sidekick-shared 0.20.0 → 0.21.0

package/dist/accounts.js

@@ -44,6 +44,9 @@ exports.writeAccountRegistry = writeAccountRegistry;
 exports.readActiveClaudeAccount = readActiveClaudeAccount;
 exports.addCurrentAccount = addCurrentAccount;
 exports.switchToAccount = switchToAccount;
+exports.resolveActiveClaudeHome = resolveActiveClaudeHome;
+exports.applyActiveClaudeToLiveHome = applyActiveClaudeToLiveHome;
+exports.reconcileClaudeAuthState = reconcileClaudeAuthState;
 exports.removeAccount = removeAccount;
 exports.listAccounts = listAccounts;
 exports.getActiveAccount = getActiveAccount;
@@ -53,6 +56,7 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const credentialIO_1 = require("./credentialIO");
 const accountRegistry_1 = require("./accountRegistry");
+const claudeProfiles_1 = require("./claudeProfiles");
 // ── Paths ────────────────────────────────────────────────────────────────
 function getClaudeDir() {
     return path.join(os.homedir(), '.claude');
@@ -75,6 +79,9 @@ function getCredentialsDir() {
 function getConfigsDir() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'configs');
 }
+function getClaudeMigrationMarkerPath() {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'claude', '.profiles-migrated-v1');
+}
 // ── Directory bootstrap ──────────────────────────────────────────────────
 function ensureDirs() {
     for (const dir of [(0, accountRegistry_1.getAccountsDir)(), getCredentialsDir(), getConfigsDir()]) {
@@ -83,6 +90,7 @@ function ensureDirs() {
 }
 // ── Atomic file write ────────────────────────────────────────────────────
 function atomicWriteJson(filePath, data, mode = 0o600) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
     const tmp = filePath + '.tmp';
     const json = JSON.stringify(data, null, 2);
     // Validate we can re-parse before writing
@@ -90,6 +98,95 @@ function atomicWriteJson(filePath, data, mode = 0o600) {
     fs.writeFileSync(tmp, json, { encoding: 'utf8', mode });
     fs.renameSync(tmp, filePath);
 }
+function readJsonOrNull(filePath) {
+    try {
+        return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function readOauthAccountFromConfigPath(filePath) {
+    const parsed = readJsonOrNull(filePath);
+    return parsed?.oauthAccount ?? null;
+}
+function writeClaudeProfileConfig(uuid, oauthAccount) {
+    atomicWriteJson(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json'), { oauthAccount });
+}
+function writeClaudeProfileCredentials(uuid, credentials) {
+    (0, credentialIO_1.writeActiveCredentials)(credentials, (0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+}
+function writeClaudeProfileMirror(uuid, credentials, oauthAccount) {
+    writeClaudeProfileConfig(uuid, oauthAccount);
+    writeClaudeProfileCredentials(uuid, credentials);
+}
+function readFlatClaudeCredentials(uuid) {
+    return readJsonOrNull(path.join(getCredentialsDir(), `${uuid}.credentials.json`));
+}
+function readFlatClaudeOauthAccount(uuid) {
+    return readJsonOrNull(path.join(getConfigsDir(), `${uuid}.config.json`));
+}
+function readProfileClaudeOauthAccount(uuid) {
+    return readOauthAccountFromConfigPath(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json'));
+}
+function readStoredClaudeAccount(uuid) {
+    const profileCredentials = (0, credentialIO_1.readActiveCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+    const profileOauthAccount = readProfileClaudeOauthAccount(uuid);
+    if (profileCredentials && profileOauthAccount) {
+        return { credentials: profileCredentials, oauthAccount: profileOauthAccount };
+    }
+    const flatCredentials = readFlatClaudeCredentials(uuid);
+    const flatOauthAccount = readFlatClaudeOauthAccount(uuid);
+    if (flatCredentials && flatOauthAccount) {
+        try {
+            writeClaudeProfileMirror(uuid, flatCredentials, flatOauthAccount);
+        }
+        catch {
+            // Flat backups remain the fallback when profile materialization fails.
