nterminal 1.3.7 → 1.3.9

package/dist/server/accounts/accountService.js

@@ -4,7 +4,9 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import os from 'node:os';
 import path from 'node:path';
+import { accountReloginReason } from '../../shared/accountRelogin.js';
 import { ProviderRequestError, requestAccountUsage, requestTokenRefresh, unavailableUsage } from './providerRequests.js';
+import { createPtyLoginLauncher, LOGIN_TIMEOUT_MS, LoginSessionError, ProviderLoginSession, validateLoginCode } from './loginSession.js';
 const VAULT_DIRECTORY = 'credential-vault';
 const VAULT_INDEX = 'index.json';
 const VAULT_KEY = 'key';
@@ -22,6 +24,9 @@ const PROVIDER_TERMINATE_GRACE_MS = 2_000;
 const TERMINATION_ACKNOWLEDGEMENT_TTL_MS = 5 * 60_000;
 const USAGE_CACHE_TTL_MS = 2 * 60_000;
 const USAGE_FAILURE_TTL_MS = 30_000;
+const LOGIN_COMPLETE_EXIT_WAIT_MS = 5_000;
+const LOGIN_NOTICE_TTL_MS = 10 * 60_000;
+const LOGIN_EXPIRY_RETRY_MS = 500;
 export class AccountServiceError extends Error {
     code;
     constructor(code, message = code) {
@@ -32,7 +37,7 @@ export class AccountServiceError extends Error {
     get statusCode() {
         if (this.code === 'preview_mode')
             return 403;
-        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending', 'active_cli_refresh_deferred'].includes(this.code))
+        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending', 'active_cli_refresh_deferred', 'account_login_code_not_expected', 'account_login_process_unavailable', 'account_login_code_attempts_exceeded'].includes(this.code))
             return 409;
         return 400;
     }
@@ -63,6 +68,12 @@ export class AccountService {
     paneProcessResolver;
     processTerminator;
     processSnapshotReader;
+    // In-popup sign-ins: one private PTY per provider, never a workspace terminal.
+    loginSessions = new Map();
+    loginNotices = new Map();
+    loginLauncher;
+    loginTimeoutMs;
+    loginExitWaitMs;
     constructor(config, terminalManager, options = {}) {
         this.config = config;
         this.terminalManager = terminalManager;
@@ -74,13 +85,17 @@ export class AccountService {
         this.now = options.now ?? (() => new Date());
         this.fetcher = options.fetcher ?? ((...args) => fetch(...args));
         this.onDiagnostic = options.onDiagnostic ?? (() => undefined);
-        this.processLister = options.processLister ?? (async (provider) => providerProcesses(provider, await this.listProcessSnapshot()));
+        // The in-popup login CLI is NTerminal's own child, not a user session.
+        this.processLister = options.processLister ?? (async (provider) => providerProcesses(provider, withoutProcessTrees(await this.listProcessSnapshot(), this.loginProcessIds())));
         this.paneProcessResolver = options.paneProcessResolver ?? (options.processLister
             ? async () => new Map()
             : async () => resolvePaneProcesses(this.config.tmuxSocket, await this.listProcessSnapshot()));
         this.processProbe = options.processProbe ?? (async (provider) => (await this.processLister(provider)).length > 0);
-        this.processTerminator = options.processTerminator ?? terminateProviderProcesses;
+        this.processTerminator = options.processTerminator ?? ((provider, processes) => terminateProviderProcesses(provider, processes, this.loginProcessIds()));
         this.processSnapshotReader = options.processSnapshot ?? listUserProcesses;
+        this.loginLauncher = options.loginLauncher ?? createPtyLoginLauncher();
+        this.loginTimeoutMs = options.loginTimeoutMs ?? LOGIN_TIMEOUT_MS;
+        this.loginExitWaitMs = options.loginExitWaitMs ?? LOGIN_COMPLETE_EXIT_WAIT_MS;
     }
     // Reject overlapping mutations instead of accumulating requests behind OAuth I/O.
     async mutate(operation) {
@@ -111,6 +126,32 @@ export class AccountService {
     beginLogin(provider) {
         return this.mutate(() => this.beginLoginUnlocked(provider));
     }
+    // Forwards a pasted Claude authorization code to the login CLI. Only a
+    // strictly shaped `code#state` value is written, followed by Enter.
