sidekick-shared 0.21.2 → 0.21.4

package/dist/codexProfiles.d.ts

@@ -1,4 +1,4 @@
-import type { AccountIdentityMetadata, SavedAccountProfile } from './accountRegistry';
+import type { AccountIdentityMetadata, ResolvedActiveAccount, SavedAccountProfile } from './accountRegistry';
 import type { AccountManagerResult } from './accounts';
 export interface CodexAccountManagerResult extends AccountManagerResult {
     needsLogin?: boolean;
@@ -14,6 +14,20 @@ export declare function isCodexProfileAuthenticated(codexHome: string): boolean;
 export declare function listCodexAccounts(): SavedAccountProfile[];
 export declare function getActiveCodexAccount(): SavedAccountProfile | null;
 export declare function resolveSidekickCodexHome(): string;
+/**
+ * Resolves the *currently logged-in* Codex account for display, preferring the
+ * live `auth.json` identity over the saved registry pointer (which only sidekick's
+ * own switch flow updates and therefore goes stale after a native `codex login`).
+ *
+ * Uses the cheap JWT decode from `auth.json` directly — NOT `readCodexAccountMetadata`,
+ * whose fallback spawns `codex login status` (a multi-second subprocess) unsuitable
+ * for a render path.
+ *
+ * Safe self-heal: when the live identity unambiguously matches a saved profile that
+ * isn't the current active pointer, the pointer is re-pointed so registry-keyed data
+ * (quota history, auto-switch) tracks reality too. Never creates or deletes profiles.
+ */
+export declare function resolveActiveCodexAccount(): ResolvedActiveAccount;
 export declare function getCodexExecutionEnv(baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export declare function prepareCodexAccount(label: string): CodexAccountManagerResult;
 export declare function finalizeCodexAccount(profileId: string, opts?: {