+        }
+        return { credentials: flatCredentials, oauthAccount: flatOauthAccount };
+    }
+    return null;
+}
+function readCurrentLiveOauthAccount() {
+    return readOauthAccountFromConfigPath(getClaudeConfigPath());
+}
+function backupCurrentClaudeLiveHome() {
+    const currentActive = readActiveClaudeAccount();
+    if (!currentActive)
+        return;
+    const originalCreds = (0, credentialIO_1.readActiveCredentials)();
+    const originalOauthAccount = readCurrentLiveOauthAccount();
+    if (originalCreds) {
+        try {
+            atomicWriteJson(path.join(getCredentialsDir(), `${currentActive.uuid}.credentials.json`), originalCreds);
+            writeClaudeProfileCredentials(currentActive.uuid, originalCreds);
+        }
+        catch {
+            // Best effort only.
+        }
+    }
+    if (originalOauthAccount) {
+        try {
+            atomicWriteJson(path.join(getConfigsDir(), `${currentActive.uuid}.config.json`), originalOauthAccount);
+            writeClaudeProfileConfig(currentActive.uuid, originalOauthAccount);
+        }
+        catch {
+            // Best effort only.
+        }
+    }
+}
+function mergeOauthAccountIntoLiveConfig(oauthAccount) {
+    let configObj = {};
+    try {
+        configObj = JSON.parse(fs.readFileSync(getClaudeConfigPath(), 'utf8'));
+    }
+    catch {
+        // File may not exist yet.
+    }
+    configObj.oauthAccount = oauthAccount;
+    atomicWriteJson(getClaudeConfigPath(), configObj);
+}
 // ── Registry operations ──────────────────────────────────────────────────
 function readAccountRegistry() {
     const registry = (0, accountRegistry_1.readSavedAccountRegistry)();
@@ -173,6 +270,10 @@ function addCurrentAccount(label) {
             existing.label = label;
         atomicWriteJson(path.join(getCredentialsDir(), `${active.uuid}.credentials.json`), credBlob);
         atomicWriteJson(path.join(getConfigsDir(), `${active.uuid}.config.json`), configBlob);
+        try {
+            writeClaudeProfileMirror(active.uuid, credBlob, configBlob);
+        }
+        catch { /* flat backups remain available */ }
         registry.activeAccountUuid = active.uuid;
         writeAccountRegistry(registry);
         return { success: true };
@@ -180,6 +281,10 @@ function addCurrentAccount(label) {
     // 6. New account — back up credentials
     atomicWriteJson(path.join(getCredentialsDir(), `${active.uuid}.credentials.json`), credBlob);
     atomicWriteJson(path.join(getConfigsDir(), `${active.uuid}.config.json`), configBlob);
+    try {
+        writeClaudeProfileMirror(active.uuid, credBlob, configBlob);
+    }
+    catch { /* flat backups remain available */ }
     // 7. Add entry
     registry.accounts.push({
         uuid: active.uuid,
@@ -201,10 +306,7 @@ function switchToAccount(uuid) {
     if (!target) {
         return { success: false, error: `Account ${uuid} not found in registry.` };
     }
-    if (registry.activeAccountUuid === uuid) {
-        return { success: true }; // Already active
-    }
-    // 1. Back up current credentials + config (for the currently-active account)
+    // 1. Back up current credentials + config (for whichever Claude account is live).