+    async submitLoginCode(provider, code) {
+        if (this.config.previewMode)
+            throw new AccountServiceError('preview_mode');
+        if (this.disposed)
+            throw new AccountServiceError('account_operation_busy');
+        const valid = validateLoginCode(provider, code);
+        if (!valid)
+            throw new AccountServiceError(provider === 'claude' ? 'account_login_code_invalid' : 'account_login_code_not_expected');
+        const index = await this.readIndex();
+        if (!index.pending[provider])
+            throw new AccountServiceError('account_login_not_pending');
+        const session = this.loginSessions.get(provider);
+        if (!session)
+            throw new AccountServiceError('account_login_process_unavailable');
+        try {
+            session.submitCode(valid);
+        }
+        catch (error) {
+            if (error instanceof LoginSessionError)
+                throw new AccountServiceError(error.code);
+            throw error;
+        }
+        return this.status();
+    }
     completeLogin(provider, label) {
         return this.mutate(() => this.completeLoginUnlocked(provider, label));
     }
@@ -210,7 +251,12 @@ export class AccountService {
         await Promise.all(['codex', 'claude'].map(async (provider) => {
             try {
                 const representedPanes = new Set(running.filter((pane) => pane.provider === provider).map((pane) => pane.terminalId));
-                processes.set(provider, (await this.processLister(provider))
+                const listed = await this.processLister(provider);
+                const daemonHelpers = daemonDescendants(listed);
+                processes.set(provider, listed
+                    // Helpers the shared daemon spawns (e.g. codex-code-mode-host) are part
+                    // of the daemon entry, not separate sessions.
+                    .filter((entry) => !daemonHelpers.has(entry.pid))
                     .filter((entry) => isCodexDaemon(entry) || !representedPanes.has(paneProcesses.get(entry.pid) ?? ''))
                     .map((entry) => ({ pid: entry.pid, provider, command: entry.command, ...(isCodexDaemon(entry) ? { role: 'daemon' } : {}) })));
             }
@@ -223,13 +269,20 @@ export class AccountService {
         await Promise.all(['codex', 'claude'].map(async (provider) => {
             pendingReady.set(provider, Boolean(refreshed.pending[provider] && await this.readCredentialFile(provider).catch(() => null)));
         }));
+        this.expireLoginNotices();
         return {
             providers: ['codex', 'claude'].map((provider) => this.providerStatus(refreshed, provider, running, processes.get(provider) ?? [], processCheckUnavailable, pendingReady.get(provider) === true))
         };
     }
+    // Providers with at least one saved login that needs a new sign-in. Cheap
+    // (index metadata only), so the server list can poll it with system stats.
+    async reloginRequired() {
+        const index = await this.readIndex();
+        const now = this.now().getTime();
+        return ['codex', 'claude'].filter((provider) => index.profiles.some((profile) => profile.provider === provider && accountReloginReason(profile, now) !== null));
+    }
     async selectUnlocked(provider, profileId) {
         const index = await this.readIndex();
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (index.pending[provider])
             throw new AccountServiceError('account_login_already_pending');
         await this.captureActiveCredentials(index, provider);
@@ -237,6 +290,8 @@ export class AccountService {
         if (!profile)
             throw new AccountServiceError('account_not_found');
         if (index.active[provider] === profile.id) {
+            if (clearExternalSwitch(index, provider))
+                await this.writeIndex(index);
             this.clearTerminationAcknowledgement(provider);
             return this.status();
         }
@@ -246,6 +301,7 @@ export class AccountService {
         try {
             await this.writeCredentialFile(provider, credentials);
             index.active[provider] = profile.id;
+            clearExternalSwitch(index, provider);
             await this.writeIndex(index);
         }
         catch (error) {
@@ -253,11 +309,10 @@ export class AccountService {
                 await this.writeCredentialFile(provider, current);
             else
                 await this.removeCredentialFile(provider);
-            if (previousId)
-                await rm(this.profilePath(previousId), { force: true });
             throw error;
         }
-        await rm(this.profilePath(profile.id), { force: true });
+        // The selected profile's vault copy is exactly what was just published, so
+        // it already is the active backup. The previous account kept its archive.