package/dist/codexProfiles.js

@@ -42,6 +42,7 @@ exports.isCodexProfileAuthenticated = isCodexProfileAuthenticated;
 exports.listCodexAccounts = listCodexAccounts;
 exports.getActiveCodexAccount = getActiveCodexAccount;
 exports.resolveSidekickCodexHome = resolveSidekickCodexHome;
+exports.resolveActiveCodexAccount = resolveActiveCodexAccount;
 exports.getCodexExecutionEnv = getCodexExecutionEnv;
 exports.prepareCodexAccount = prepareCodexAccount;
 exports.finalizeCodexAccount = finalizeCodexAccount;
@@ -121,7 +122,9 @@ function atomicWriteJson(filePath, data, mode = 0o600) {
         try {
             fs.unlinkSync(tmp);
         }
-        catch { /* nothing to clean up */ }
+        catch {
+            /* nothing to clean up */
+        }
         throw err;
     }
 }
@@ -139,7 +142,9 @@ function atomicWriteFile(filePath, content, mode = 0o600) {
         try {
             fs.unlinkSync(tmp);
         }
-        catch { /* nothing to clean up */ }
+        catch {
+            /* nothing to clean up */
+        }
         throw err;
     }
 }
@@ -216,12 +221,8 @@ function readAuthIdentityFromRaw(raw) {
     const workspaceId = typeof authClaims?.chatgpt_account_id === 'string'
         ? authClaims.chatgpt_account_id
         : parsed.tokens?.account_id;
-    const planType = typeof authClaims?.chatgpt_plan_type === 'string'
-        ? authClaims.chatgpt_plan_type
-        : undefined;
-    const authMode = parsed.OPENAI_API_KEY || parsed.auth_mode === 'api_key'
-        ? 'api-key'
-        : 'chatgpt';
+    const planType = typeof authClaims?.chatgpt_plan_type === 'string' ? authClaims.chatgpt_plan_type : undefined;
+    const authMode = parsed.OPENAI_API_KEY || parsed.auth_mode === 'api_key' ? 'api-key' : 'chatgpt';
     return { email, workspaceId, planType, authMode };
 }
 function readLastRefresh(raw, fallbackPath) {
@@ -235,7 +236,9 @@ function readLastRefresh(raw, fallbackPath) {
         try {
             return fs.statSync(fallbackPath).mtimeMs;
         }
-        catch { /* fall through */ }
+        catch {
+            /* fall through */
+        }
     }
     return null;
 }
@@ -271,6 +274,8 @@ function getCodexLoginStatus(codexHome) {
         const result = (0, child_process_1.spawnSync)('codex', ['login', 'status'], {
             encoding: 'utf8',
             env,
+            timeout: 4000,
+            killSignal: 'SIGKILL',
         });
         const stdout = String(result.stdout ?? '').trim();
         if (result.status === 0 && /^Logged in/i.test(stdout)) {
@@ -292,7 +297,11 @@ function detectRunningCodexProcess() {
     if (process.platform === 'win32')
         return false;
     try {
-        return (0, child_process_1.spawnSync)('pgrep', ['-x', 'codex'], { encoding: 'utf8' }).status === 0;
+        return ((0, child_process_1.spawnSync)('pgrep', ['-x', 'codex'], {
+            encoding: 'utf8',
+            timeout: 4000,
+            killSignal: 'SIGKILL',
+        }).status === 0);
     }
     catch {
         return false;
@@ -324,8 +333,7 @@ function isCodexProfileAuthenticated(codexHome) {
 }
 function ensureUniqueCodexLabel(label, excludeId) {
     const normalized = label.trim().toLowerCase();
-    const conflict = listCodexAccounts().find(account => account.id !== excludeId &&
-        (account.label ?? '').trim().toLowerCase() === normalized);
+    const conflict = listCodexAccounts().find((account) => account.id !== excludeId && (account.label ?? '').trim().toLowerCase() === normalized);
     return conflict ? `A Codex account named "${label}" already exists.` : null;
 }
 function listCodexAccounts() {
@@ -339,6 +347,56 @@ function resolveSidekickCodexHome() {
     // home (or an explicit CODEX_HOME) is always the single live home.
     return getSystemCodexHome();