     let originalCreds = null;
     let originalConfig = null;
     originalCreds = (0, credentialIO_1.readActiveCredentials)();
@@ -212,46 +314,64 @@ function switchToAccount(uuid) {
         originalConfig = fs.readFileSync(getClaudeConfigPath(), 'utf8');
     }
     catch { /* no existing config to back up */ }
-    // Save current account's backup if we know who's active
-    const currentActive = readActiveClaudeAccount();
-    if (currentActive) {
+    try {
+        backupCurrentClaudeLiveHome();
+    }
+    catch { /* best effort */ }
+    try {
+        (0, accountRegistry_1.setActiveSavedAccount)('claude-code', uuid);
+    }
+    catch (err) {
+        return { success: false, error: `Failed to update account registry: ${err}` };
+    }
+    const applied = applyActiveClaudeToLiveHome();
+    if (!applied.success) {
+        try {
+            (0, accountRegistry_1.setActiveSavedAccount)('claude-code', registry.activeAccountUuid);
+        }
+        catch { /* rollback failed */ }
         if (originalCreds) {
             try {
-                atomicWriteJson(path.join(getCredentialsDir(), `${currentActive.uuid}.credentials.json`), originalCreds);
+                (0, credentialIO_1.writeActiveCredentials)(originalCreds);
             }
-            catch { /* best effort */ }
+            catch { /* rollback failed */ }
         }
         if (originalConfig) {
             try {
-                const parsed = JSON.parse(originalConfig);
-                if (parsed.oauthAccount) {
-                    atomicWriteJson(path.join(getConfigsDir(), `${currentActive.uuid}.config.json`), parsed.oauthAccount);
-                }
+                fs.writeFileSync(getClaudeConfigPath(), originalConfig);
             }
-            catch { /* best effort */ }
+            catch { /* rollback failed */ }
         }
+        return applied;
     }
-    // 2. Read target account's backed-up credentials + config
-    let targetCreds;
-    let targetOauthAccount;
-    try {
-        targetCreds = JSON.parse(fs.readFileSync(path.join(getCredentialsDir(), `${uuid}.credentials.json`), 'utf8'));
+    return applied;
+}
+function resolveActiveClaudeHome() {
+    const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
+    if (!active)
+        return getClaudeDir();
+    return (0, claudeProfiles_1.getClaudeProfileHome)(active.providerAccountId ?? active.id);
+}
+function applyActiveClaudeToLiveHome() {
+    const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
+    if (!active) {
+        return { success: false, error: 'No active Claude account found.' };
     }
-    catch {
-        return { success: false, error: `Backed-up credentials for ${target.email} not found.` };
+    const uuid = active.providerAccountId ?? active.id;
+    const stored = readStoredClaudeAccount(uuid);
+    if (!stored) {
+        return { success: false, error: `Stored credentials for ${active.email ?? uuid} not found.` };
     }
+    const originalCreds = (0, credentialIO_1.readActiveCredentials)();
+    let originalConfig = null;
     try {
-        targetOauthAccount = JSON.parse(fs.readFileSync(path.join(getConfigsDir(), `${uuid}.config.json`), 'utf8'));
-    }
-    catch {
-        return { success: false, error: `Backed-up config for ${target.email} not found.` };
+        originalConfig = fs.readFileSync(getClaudeConfigPath(), 'utf8');
     }
-    // 3. Write target credentials (platform-aware: Keychain on macOS, file on Linux)
+    catch { /* no existing config to back up */ }
     try {
-        (0, credentialIO_1.writeActiveCredentials)(targetCreds);
+        (0, credentialIO_1.writeActiveCredentials)(stored.credentials);
     }
     catch (err) {
-        // Rollback: restore original credentials
         if (originalCreds) {
             try {
                 (0, credentialIO_1.writeActiveCredentials)(originalCreds);
@@ -260,18 +380,10 @@ function switchToAccount(uuid) {
         }
         return { success: false, error: `Failed to write credentials: ${err}` };