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
@@ -273,6 +328,8 @@ export class AccountService {
             throw new AccountServiceError('cannot_remove_active_account');
         }
         index.profiles = index.profiles.filter((candidate) => candidate.id !== profile.id);
+        if (index.externalSwitch?.[provider]?.fromProfileId === profile.id)
+            clearExternalSwitch(index, provider);
         await this.writeIndex(index);
         await rm(this.profilePath(profile.id), { force: true });
         this.retryAfter.delete(profile.id);
@@ -282,7 +339,6 @@ export class AccountService {
     }
     async beginLoginUnlocked(provider) {
         const index = await this.readIndex();
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (index.pending[provider])
             throw new AccountServiceError('account_login_already_pending');
         await this.captureActiveCredentials(index, provider);
@@ -290,28 +346,36 @@ export class AccountService {
         index.pending[provider] = {
             provider,
             previousProfileId: index.active[provider] ?? null,
-            startedAt: this.now().toISOString(),
-            terminalId: null
+            startedAt: this.now().toISOString()
         };
         delete index.active[provider];
         await this.writeIndex(index);
-        let terminal;
+        let session;
         try {
+            // `codex login` revokes the tokens of an auth.json it finds, so the CLI
+            // must start only after the archived live file is gone.
             if (current)
                 await this.removeCredentialFile(provider);
-            terminal = await this.terminalManager.createTerminal({ cwd: this.config.workspaceRoot, cols: 100, rows: 30 });
-            const command = provider === 'codex' ? 'codex login --device-auth' : 'claude auth login';
-            const wrote = await this.terminalManager.writeToTerminal(terminal.id, `${command}\r`);
-            if (!wrote)
-                throw new AccountServiceError('account_login_terminal_unavailable');
-            index.pending[provider].terminalId = terminal.id;
-            await this.writeIndex(index);
+            await this.stopLoginSession(provider);
+            let launched;
+            try {
+                launched = this.loginLauncher(provider, { homeDir: this.homeDir });
+            }
+            catch {
+                throw new AccountServiceError('account_login_process_unavailable');
+            }
+            session = new ProviderLoginSession(provider, launched, () => this.now().getTime(), this.loginTimeoutMs, (expired) => void this.expireLogin(provider, expired));
+            this.loginSessions.set(provider, session);
+            this.loginNotices.delete(provider);
             this.clearTerminationAcknowledgement(provider);
-            return { terminal, command };
+            return this.status();
         }
         catch (error) {
-            if (terminal)
-                await this.terminalManager.closeTerminal(terminal.id);
+            if (session) {
+                if (this.loginSessions.get(provider) === session)
+                    this.loginSessions.delete(provider);
+                await session.terminate();
+            }
             if (current)
                 await this.writeCredentialFile(provider, current);
             if (index.active[provider] === undefined && index.pending[provider]?.previousProfileId) {
@@ -319,9 +383,6 @@ export class AccountService {
             }
             delete index.pending[provider];
             await this.writeIndex(index);
-            const restoredId = index.active[provider];
-            if (restoredId)
-                await rm(this.profilePath(restoredId), { force: true });
             throw error;
         }
     }
@@ -330,24 +391,34 @@ export class AccountService {
         const pending = index.pending[provider];
         if (!pending)
             throw new AccountServiceError('account_login_not_pending');
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
+        if (!await this.readCredentialFile(provider))
+            throw new AccountServiceError('account_login_not_complete');
+        // Let the CLI finish its own post-login writes before the file is captured.