 }
+/**
+ * Resolves the *currently logged-in* Codex account for display, preferring the
+ * live `auth.json` identity over the saved registry pointer (which only sidekick's
+ * own switch flow updates and therefore goes stale after a native `codex login`).
+ *
+ * Uses the cheap JWT decode from `auth.json` directly — NOT `readCodexAccountMetadata`,
+ * whose fallback spawns `codex login status` (a multi-second subprocess) unsuitable
+ * for a render path.
+ *
+ * Safe self-heal: when the live identity unambiguously matches a saved profile that
+ * isn't the current active pointer, the pointer is re-pointed so registry-keyed data
+ * (quota history, auto-switch) tracks reality too. Never creates or deletes profiles.
+ */
+function resolveActiveCodexAccount() {
+    const identity = readAuthIdentityFromRaw(readFileOrNull(path.join(resolveSidekickCodexHome(), 'auth.json')));
+    if (identity && (identity.email || identity.workspaceId)) {
+        const match = findProfileForIdentity(identity);
+        if (match) {
+            const active = (0, accountRegistry_1.getActiveSavedAccount)('codex');
+            if (!active || active.id !== match.id) {
+                // Self-heal is best-effort: a registry write failure (read-only/full
+                // disk) must never break display, extension activation, or the quota
+                // watcher's hot path. We still return the correct live identity below.
+                try {
+                    (0, accountRegistry_1.setActiveSavedAccount)('codex', match.id);
+                }
+                catch {
+                    /* keep going with the live identity */
+                }
+            }
+        }
+        return {
+            email: identity.email ?? match?.email ?? match?.metadata?.email,
+            label: match?.label,
+            providerAccountId: match?.providerAccountId ?? identity.workspaceId,
+            source: 'live',
+        };
+    }
+    // api-key auth, unparseable token, or logged out → fall back to the registry.
+    const active = getActiveCodexAccount();
+    if (active) {
+        return {
+            email: active.email ?? active.metadata?.email,
+            label: active.label,
+            providerAccountId: active.providerAccountId,
+            source: 'registry',
+        };
+    }
+    return { source: 'none' };
+}
 function getCodexExecutionEnv(baseEnv = process.env) {
     return {
         ...baseEnv,
@@ -440,12 +498,12 @@ function stashLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
 function findProfileForIdentity(identity) {
     const profiles = listCodexAccounts();
     if (identity?.workspaceId) {
-        const byWorkspace = profiles.find(profile => profile.metadata?.workspaceId === identity.workspaceId);
+        const byWorkspace = profiles.find((profile) => profile.metadata?.workspaceId === identity.workspaceId);
         if (byWorkspace)
             return byWorkspace;
     }
     if (identity?.email) {
-        const byEmail = profiles.find(profile => (profile.email ?? profile.metadata?.email) === identity.email);
+        const byEmail = profiles.find((profile) => (profile.email ?? profile.metadata?.email) === identity.email);
         if (byEmail)
             return byEmail;
     }
@@ -488,7 +546,9 @@ function syncBackLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
                 metadata: { ...profile.metadata, ...metadata },
             });
         }
-        catch { /* metadata refresh is best-effort */ }
+        catch {
+            /* metadata refresh is best-effort */
+        }
         return { syncedProfileId: profile.id };
     }
     catch (err) {
@@ -513,10 +573,16 @@ function performCodexAuthSwap(target) {