     }
-    // 4. Merge target oauthAccount into current .claude.json
     try {
-        let configObj = {};
-        try {
-            configObj = JSON.parse(fs.readFileSync(getClaudeConfigPath(), 'utf8'));
-        }
-        catch { /* file may not exist yet */ }
-        configObj.oauthAccount = targetOauthAccount;
-        atomicWriteJson(getClaudeConfigPath(), configObj);
+        mergeOauthAccountIntoLiveConfig(stored.oauthAccount);
     }
     catch (err) {
-        // Rollback: restore original credentials and config
         if (originalCreds) {
             try {
                 (0, credentialIO_1.writeActiveCredentials)(originalCreds);
@@ -286,11 +398,39 @@ function switchToAccount(uuid) {
         }
         return { success: false, error: `Failed to write config: ${err}` };
     }
-    // 5. Update registry
-    registry.activeAccountUuid = uuid;
-    writeAccountRegistry(registry);
     return { success: true };
 }
+function reconcileClaudeAuthState() {
+    try {
+        const markerPath = getClaudeMigrationMarkerPath();
+        if (fs.existsSync(markerPath))
+            return;
+        const registry = (0, accountRegistry_1.readSavedAccountRegistry)();
+        if (registry) {
+            for (const profile of registry.accounts.filter(account => account.providerId === 'claude-code')) {
+                try {
+                    const uuid = profile.providerAccountId ?? profile.id;
+                    if ((0, credentialIO_1.readActiveCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(uuid)) && readProfileClaudeOauthAccount(uuid)) {
+                        continue;
+                    }
+                    const credentials = readFlatClaudeCredentials(uuid);
+                    const oauthAccount = readFlatClaudeOauthAccount(uuid);
+                    if (!credentials || !oauthAccount)
+                        continue;
+                    writeClaudeProfileMirror(uuid, credentials, oauthAccount);
+                }
+                catch {
+                    // Migration is best-effort per account.
+                }
+            }
+        }
+        fs.mkdirSync(path.dirname(markerPath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(markerPath, new Date().toISOString() + '\n', { encoding: 'utf8', mode: 0o600 });
+    }
+    catch {
+        // Reconciliation must never break startup.
+    }
+}
 // ── Remove account ───────────────────────────────────────────────────────
 function removeAccount(uuid) {
     const registry = readAccountRegistry();

package/dist/autoSwitch.d.ts

@@ -0,0 +1,70 @@
+import { type AccountEntry, type AccountManagerResult } from './accounts';
+import type { AccountProviderId, SavedAccountProfile } from './accountRegistry';
+import type { ProviderQuotaMap } from './providerQuota';
+import type { Disposable } from './quotaPoller';
+import type { QuotaState } from './quota';
+export interface AutoSwitchConfig {
+    enabled: boolean;
+    thresholdPct: number;
+}
+export declare const DEFAULT_AUTO_SWITCH_CONFIG: AutoSwitchConfig;
+export interface AutoSwitchCandidate {
+    accountId: string;
+    quota: QuotaState | null;
+    switchable?: boolean;
+}
+export interface AutoSwitchDecision {
+    switchTo: string;
+}
+export interface AutoSwitchActiveAccount {
+    accountId: string;
+    quota: QuotaState | null;
+}
+export interface AutoSwitchTransitionEvent {
+    provider: AccountProviderId;
+    from: string;
+    to: string;
+}
+interface QuotaServiceLike {
+    onUpdate(cb: (state: ProviderQuotaMap) => void): Disposable;
+}
+export interface AutoSwitchControllerOptions {
+    quotaService: QuotaServiceLike;
+    config?: AutoSwitchConfig;
+    getClaudeAccounts?: () => AccountEntry[];
+    getActiveClaudeAccount?: () => AccountEntry | null;
+    getCodexAccounts?: () => SavedAccountProfile[];
+    getActiveCodexAccount?: () => SavedAccountProfile | null;
+    readSnapshot?: (providerId: AccountProviderId, accountId: string) => QuotaState | null;