+        const session = this.loginSessions.get(provider);
+        if (session?.running && !await session.waitForExit(this.loginExitWaitMs))
+            await session.terminate();
         const credentials = await this.readCredentialFile(provider);
         if (!credentials)
             throw new AccountServiceError('account_login_not_complete');
         const profile = await this.storeProfile(index, provider, credentials, label);
+        // Back up the new active login before committing it as active.
+        await this.writeVaultCredentials(profile.id, credentials);
         index.active[provider] = profile.id;
         delete index.pending[provider];
+        clearExternalSwitch(index, provider);
         await this.writeIndex(index);
-        await rm(this.profilePath(profile.id), { force: true });
+        if (this.loginSessions.get(provider) === session)
+            this.loginSessions.delete(provider);
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
     async cancelLoginUnlocked(provider) {
+        // Stop the CLI first so it cannot write a credential after the restore.
+        await this.stopLoginSession(provider);
         const index = await this.readIndex();
         const pending = index.pending[provider];
         if (!pending)
             return this.status();
-        await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (pending.previousProfileId) {
             const credentials = await this.readVaultCredentials(pending.previousProfileId);
             await this.writeCredentialFile(provider, credentials);
@@ -358,9 +429,6 @@ export class AccountService {
         }
         delete index.pending[provider];
         await this.writeIndex(index);
-        const restoredId = index.active[provider];
-        if (restoredId)
-            await rm(this.profilePath(restoredId), { force: true });
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
@@ -386,6 +454,68 @@ export class AccountService {
         if (this.refreshTimer)
             clearInterval(this.refreshTimer);
         this.refreshTimer = null;
+        // The pending entry survives in the index; after a restart the dialog
+        // reports the missing login process and offers to cancel and restore.
+        for (const session of this.loginSessions.values())
+            session.dispose();
+        this.loginSessions.clear();
+    }
+    loginProcessIds() {
+        return [...this.loginSessions.values()].filter((session) => session.running).map((session) => session.pid);
+    }
+    async stopLoginSession(provider) {
+        const session = this.loginSessions.get(provider);
+        if (!session)
+            return;
+        this.loginSessions.delete(provider);
+        await session.terminate();
+    }
+    // Timeout: stop the CLI and restore the previous credential through the
+    // normal cancel path, retrying while another account operation holds the lock.
+    async expireLogin(provider, session) {
+        await session.terminate();
+        for (let attempt = 0; attempt < 120 && !this.disposed; attempt += 1) {
+            if (this.loginSessions.get(provider) !== session)
+                return;
+            try {
+                await this.cancelLogin(provider);
+                this.loginNotices.set(provider, { code: 'login_timed_out', at: this.now().toISOString() });
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof AccountServiceError) || error.code !== 'account_operation_busy')
+                    return;
+                await sleep(LOGIN_EXPIRY_RETRY_MS);
+            }
+        }
+    }
+    expireLoginNotices() {
+        for (const [provider, notice] of this.loginNotices) {
+            if (this.now().getTime() - Date.parse(notice.at) > LOGIN_NOTICE_TTL_MS)
+                this.loginNotices.delete(provider);
+        }
+    }
+    loginState(provider, ready) {
+        const session = this.loginSessions.get(provider);
+        if (!session) {
+            return ready ? { phase: 'done' } : {
+                phase: 'failed',
+                message: 'The sign-in process is no longer running (NTerminal may have restarted). Cancel to restore the previous account, then try again.'
+            };
+        }
+        const state = session.state();
+        if (ready) {
+            // The credential exists; wait for the CLI to report success or exit.