     const targetLegacyRaw = readFileOrNull(path.join(profileHome, '.credentials.json'));
     const targetName = target.label ?? target.email ?? target.id;
     if (!targetAuthRaw && !targetLegacyRaw) {
-        return { success: false, error: `No stored credentials for "${targetName}". Remove and re-add this account.` };
+        return {
+            success: false,
+            error: `No stored credentials for "${targetName}". Remove and re-add this account.`,
+        };
     }
     if (targetAuthRaw && !parseAuthJson(targetAuthRaw)) {
-        return { success: false, error: `Stored credentials for "${targetName}" are corrupted. Remove and re-add this account.` };
+        return {
+            success: false,
+            error: `Stored credentials for "${targetName}" are corrupted. Remove and re-add this account.`,
+        };
     }
     const warnings = [];
     if (detectRunningCodexProcess()) {
@@ -530,7 +596,9 @@ function performCodexAuthSwap(target) {
     const targetIdentity = readAuthIdentityFromRaw(targetAuthRaw);
     const targetWorkspaceId = target.metadata?.workspaceId ?? targetIdentity?.workspaceId;
     const targetEmail = target.email ?? target.metadata?.email ?? targetIdentity?.email;
-    const liveMatchesTarget = Boolean((liveIdentity?.workspaceId && targetWorkspaceId && liveIdentity.workspaceId === targetWorkspaceId) ||
+    const liveMatchesTarget = Boolean((liveIdentity?.workspaceId &&
+        targetWorkspaceId &&
+        liveIdentity.workspaceId === targetWorkspaceId) ||
         (liveIdentity?.email && targetEmail && liveIdentity.email === targetEmail) ||
         (liveAuthRaw !== null && liveAuthRaw === targetAuthRaw) ||
         (!liveAuthRaw && !targetAuthRaw && liveLegacyRaw !== null && liveLegacyRaw === targetLegacyRaw));
@@ -547,7 +615,9 @@ function performCodexAuthSwap(target) {
                 metadata: { ...target.metadata, ...metadata },
             });
         }
-        catch { /* backup refresh is best-effort */ }
+        catch {
+            /* backup refresh is best-effort */
+        }
         (0, accountRegistry_1.setActiveSavedAccount)('codex', target.id);
         return { success: true, warning: warnings.length ? warnings.join(' ') : undefined };
     }
@@ -569,7 +639,9 @@ function performCodexAuthSwap(target) {
             else
                 fs.rmSync(liveLegacyPath, { force: true });
         }
-        catch { /* rollback is best-effort */ }
+        catch {
+            /* rollback is best-effort */
+        }
     };
     try {
         if (targetAuthRaw) {
@@ -599,7 +671,7 @@ function performCodexAuthSwap(target) {
     return { success: true, warning: warnings.length ? warnings.join(' ') : undefined };
 }
 function switchToCodexAccount(profileId) {
-    const target = listCodexAccounts().find(account => account.id === profileId);
+    const target = listCodexAccounts().find((account) => account.id === profileId);
     if (!target) {
         return { success: false, error: `Codex account ${profileId} not found.` };
     }
@@ -641,7 +713,9 @@ function reconcileCodexAuthState() {
         }
         const liveIdentity = readAuthIdentityFromRaw(liveAuthRaw);
         const profileIdentity = readAuthIdentityFromRaw(profileAuthRaw);
-        const sameIdentity = Boolean((liveIdentity?.workspaceId && profileIdentity?.workspaceId && liveIdentity.workspaceId === profileIdentity.workspaceId) ||
+        const sameIdentity = Boolean((liveIdentity?.workspaceId &&
+            profileIdentity?.workspaceId &&
+            liveIdentity.workspaceId === profileIdentity.workspaceId) ||
             (liveIdentity?.email && liveIdentity.email === profileIdentity?.email));
         if (sameIdentity) {
             const liveRefresh = readLastRefresh(liveAuthRaw, liveAuthPath);

