+        if (active || displaced)
             await this.assertNoRefreshOwner(profile.provider);
         let refreshResponse;
         try {
@@ -706,8 +774,11 @@ export class AccountService {
             }
             // The live credential is shared by every pane for this OS user. The
             // compare above preserves an external CLI refresh or login that won the
-            // race; otherwise atomically publish the one rotated credential.
+            // race; otherwise atomically publish the one rotated credential, then
+            // mirror it into the active backup. If the backup write fails, the next
+            // synchronization copies the newer live file.
             await this.writeCredentialFile(profile.provider, next);
+            await this.writeVaultCredentials(profile.id, next);
         }
         else {
             await this.writeVaultCredentials(profile.id, next);
@@ -735,7 +806,8 @@ export class AccountService {
                 version: 1,
                 profiles: Array.isArray(parsed.profiles) ? parsed.profiles.filter(isVaultProfile) : [],
                 active: isRecord(parsed.active) ? parsed.active : {},
-                pending: isRecord(parsed.pending) ? parsed.pending : {}
+                pending: isRecord(parsed.pending) ? parsed.pending : {},
+                ...(isRecord(parsed.externalSwitch) ? { externalSwitch: parseExternalSwitches(parsed.externalSwitch) } : {})
             };
         }
         catch (error) {
@@ -929,14 +1001,22 @@ async function listUserProcesses() {
     const getuid = process.getuid;
     if (!getuid)
         throw new Error('unsupported');
-    const { stdout } = await execFileAsync('ps', ['-u', String(getuid()), '-o', 'pid=,ppid=,comm=,args='], {
+    const { stdout } = await execFileAsync('ps', ['-u', String(getuid()), '-o', 'pid=,ppid=,stat=,comm=,args='], {
         timeout: 3_000, maxBuffer: 4 * 1024 * 1024, encoding: 'utf8'
     });
+    return parseProcessSnapshot(stdout);
+}
+// Zombie (Z) and dead (X) entries have exited and cannot be signalled; only
+// their parent can reap them (e.g. an old Codex daemon under its updater).
+// They are not running providers.
+export function parseProcessSnapshot(stdout) {
     return stdout.split('\n').flatMap((line) => {
-        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/);
+        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\S+)\s+(\S+)\s*(.*)$/);
         if (!match)
             return [];
-        const [, pidText, ppidText, command, args] = match;
+        const [, pidText, ppidText, stat, command, args] = match;
+        if (/^[ZX]/.test(stat))
+            return [];
         const pid = Number.parseInt(pidText, 10);
         const ppid = Number.parseInt(ppidText, 10);
         return Number.isSafeInteger(pid) && Number.isSafeInteger(ppid) ? [{ pid, ppid, command: command, args: args }] : [];
@@ -1005,6 +1085,24 @@ async function stopCodexDaemon(daemons) {
     }
     throw new AccountServiceError('codex_daemon_stop_failed');
 }
+function daemonDescendants(entries) {
+    const parents = new Map(entries.map((entry) => [entry.pid, entry.ppid]));
+    const daemons = new Set(entries.filter(isCodexDaemon).map((entry) => entry.pid));
+    const out = new Set();
+    for (const entry of entries) {
+        if (daemons.has(entry.pid))
+            continue;
+        const seen = new Set();
+        for (let pid = entry.ppid; pid > 0 && !seen.has(pid); pid = parents.get(pid) ?? 0) {
+            if (daemons.has(pid)) {
+                out.add(entry.pid);
+                break;
+            }
+            seen.add(pid);
+        }
+    }
+    return out;
+}
 function isCodexDaemon(entry) {
     const args = entry.args.trim().split(/\s+/);
     return path.basename(args[0] ?? '') === 'codex' && args[1] === 'app-server'
@@ -1044,6 +1142,31 @@ function signalProcess(pid, signal) {
 function sleep(milliseconds) {
     return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
+function clearExternalSwitch(index, provider) {
+    if (!index.externalSwitch?.[provider])
+        return false;
+    const { [provider]: _cleared, ...rest } = index.externalSwitch;
+    index.externalSwitch = rest;
+    return true;
+}
+function parseExternalSwitches(value) {
+    const result = {};
+    for (const provider of ['codex', 'claude']) {
+        const entry = value[provider];
+        if (isRecord(entry) && typeof entry.at === 'string' && typeof entry.fromProfileId === 'string' && (entry.toProfileId === null || typeof entry.toProfileId === 'string')) {
+            result[provider] = { at: entry.at, fromProfileId: entry.fromProfileId, toProfileId: entry.toProfileId };
+        }
+    }
+    return result;
+}
+// True when `candidate` is provably older than `reference`: both carry an
+// access-token expiry and the candidate's is earlier. Unknown timing is never
+// treated as older, so the live file wins by default.
+function isOlderCredential(provider, candidate, reference) {
+    const a = Date.parse(credentialTiming(provider, candidate).expiresAt ?? '');
+    const b = Date.parse(credentialTiming(provider, reference).expiresAt ?? '');
+    return Number.isFinite(a) && Number.isFinite(b) && a < b;
+}
 function toPublicProfile(profile) {
     return { id: profile.id, provider: profile.provider, label: profile.label, createdAt: profile.createdAt, updatedAt: profile.updatedAt, expiresAt: profile.expiresAt, refreshTokenExpiresAt: profile.refreshTokenExpiresAt, ...(profile.refresh ? { refresh: profile.refresh } : {}) };
 }