+            if (session.succeeded || !session.running)
+                return { phase: 'done' };
+            return { ...state, phase: 'completing' };
+        }
+        if (state.phase === 'done') {
+            return session.running ? { ...state, phase: 'completing' } : {
+                ...state, phase: 'failed', message: 'The CLI reported success, but no credential file was written. Cancel and try again.'
+            };
+        }
+        return state;
     }
     async refreshExpiringProfiles() {
         if (this.refreshInFlight || this.disposed || this.config.previewMode || this.operationInFlight)
@@ -486,7 +616,9 @@ export class AccountService {
             runningProcesses,
             processCheckUnavailable,
             terminationAcknowledged: this.hasTerminationAcknowledgement(provider),
-            pendingLogin: pending ? { startedAt: pending.startedAt, ready: pendingReady, terminalId: pending.terminalId ?? null } : null,
+            pendingLogin: pending ? { startedAt: pending.startedAt, ready: pendingReady, login: this.loginState(provider, pendingReady) } : null,
+            loginNotice: pending ? null : this.loginNotices.get(provider) ?? null,
+            lastExternalSwitch: index.externalSwitch?.[provider] ?? null,
             credentialPresent: Boolean(profile || pending || false)
         };
     }
@@ -498,12 +630,10 @@ export class AccountService {
             return provider ? [{ terminalId: terminal.id, provider, title: terminal.title, cwd: terminal.cwd }] : [];
         });
     }
-    async assertNoRunningPanes(provider, options = {}) {
-        const acknowledged = options.allowTerminationAcknowledgement === true && this.hasTerminationAcknowledgement(provider);
-        if ((!acknowledged && this.runningPanes().some((pane) => pane.provider === provider)) || await this.processProbe(provider)) {
-            throw new AccountServiceError('provider_panes_running');
-        }
-    }
+    // Running provider sessions are advisory for account changes: the dialog lists
+    // them, and they keep the account they started with until restarted. Only
+    // refreshing the ACTIVE account's credential stays guarded, because rotating
+    // its refresh token would invalidate the running CLI's copy.
     async terminateProviderSessionsUnlocked(provider) {
         const processes = await this.processLister(provider);
         this.clearTerminationAcknowledgement(provider);
@@ -559,51 +689,102 @@ export class AccountService {
         }
         if (JSON.stringify(index) !== before)
             await this.writeIndex(index);
-        // Only metadata is retained for active accounts. A duplicate can exist
-        // briefly during a switch, until the source file and index are committed.
-        for (const provider of providers) {
-            const id = index.active[provider];
-            if (id)
-                await rm(this.profilePath(id), { force: true });
-        }
     }
+    // The live CLI file is the source of truth for the active account. Every
+    // newer live credential NTerminal observes is also copied into the active
+    // profile's encrypted vault backup, so an external overwrite (another login,
+    // or a stale CLI writing its old account back) never loses the account that
+    // was active: it stays in the vault and can be selected again.
     async captureActiveCredential(index, provider) {
         const credentials = await this.readCredentialFile(provider);
         const previousId = index.active[provider];
         if (!credentials) {
+            if (!previousId)
+                return;
             delete index.active[provider];
-            await this.removeUnavailableProfile(index, previousId);
+            await this.deactivateProfile(index, provider, previousId, null);
             return;
         }
         const fingerprint = fingerprintFor(provider, credentials);
         const credentialHash = hashCredential(credentials);
         const existing = index.profiles.find((profile) => profile.provider === provider && (profile.fingerprint === fingerprint || profile.credentialHash === credentialHash));
+        if (existing && existing.id === previousId) {
+            if (existing.credentialHash !== credentialHash) {
+                // The active account's CLI rotated or re-wrote it: the live file wins.
+                await this.updateProfile(existing, provider, credentials);
+                await this.backupLiveCredential(existing, credentials, false);
+            }
+            else if (!await this.hasVaultCredentials(existing.id)) {
+                // Vaults written before active backups existed: create it once.