package/dist/codexQuota.js

@@ -42,6 +42,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const codexProfiles_1 = require("./codexProfiles");
 const quotaSnapshots_1 = require("./quotaSnapshots");
+const quota_1 = require("./quota");
 const codex_1 = require("./providers/codex");
 const DEFAULT_TAIL_BYTES = 2 * 1024 * 1024;
 const DEFAULT_MAX_SESSION_FILES = 50;
@@ -79,6 +80,11 @@ function isPreferredQuotaHit(candidate, current) {
 function normalizePercent(value) {
     return typeof value === 'number' && Number.isFinite(value) ? value : 0;
 }
+function windowMinutesToMs(value, fallbackMs) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0
+        ? value * 60_000
+        : fallbackMs;
+}
 function timestampToIso(seconds) {
     if (typeof seconds !== 'number' || !Number.isFinite(seconds) || seconds <= 0) {
         return '';
@@ -89,8 +95,9 @@ function accountEmail(account) {
     return account?.email ?? account?.metadata?.email;
 }
 function enrichCodexQuota(state, account) {
+    const withProjections = (0, quota_1.withQuotaProjections)(state);
     return {
-        ...state,
+        ...withProjections,
         runtimeProvider: 'codex',
         providerId: 'codex',
         accountLabel: account?.label,
@@ -183,12 +190,18 @@ function quotaFromCodexRateLimits(rateLimits, source = 'session', capturedAt = n
     const secondary = rateLimits?.secondary;
     if (!primary && !secondary)
         return null;
-    return {
+    return (0, quota_1.withQuotaProjections)({
         fiveHour: primary
-            ? { utilization: normalizePercent(primary.used_percent), resetsAt: timestampToIso(primary.resets_at) }
+            ? {
+                utilization: normalizePercent(primary.used_percent),
+                resetsAt: timestampToIso(primary.resets_at),
+            }
             : { utilization: 0, resetsAt: '' },
         sevenDay: secondary
-            ? { utilization: normalizePercent(secondary.used_percent), resetsAt: timestampToIso(secondary.resets_at) }
+            ? {
+                utilization: normalizePercent(secondary.used_percent),
+                resetsAt: timestampToIso(secondary.resets_at),
+            }
             : { utilization: 0, resetsAt: '' },
         available: true,
         providerId: 'codex',
@@ -202,7 +215,11 @@ function quotaFromCodexRateLimits(rateLimits, source = 'session', capturedAt = n
         credits: rateLimits?.credits,
         planType: rateLimits?.plan_type,
         rateLimitReachedType: rateLimits?.rate_limit_reached_type,
-    };
+    }, {
+        fiveHourWindowMs: windowMinutesToMs(primary?.window_minutes, quota_1.FIVE_HOUR_WINDOW_MS),
+        sevenDayWindowMs: windowMinutesToMs(secondary?.window_minutes, quota_1.SEVEN_DAY_WINDOW_MS),
+        capturedAt,
+    });
 }
 function readLatestCodexQuotaFromRollouts(sessionPaths, options = {}) {
     return readLatestCodexQuotaHitFromRollouts(sessionPaths, options)?.quota ?? null;
@@ -260,23 +277,30 @@ function resolveCodexQuotaFromLocalSources(options = {}) {
     const maxTailBytes = options.maxTailBytes ?? DEFAULT_TAIL_BYTES;
     const maxSessionFiles = options.maxSessionFiles ?? DEFAULT_MAX_SESSION_FILES;
     let ownProvider = false;
-    const provider = options.provider ?? (() => {
-        ownProvider = true;
-        return new codex_1.CodexProvider();
-    })();
+    const provider = options.provider ??
+        (() => {
+            ownProvider = true;
+            return new codex_1.CodexProvider();
+        })();
     try {
         const candidates = [];
         if (options.workspacePath) {
             const workspaceSessions = provider.findAllSessions(options.workspacePath);
-            const workspaceHit = readLatestCodexQuotaHitFromRollouts(workspaceSessions, { maxTailBytes, maxSessionFiles });
+            const workspaceHit = readLatestCodexQuotaHitFromRollouts(workspaceSessions, {
+                maxTailBytes,
+                maxSessionFiles,
+            });
             if (workspaceHit)
                 candidates.push(workspaceHit);
         }
         const accountSessions = findAccountRolloutFiles(options.codexHome);
-        const accountHit = readLatestCodexQuotaHitFromRollouts(accountSessions, { maxTailBytes, maxSessionFiles });
+        const accountHit = readLatestCodexQuotaHitFromRollouts(accountSessions, {
+            maxTailBytes,
+            maxSessionFiles,
+        });
         if (accountHit)
             candidates.push(accountHit);
-        const latestHit = candidates.reduce((latest, candidate) => isPreferredQuotaHit(candidate, latest) ? candidate : latest, null);
+        const latestHit = candidates.reduce((latest, candidate) => (isPreferredQuotaHit(candidate, latest) ? candidate : latest), null);
         if (latestHit) {
             if (account)
                 writeSnapshot('codex', account.id, latestHit.quota);
@@ -368,7 +392,9 @@ async function fetchCodexQuotaFromApi(options = {}) {
                             ? 'server'
                             : 'unknown',
                 httpStatus: response.status,
-                retryAfterMs: response.status === 429 ? parseRetryAfterMs(response.headers.get('retry-after')) : undefined,
+                retryAfterMs: response.status === 429
+                    ? parseRetryAfterMs(response.headers.get('retry-after'))
+                    : undefined,
                 providerId: 'codex',
                 source: 'api',
                 capturedAt,
@@ -376,7 +402,7 @@ async function fetchCodexQuotaFromApi(options = {}) {
                 sevenDayLabel: 'Secondary',
             };
         }
-        const payload = await response.json();
+        const payload = (await response.json());
         const quota = quotaFromCodexRateLimits(rateLimitsFromUsagePayload(payload), 'api', capturedAt);
         if (!quota) {
             return {
@@ -464,7 +490,9 @@ function readLatestQuotaFromRollout(sessionPath, maxTailBytes, source) {
             try {
                 fs.closeSync(fd);
             }
-            catch { /* ignore */ }
+            catch {
+                /* ignore */
+            }
         }
     }
     return null;
@@ -500,5 +528,5 @@ function findRolloutFiles(sessionsDir) {
     }
     visit(sessionsDir);
     results.sort((a, b) => b.mtime - a.mtime);
-    return results.map(item => item.path);
+    return results.map((item) => item.path);
 }