+    switchAccount?: (providerId: AccountProviderId, accountId: string) => AccountManagerResult;
+    onTransition?: (event: AutoSwitchTransitionEvent) => void;
+    log?: (message: string, error?: unknown) => void;
+    cooldownMs?: number;
+    now?: () => number;
+}
+export declare function decideAutoSwitch(_provider: AccountProviderId, active: AutoSwitchActiveAccount, candidates: AutoSwitchCandidate[], config?: AutoSwitchConfig): AutoSwitchDecision | null;
+export declare class AutoSwitchController implements Disposable {
+    private readonly quotaService;
+    private readonly getClaudeAccounts;
+    private readonly getActiveClaudeAccount;
+    private readonly getCodexAccounts;
+    private readonly getActiveCodexAccount;
+    private readonly readSnapshot;
+    private readonly switchAccount;
+    private readonly onTransition?;
+    private readonly log?;
+    private readonly cooldownMs;
+    private readonly now;
+    private config;
+    private subscription;
+    private readonly switchedDuringCrossing;
+    private readonly lastSwitchAt;
+    constructor(options: AutoSwitchControllerOptions);
+    start(): void;
+    stop(): void;
+    dispose(): void;
+    setConfig(config: AutoSwitchConfig): void;
+    private handleUpdate;
+    private handleProviderUpdate;
+}
+export {};

package/dist/autoSwitch.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutoSwitchController = exports.DEFAULT_AUTO_SWITCH_CONFIG = void 0;
+exports.decideAutoSwitch = decideAutoSwitch;
+const accounts_1 = require("./accounts");
+const accountManager_1 = require("./accountManager");
+const codexProfiles_1 = require("./codexProfiles");
+const quotaSnapshots_1 = require("./quotaSnapshots");
+exports.DEFAULT_AUTO_SWITCH_CONFIG = {
+    enabled: false,
+    thresholdPct: 90,
+};
+const MATERIAL_REMAINING_IMPROVEMENT_PCT = 5;
+function mergedConfig(config) {
+    return {
+        ...exports.DEFAULT_AUTO_SWITCH_CONFIG,
+        ...config,
+    };
+}
+function quotaUtilization(quota) {
+    if (!quota?.available)
+        return 0;
+    return Math.max(quota.fiveHour.utilization, quota.sevenDay.utilization);
+}
+function quotaRemaining(quota) {
+    if (!quota?.available)
+        return 0;
+    return Math.max(0, 100 - quotaUtilization(quota));
+}
+function decideAutoSwitch(_provider, active, candidates, config) {
+    const cfg = mergedConfig(config);
+    if (!cfg.enabled)
+        return null;
+    if (!active.quota?.available)
+        return null;
+    const activeUtilization = quotaUtilization(active.quota);
+    if (activeUtilization < cfg.thresholdPct)
+        return null;
+    const activeRemaining = quotaRemaining(active.quota);
+    const best = candidates
+        .filter(candidate => candidate.accountId !== active.accountId &&
+        candidate.switchable !== false &&
+        candidate.quota?.available)
+        .sort((a, b) => quotaRemaining(b.quota) - quotaRemaining(a.quota))[0];
+    if (!best)
+        return null;
+    if (quotaRemaining(best.quota) < activeRemaining + MATERIAL_REMAINING_IMPROVEMENT_PCT)
+        return null;
+    return { switchTo: best.accountId };
+}
+function runtimeStateToProvider(provider) {
+    return provider === 'claude' ? 'claude-code' : 'codex';
+}
+function accountIdFor(provider, account) {
+    return provider === 'claude-code'
+        ? account.uuid
+        : account.id;
+}
+class AutoSwitchController {
+    quotaService;
+    getClaudeAccounts;
+    getActiveClaudeAccount;
+    getCodexAccounts;
+    getActiveCodexAccount;
+    readSnapshot;
+    switchAccount;
+    onTransition;
+    log;
+    cooldownMs;
+    now;
+    config;
+    subscription = null;
+    switchedDuringCrossing = new Set();
+    lastSwitchAt = {};
+    constructor(options) {
+        this.quotaService = options.quotaService;
+        this.config = mergedConfig(options.config);
+        this.getClaudeAccounts = options.getClaudeAccounts ?? accounts_1.listAccounts;
+        this.getActiveClaudeAccount = options.getActiveClaudeAccount ?? accounts_1.getActiveAccount;