+                await this.writeVaultCredentials(existing.id, credentials);
+            }
+            return;
+        }
+        // The live file now holds a different account than the index says.
+        let profile;
         if (existing) {
             if (existing.credentialHash !== credentialHash)
                 await this.updateProfile(existing, provider, credentials);
-            index.active[provider] = existing.id;
-            if (previousId !== existing.id)
-                await this.removeUnavailableProfile(index, previousId);
-            return;
+            profile = existing;
+        }
+        else {
+            profile = await this.storeProfile(index, provider, credentials);
         }
-        const profile = await this.storeProfile(index, provider, credentials);
+        // A stale CLI may write back tokens older than this profile's vault copy
+        // (renewed while it was inactive); keep the newer copy for a later Use.
+        await this.backupLiveCredential(profile, credentials, true);
         index.active[provider] = profile.id;
-        if (previousId !== profile.id)
-            await this.removeUnavailableProfile(index, previousId);
-    }
-    async removeUnavailableProfile(index, id) {
-        if (!id)
+        if (previousId)
+            await this.deactivateProfile(index, provider, previousId, profile.id);
+    }
+    // Copies a live credential into the profile's vault backup. With
+    // keepNewerBackup, a backup that holds a strictly newer credential for the
+    // same account is kept instead. The live file itself is never changed here.
+    async backupLiveCredential(profile, live, keepNewerBackup) {
+        const backup = await this.readVaultCredentials(profile.id).catch(() => null);
+        if (backup && keepNewerBackup && stableIdentity(profile.provider, backup) === stableIdentity(profile.provider, live) && isOlderCredential(profile.provider, live, backup)) {
+            return backup;
+        }
+        if (!backup || hashCredential(backup) !== hashCredential(live))
+            await this.writeVaultCredentials(profile.id, live);
+        return live;
+    }
+    // A profile stops being active because the live file changed outside
+    // NTerminal. Its backup becomes its saved credential. Profiles without a
+    // backup (vaults from before active backups) cannot be restored and are
+    // dropped, as before.
+    async deactivateProfile(index, provider, id, toProfileId) {
+        const profile = index.profiles.find((entry) => entry.id === id);
+        if (!profile)
             return;
+        let backup;
         try {
-            await stat(this.profilePath(id));
+            backup = await this.readVaultCredentials(id);
         }
         catch (error) {
-            if (!isNotFound(error))
+            if (!(error instanceof AccountServiceError) || await this.hasVaultCredentials(id))
                 throw error;
-            index.profiles = index.profiles.filter((profile) => profile.id !== id);
+            index.profiles = index.profiles.filter((entry) => entry.id !== id);
             this.retryAfter.delete(id);
+            return;
         }
+        if (hashCredential(backup) !== profile.credentialHash)
+            await this.updateProfile(profile, provider, backup);
+        index.externalSwitch = { ...index.externalSwitch, [provider]: { at: this.now().toISOString(), fromProfileId: id, toProfileId } };
     }
+    async hasVaultCredentials(id) {
+        try {
+            await stat(this.profilePath(id));
+            return true;
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return false;
+            throw error;
+        }
+    }
+    // Before NTerminal itself replaces the live file (switch or new login), make
+    // sure the outgoing account's vault copy holds its newest credential.
     async archiveActiveCredential(index, provider) {
         const credentials = await this.readCredentialFile(provider);
         const profile = index.profiles.find((entry) => entry.id === index.active[provider]);
@@ -611,7 +792,12 @@ export class AccountService {
             return null;
         if (!profile || profile.credentialHash !== hashCredential(credentials))
             throw new AccountServiceError('account_credential_changed');
-        await this.writeVaultCredentials(profile.id, credentials);
+        // The live hash matches the last synchronization, so the backup can only
+        // differ if it was kept as newer when this account became live again.
+        const kept = await this.backupLiveCredential(profile, credentials, true);
+        // Inactive profiles describe their vault copy.