package/dist/codexQuotaWatcher.js

@@ -93,9 +93,18 @@ class CodexQuotaWatcher {
     running = false;
     constructor(workspacePath, options = {}) {
         this.workspacePath = workspacePath;
-        this.discoveryPollIntervalMs = options.discoveryPollIntervalMs ?? DEFAULT_DISCOVERY_POLL_INTERVAL_MS;
+        this.discoveryPollIntervalMs =
+            options.discoveryPollIntervalMs ?? DEFAULT_DISCOVERY_POLL_INTERVAL_MS;
         this.providerFactory = options.providerFactory ?? (() => new codex_1.CodexProvider());
-        this.getActiveAccount = options.getActiveAccount ?? codexProfiles_1.getActiveCodexAccount;
+        // Self-heal the registry pointer to the live login before reading it, so the
+        // history key (account.id) and the display label track the currently
+        // logged-in account even after a native `codex login`. Overridable for tests.
+        this.getActiveAccount =
+            options.getActiveAccount ??
+                (() => {
+                    (0, codexProfiles_1.resolveActiveCodexAccount)();
+                    return (0, codexProfiles_1.getActiveCodexAccount)();
+                });
         this.readSnapshot = options.readSnapshot ?? quotaSnapshots_1.readQuotaSnapshot;
         this.writeSnapshot = options.writeSnapshot ?? quotaSnapshots_1.writeQuotaSnapshot;
         this.watchFile = options.watchFile ?? fs.watch;
@@ -207,8 +216,14 @@ class CodexQuotaWatcher {
                     runtimeProvider: 'codex',
                     providerId: account.id,
                     workspaceId: this.workspaceId,
-                    fiveHour: { utilization: liveQuota.fiveHour.utilization, resetsAt: liveQuota.fiveHour.resetsAt },
-                    sevenDay: { utilization: liveQuota.sevenDay.utilization, resetsAt: liveQuota.sevenDay.resetsAt },
+                    fiveHour: {
+                        utilization: liveQuota.fiveHour.utilization,
+                        resetsAt: liveQuota.fiveHour.resetsAt,
+                    },
+                    sevenDay: {
+                        utilization: liveQuota.sevenDay.utilization,
+                        resetsAt: liveQuota.sevenDay.resetsAt,
+                    },
                     available: liveQuota.available,
                     error: liveQuota.error,
                     source: liveQuota.source,

package/dist/context/composer.js

@@ -29,7 +29,9 @@ async function composeContext(slug, fidelity, provider, workspacePath) {
         try {
             sessionSummaries.push(provider.readSessionStats(sp));
         }
-        catch { /* skip */ }
+        catch {
+            /* skip */
+        }
     }
     // Apply fidelity filtering
     let tasks;
@@ -40,23 +42,23 @@ async function composeContext(slug, fidelity, provider, workspacePath) {
         case 'full':
             tasks = allTasks;
             decisions = allDecisions;
-            notes = allNotes.filter(n => n.status === 'active' || n.status === 'needs_review');
+            notes = allNotes.filter((n) => n.status === 'active' || n.status === 'needs_review');
             if (history) {
                 stats = { tokens: { ...history.allTime.tokens }, cost: history.allTime.totalCost };
             }
             break;
         case 'compact':
-            tasks = allTasks.filter(t => t.status === 'pending');
+            tasks = allTasks.filter((t) => t.status === 'pending');
             decisions = allDecisions.slice(0, 10);
-            notes = allNotes.filter(n => n.status === 'active');
+            notes = allNotes.filter((n) => n.status === 'active');
             if (history) {
                 stats = { tokens: { ...history.allTime.tokens }, cost: history.allTime.totalCost };
             }
             break;
         case 'brief':
-            tasks = allTasks.filter(t => t.status === 'pending').slice(0, 3);
+            tasks = allTasks.filter((t) => t.status === 'pending').slice(0, 3);
             decisions = []; // Count only
-            notes = allNotes.filter(n => n.importance === 'critical');
+            notes = allNotes.filter((n) => n.importance === 'critical');
             stats = null;
             break;
     }