+        this.getCodexAccounts = options.getCodexAccounts ?? codexProfiles_1.listCodexAccounts;
+        this.getActiveCodexAccount = options.getActiveCodexAccount ?? codexProfiles_1.getActiveCodexAccount;
+        this.readSnapshot = options.readSnapshot ?? quotaSnapshots_1.readQuotaSnapshot;
+        this.switchAccount = options.switchAccount ?? accountManager_1.switchAccount;
+        this.onTransition = options.onTransition;
+        this.log = options.log;
+        this.cooldownMs = options.cooldownMs ?? 0;
+        this.now = options.now ?? Date.now;
+    }
+    start() {
+        if (this.subscription)
+            return;
+        this.subscription = this.quotaService.onUpdate(state => this.handleUpdate(state));
+    }
+    stop() {
+        this.subscription?.dispose();
+        this.subscription = null;
+    }
+    dispose() {
+        this.stop();
+    }
+    setConfig(config) {
+        this.config = mergedConfig(config);
+        if (!this.config.enabled) {
+            this.switchedDuringCrossing.clear();
+        }
+    }
+    handleUpdate(state) {
+        if (state.claude)
+            this.handleProviderUpdate('claude', state.claude);
+        if (state.codex)
+            this.handleProviderUpdate('codex', state.codex);
+    }
+    handleProviderUpdate(runtimeProvider, activeQuota) {
+        const providerId = runtimeStateToProvider(runtimeProvider);
+        const activeAccount = providerId === 'claude-code'
+            ? this.getActiveClaudeAccount()
+            : this.getActiveCodexAccount();
+        if (!activeAccount)
+            return;
+        const activeAccountId = accountIdFor(providerId, activeAccount);
+        if (quotaUtilization(activeQuota) < this.config.thresholdPct) {
+            this.switchedDuringCrossing.delete(providerId);
+        }
+        const accounts = providerId === 'claude-code'
+            ? this.getClaudeAccounts()
+            : this.getCodexAccounts();
+        if (accounts.length <= 1)
+            return;
+        const candidates = accounts.map(account => {
+            const accountId = accountIdFor(providerId, account);
+            return {
+                accountId,
+                quota: accountId === activeAccountId
+                    ? activeQuota
+                    : this.readSnapshot(providerId, accountId),
+            };
+        });
+        const decision = decideAutoSwitch(providerId, { accountId: activeAccountId, quota: activeQuota }, candidates, this.config);
+        if (!decision)
+            return;
+        if (this.switchedDuringCrossing.has(providerId))
+            return;
+        const previousSwitchAt = this.lastSwitchAt[providerId] ?? 0;
+        if (this.cooldownMs > 0 && this.now() - previousSwitchAt < this.cooldownMs)
+            return;
+        const result = this.switchAccount(providerId, decision.switchTo);
+        if (!result.success) {
+            this.log?.(`[AutoSwitch] Could not switch ${providerId} to ${decision.switchTo}.`, result.error);
+            return;
+        }
+        this.lastSwitchAt[providerId] = this.now();
+        this.switchedDuringCrossing.add(providerId);
+        this.onTransition?.({
+            provider: providerId,
+            from: activeAccountId,
+            to: decision.switchTo,
+        });
+    }
+}
+exports.AutoSwitchController = AutoSwitchController;

package/dist/claudeProfiles.d.ts

@@ -0,0 +1,12 @@
+export interface ClaudeProfileIdentity {
+    email: string;
+    uuid: string;
+}
+export declare function getClaudeProfilesDir(): string;
+export declare function getClaudeProfileHome(uuid: string): string;
+export declare function ensureClaudeProfileDirs(uuid: string): void;
+export declare function claudeKeychainSuffix(configDir: string): string;
+export declare function claudeKeychainService(configDir?: string): string;
+export declare function readClaudeProfileIdentity(home: string): ClaudeProfileIdentity | null;
+export declare function keychainServiceExists(service: string): boolean;