+        if (kept !== credentials)
+            await this.updateProfile(profile, provider, kept);
         return credentials;
     }
     // A blank label only names new profiles; re-authenticating an existing
@@ -665,7 +851,11 @@ export class AccountService {
         }
         // Idle describes a conversation, not the CLI's background auth work. Until
         // we can delegate to its native auth owner, never compete with a live CLI.
-        if (active)
+        // The same applies to an account an external write just displaced: CLIs
+        // started while it was active still hold its refresh token. The active
+        // account is always refreshed from the live file, never from its backup.
+        const displaced = index.externalSwitch?.[profile.provider]?.fromProfileId === profile.id;
+        if (active || displaced)
             await this.assertNoRefreshOwner(profile.provider);
         let refreshResponse;
         try {
@@ -706,8 +896,11 @@ export class AccountService {
             }
             // The live credential is shared by every pane for this OS user. The
             // compare above preserves an external CLI refresh or login that won the
-            // race; otherwise atomically publish the one rotated credential.
+            // race; otherwise atomically publish the one rotated credential, then
+            // mirror it into the active backup. If the backup write fails, the next
+            // synchronization copies the newer live file.
             await this.writeCredentialFile(profile.provider, next);
+            await this.writeVaultCredentials(profile.id, next);
         }
         else {
             await this.writeVaultCredentials(profile.id, next);
@@ -735,7 +928,8 @@ export class AccountService {
                 version: 1,
                 profiles: Array.isArray(parsed.profiles) ? parsed.profiles.filter(isVaultProfile) : [],
                 active: isRecord(parsed.active) ? parsed.active : {},
-                pending: isRecord(parsed.pending) ? parsed.pending : {}
+                pending: isRecord(parsed.pending) ? parsed.pending : {},
+                ...(isRecord(parsed.externalSwitch) ? { externalSwitch: parseExternalSwitches(parsed.externalSwitch) } : {})
             };
         }
         catch (error) {
@@ -929,14 +1123,22 @@ async function listUserProcesses() {
     const getuid = process.getuid;
     if (!getuid)
         throw new Error('unsupported');
-    const { stdout } = await execFileAsync('ps', ['-u', String(getuid()), '-o', 'pid=,ppid=,comm=,args='], {
+    const { stdout } = await execFileAsync('ps', ['-u', String(getuid()), '-o', 'pid=,ppid=,stat=,comm=,args='], {
         timeout: 3_000, maxBuffer: 4 * 1024 * 1024, encoding: 'utf8'
     });
+    return parseProcessSnapshot(stdout);
+}
+// Zombie (Z) and dead (X) entries have exited and cannot be signalled; only
+// their parent can reap them (e.g. an old Codex daemon under its updater).
+// They are not running providers.
+export function parseProcessSnapshot(stdout) {
     return stdout.split('\n').flatMap((line) => {
-        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/);
+        const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\S+)\s+(\S+)\s*(.*)$/);
         if (!match)
             return [];
-        const [, pidText, ppidText, command, args] = match;
+        const [, pidText, ppidText, stat, command, args] = match;
+        if (/^[ZX]/.test(stat))
+            return [];
         const pid = Number.parseInt(pidText, 10);
         const ppid = Number.parseInt(ppidText, 10);
         return Number.isSafeInteger(pid) && Number.isSafeInteger(ppid) ? [{ pid, ppid, command: command, args: args }] : [];
@@ -963,8 +1165,8 @@ function displayProcessCommand(command) {
     const basename = path.basename(command);
     return basename.length <= 80 ? basename : basename.slice(0, 80);
 }
-async function terminateProviderProcesses(provider, _processes) {
-    const snapshot = await listUserProcesses();
+async function terminateProviderProcesses(provider, _processes, excludedRoots = []) {
+    const snapshot = withoutProcessTrees(await listUserProcesses(), excludedRoots);
     const daemons = provider === 'codex' ? snapshot.filter(isCodexDaemon) : [];
     // Shared daemon descendants include work for multiple TUI clients. Stop the
     // interactive clients first, then let the daemon's lifecycle command stop it.