package/dist/context/sessionContext.js

@@ -65,7 +65,7 @@ function buildSessionContextSnapshot(events, options = {}) {
     const allSources = sourceState.sources;
     const limitedSources = limitSources(allSources, options.sourceLimit ?? DEFAULT_CONTEXT_SOURCE_LIMIT);
     const breakdown = buildLayerBreakdown(limitedSources);
-    const layers = breakdown.map(row => row.layer);
+    const layers = breakdown.map((row) => row.layer);
     const sourceTokenTotal = allSources.reduce((sum, source) => sum + source.tokenEstimate, 0);
     const contextTokens = metrics.currentContextSize > 0 ? metrics.currentContextSize : sourceTokenTotal;
     const { pressure, ratio } = calculateSessionContextPressure(contextTokens, contextWindow);
@@ -381,16 +381,16 @@ function limitSources(sources, limit) {
         return [];
     if (sources.length <= limit)
         return [...sources];
-    const pinned = sources.filter(source => source.sourceType === 'system' ||
+    const pinned = sources.filter((source) => source.sourceType === 'system' ||
         source.sourceType === 'runtime' ||
         source.sourceType === 'rate_limit');
     const pinnedLimit = Math.min(pinned.length, Math.max(1, Math.floor(limit / 4)));
     const pinnedKept = pinned.slice(0, pinnedLimit);
-    const pinnedIds = new Set(pinnedKept.map(source => source.id));
-    const remaining = sources.filter(source => !pinnedIds.has(source.id));
+    const pinnedIds = new Set(pinnedKept.map((source) => source.id));
+    const remaining = sources.filter((source) => !pinnedIds.has(source.id));
     const latest = remaining.slice(-(limit - pinnedKept.length));
-    const keepIds = new Set([...pinnedKept, ...latest].map(source => source.id));
-    return sources.filter(source => keepIds.has(source.id));
+    const keepIds = new Set([...pinnedKept, ...latest].map((source) => source.id));
+    return sources.filter((source) => keepIds.has(source.id));
 }
 function latestModel(events) {
     for (let i = events.length - 1; i >= 0; i--) {
@@ -440,7 +440,7 @@ function inferSourceFile(input) {
     }
     const files = input.files;
     if (Array.isArray(files)) {
-        const first = files.find(value => typeof value === 'string' && value.trim());
+        const first = files.find((value) => typeof value === 'string' && value.trim());
         if (typeof first === 'string')
             return first.trim();
     }
@@ -451,7 +451,10 @@ function inferCommand(input) {
     if (typeof command === 'string' && command.trim())
         return command.trim();
     if (Array.isArray(command)) {
-        return command.map(part => String(part)).join(' ').trim() || undefined;
+        return (command
+            .map((part) => String(part))
+            .join(' ')
+            .trim() || undefined);
     }
     return undefined;
 }
@@ -469,7 +472,7 @@ function extractText(content) {
         return content;
     if (Array.isArray(content)) {
         return content
-            .map(block => isRecord(block) ? blockText(block) : '')
+            .map((block) => (isRecord(block) ? blockText(block) : ''))
             .filter(Boolean)
             .join('\n');
     }

package/dist/credentialIO.js

@@ -66,9 +66,7 @@ function getCredentialsFilePath(configDir) {
 function readActiveCredentials(configDir) {
     if (process.platform === 'darwin') {
         try {
-            const raw = (0, child_process_1.execFileSync)('security', [
-                'find-generic-password', '-s', (0, claudeProfiles_1.claudeKeychainService)(configDir), '-w',
-            ], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+            const raw = (0, child_process_1.execFileSync)('security', ['find-generic-password', '-s', (0, claudeProfiles_1.claudeKeychainService)(configDir), '-w'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 4000, killSignal: 'SIGKILL' });
             return JSON.parse(raw.trim());
         }
         catch {
@@ -96,11 +94,15 @@ function writeActiveCredentials(credentials, configDir) {
     JSON.parse(json); // validate round-trip
     if (process.platform === 'darwin') {
         (0, child_process_1.execFileSync)('security', [
-            'add-generic-password', '-U',
-            '-s', (0, claudeProfiles_1.claudeKeychainService)(configDir),
-            '-a', process.env.USER || 'user',
-            '-w', json,
-        ], { stdio: ['pipe', 'pipe', 'pipe'] });
+            'add-generic-password',
+            '-U',
+            '-s',
+            (0, claudeProfiles_1.claudeKeychainService)(configDir),
+            '-a',
+            process.env.USER || 'user',
+            '-w',
+            json,
+        ], { stdio: ['pipe', 'pipe', 'pipe'], timeout: 4000, killSignal: 'SIGKILL' });
         return;
     }
     // Linux / WSL / Windows — file-based