+export declare function isClaudeProfileAuthenticated(home: string): boolean;

package/dist/claudeProfiles.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getClaudeProfilesDir = getClaudeProfilesDir;
+exports.getClaudeProfileHome = getClaudeProfileHome;
+exports.ensureClaudeProfileDirs = ensureClaudeProfileDirs;
+exports.claudeKeychainSuffix = claudeKeychainSuffix;
+exports.claudeKeychainService = claudeKeychainService;
+exports.readClaudeProfileIdentity = readClaudeProfileIdentity;
+exports.keychainServiceExists = keychainServiceExists;
+exports.isClaudeProfileAuthenticated = isClaudeProfileAuthenticated;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const accountRegistry_1 = require("./accountRegistry");
+const DEFAULT_CLAUDE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
+function getClaudeProfilesDir() {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'claude', 'profiles');
+}
+function getClaudeProfileHome(uuid) {
+    return path.join(getClaudeProfilesDir(), uuid, 'home');
+}
+function ensureClaudeProfileDirs(uuid) {
+    fs.mkdirSync(getClaudeProfileHome(uuid), { recursive: true, mode: 0o700 });
+}
+function claudeKeychainSuffix(configDir) {
+    return (0, crypto_1.createHash)('sha256').update(configDir).digest('hex').slice(0, 8);
+}
+function claudeKeychainService(configDir) {
+    return configDir
+        ? `${DEFAULT_CLAUDE_KEYCHAIN_SERVICE}-${claudeKeychainSuffix(configDir)}`
+        : DEFAULT_CLAUDE_KEYCHAIN_SERVICE;
+}
+function readClaudeProfileIdentity(home) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(home, '.claude.json'), 'utf8'));
+        const email = raw?.oauthAccount?.emailAddress;
+        const uuid = raw?.oauthAccount?.accountUuid;
+        return typeof email === 'string' && typeof uuid === 'string'
+            ? { email, uuid }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function keychainServiceExists(service) {
+    try {
+        (0, child_process_1.execFileSync)('security', ['find-generic-password', '-s', service], {
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isClaudeProfileAuthenticated(home) {
+    const hasCredentials = process.platform === 'darwin'
+        ? keychainServiceExists(claudeKeychainService(home))
+        : fs.existsSync(path.join(home, '.credentials.json'));
+    return hasCredentials && readClaudeProfileIdentity(home) !== null;
+}

package/dist/codexProfiles.d.ts

@@ -1,4 +1,4 @@
-import type { SavedAccountProfile } from './accountRegistry';
+import type { AccountIdentityMetadata, SavedAccountProfile } from './accountRegistry';
 import type { AccountManagerResult } from './accounts';
 export interface CodexAccountManagerResult extends AccountManagerResult {
     needsLogin?: boolean;
@@ -9,12 +9,16 @@ export declare function getSystemCodexHome(): string;
 export declare function getCodexMonitoringHomes(): string[];
 export declare function getCodexProfilesDir(): string;
 export declare function getCodexProfileHome(profileId: string): string;
+export declare function readCodexAccountMetadata(codexHome: string): AccountIdentityMetadata;
+export declare function isCodexProfileAuthenticated(codexHome: string): boolean;
 export declare function listCodexAccounts(): SavedAccountProfile[];
 export declare function getActiveCodexAccount(): SavedAccountProfile | null;
 export declare function resolveSidekickCodexHome(): string;
 export declare function getCodexExecutionEnv(baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export declare function prepareCodexAccount(label: string): CodexAccountManagerResult;
-export declare function finalizeCodexAccount(profileId: string): CodexAccountManagerResult;
+export declare function finalizeCodexAccount(profileId: string, opts?: {
+    activate?: boolean;
+}): CodexAccountManagerResult;
 export declare function switchToCodexAccount(profileId: string): CodexAccountManagerResult;
 export declare function reconcileCodexAuthState(): void;
 export declare function removeCodexAccount(profileId: string): AccountManagerResult;