@@ -982,7 +1184,7 @@ async function terminateProviderProcesses(provider, _processes) {
         signalProcess(pid, 'SIGTERM');
     if (targetPids.length > 0) {
         await sleep(PROVIDER_TERMINATE_GRACE_MS);
-        const survivors = new Set(providerProcessTree(provider, await listUserProcesses()));
+        const survivors = new Set(providerProcessTree(provider, withoutProcessTrees(await listUserProcesses(), excludedRoots)));
         for (const pid of targetPids)
             if (survivors.has(pid))
                 signalProcess(pid, 'SIGKILL');
@@ -1005,6 +1207,39 @@ async function stopCodexDaemon(daemons) {
     }
     throw new AccountServiceError('codex_daemon_stop_failed');
 }
+// Drops the given processes and all their descendants from a snapshot.
+function withoutProcessTrees(entries, roots) {
+    if (roots.length === 0)
+        return entries;
+    const excluded = new Set(roots);
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const entry of entries)
+            if (excluded.has(entry.ppid) && !excluded.has(entry.pid)) {
+                excluded.add(entry.pid);
+                changed = true;
+            }
+    }
+    return entries.filter((entry) => !excluded.has(entry.pid));
+}
+function daemonDescendants(entries) {
+    const parents = new Map(entries.map((entry) => [entry.pid, entry.ppid]));
+    const daemons = new Set(entries.filter(isCodexDaemon).map((entry) => entry.pid));
+    const out = new Set();
+    for (const entry of entries) {
+        if (daemons.has(entry.pid))
+            continue;
+        const seen = new Set();
+        for (let pid = entry.ppid; pid > 0 && !seen.has(pid); pid = parents.get(pid) ?? 0) {
+            if (daemons.has(pid)) {
+                out.add(entry.pid);
+                break;
+            }
+            seen.add(pid);
+        }
+    }
+    return out;
+}
 function isCodexDaemon(entry) {
     const args = entry.args.trim().split(/\s+/);
     return path.basename(args[0] ?? '') === 'codex' && args[1] === 'app-server'
@@ -1044,6 +1279,31 @@ function signalProcess(pid, signal) {
 function sleep(milliseconds) {
     return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
+function clearExternalSwitch(index, provider) {
+    if (!index.externalSwitch?.[provider])
+        return false;
+    const { [provider]: _cleared, ...rest } = index.externalSwitch;
+    index.externalSwitch = rest;
+    return true;
+}
+function parseExternalSwitches(value) {
+    const result = {};
+    for (const provider of ['codex', 'claude']) {
+        const entry = value[provider];
+        if (isRecord(entry) && typeof entry.at === 'string' && typeof entry.fromProfileId === 'string' && (entry.toProfileId === null || typeof entry.toProfileId === 'string')) {
+            result[provider] = { at: entry.at, fromProfileId: entry.fromProfileId, toProfileId: entry.toProfileId };
+        }
+    }
+    return result;
+}
+// True when `candidate` is provably older than `reference`: both carry an
+// access-token expiry and the candidate's is earlier. Unknown timing is never
+// treated as older, so the live file wins by default.
+function isOlderCredential(provider, candidate, reference) {
+    const a = Date.parse(credentialTiming(provider, candidate).expiresAt ?? '');
+    const b = Date.parse(credentialTiming(provider, reference).expiresAt ?? '');
+    return Number.isFinite(a) && Number.isFinite(b) && a < b;
+}
 function toPublicProfile(profile) {
     return { id: profile.id, provider: profile.provider, label: profile.label, createdAt: profile.createdAt, updatedAt: profile.updatedAt, expiresAt: profile.expiresAt, refreshTokenExpiresAt: profile.refreshTokenExpiresAt, ...(profile.refresh ? { refresh: profile.refresh } : {}) };
 }