package/dist/extractors/sessionAssets.js

@@ -62,7 +62,15 @@ const os = __importStar(require("node:os"));
 const node_path_1 = require("node:path");
 const URL_RE = /(?:https?|file):\/\/[^\s"'<>)\]`\\]+/g;
 const PATH_RE = /(?:~|\.{0,2}\/)?[A-Za-z0-9_@.-]*(?:\/[A-Za-z0-9_@.-]+)+(?::\d+){0,2}|[A-Za-z0-9_@-]+\.[A-Za-z0-9]{1,8}(?::\d+){0,2}/g;
-const SHELL_TAGS = new Set(['sh', 'bash', 'shell', 'zsh', 'console', 'shellscript', 'shell-session']);
+const SHELL_TAGS = new Set([
+    'sh',
+    'bash',
+    'shell',
+    'zsh',
+    'console',
+    'shellscript',
+    'shell-session',
+]);
 exports.DEFAULT_CAPS = {
     command: 60,
     path: 60,

package/dist/extractors/sources/claudeAssets.js

@@ -149,7 +149,13 @@ function accumClaude(filePath, cwd, acc) {
 }
 function readClaudeAssets(cwd, limit = 3) {
     const sessions = claudeSessions(cwd, limit);
-    const acc = { urls: [], paths: [], commands: [], plans: [], hadSession: sessions.length > 0 };
+    const acc = {
+        urls: [],
+        paths: [],
+        commands: [],
+        plans: [],
+        hadSession: sessions.length > 0,
+    };
     for (const session of sessions)
         accumClaude(session, cwd, acc);
     return acc;

package/dist/extractors/sources/codexAssets.js

@@ -99,7 +99,9 @@ function rolloutFiles(limit = 150) {
             if (entry.isDirectory()) {
                 walk(fullPath);
             }
-            else if (entry.isFile() && entry.name.startsWith('rollout-') && entry.name.endsWith('.jsonl')) {
+            else if (entry.isFile() &&
+                entry.name.startsWith('rollout-') &&
+                entry.name.endsWith('.jsonl')) {
                 try {
                     if (seen.has(fullPath))
                         continue;
@@ -117,7 +119,10 @@ function rolloutFiles(limit = 150) {
         if (dirExists(sessionsDir))
             walk(sessionsDir);
     }
-    return entries.sort((a, b) => b.mtime - a.mtime).slice(0, limit).map((entry) => entry.path);
+    return entries
+        .sort((a, b) => b.mtime - a.mtime)
+        .slice(0, limit)
+        .map((entry) => entry.path);
 }
 function codexSessions(cwd, limit = 3) {
     const exactCwd = (0, node_path_1.resolve)(cwd);
@@ -182,7 +187,13 @@ function addExecutedCommandAssets(acc, command, cwd, timestamp, meta) {
 function readCodexAssets(cwd, limit = 3) {
     const exactCwd = (0, node_path_1.resolve)(cwd);
     const files = codexSessions(exactCwd, limit);
-    const acc = { urls: [], paths: [], commands: [], plans: [], hadSession: files.length > 0 };
+    const acc = {
+        urls: [],
+        paths: [],
+        commands: [],
+        plans: [],
+        hadSession: files.length > 0,
+    };
     const skip = (line) => line.includes('"type":"function_call_output"') ||
         line.includes('"type":"reasoning"') ||
         line.includes('"type":"token_count"');

package/dist/extractors/toolCall.js

@@ -37,10 +37,7 @@ function extractToolCalls(event) {
     const timestamp = new Date(event.timestamp);
     const calls = [];
     for (const block of content) {
-        if (block &&
-            typeof block === 'object' &&
-            'type' in block &&
-            block.type === 'tool_use') {
+        if (block && typeof block === 'object' && 'type' in block && block.type === 'tool_use') {
             const toolBlock = block;
             if (toolBlock.name) {
                 calls.push({