sidekick-shared 0.24.4 → 0.24.5

package/dist/codexProfiles.js

@@ -38,16 +38,22 @@ exports.getCodexMonitoringHomes = getCodexMonitoringHomes;
 exports.getCodexProfilesDir = getCodexProfilesDir;
 exports.getCodexProfileHome = getCodexProfileHome;
 exports.readCodexAccountMetadata = readCodexAccountMetadata;
+exports.readCodexAccountMetadataAsync = readCodexAccountMetadataAsync;
 exports.isCodexProfileAuthenticated = isCodexProfileAuthenticated;
+exports.isCodexProfileAuthenticatedAsync = isCodexProfileAuthenticatedAsync;
 exports.listCodexAccounts = listCodexAccounts;
 exports.getActiveCodexAccount = getActiveCodexAccount;
 exports.resolveSidekickCodexHome = resolveSidekickCodexHome;
 exports.resolveActiveCodexAccount = resolveActiveCodexAccount;
 exports.getCodexExecutionEnv = getCodexExecutionEnv;
 exports.prepareCodexAccount = prepareCodexAccount;
+exports.prepareCodexAccountAsync = prepareCodexAccountAsync;
 exports.finalizeCodexAccount = finalizeCodexAccount;
+exports.finalizeCodexAccountAsync = finalizeCodexAccountAsync;
 exports.switchToCodexAccount = switchToCodexAccount;
+exports.switchToCodexAccountAsync = switchToCodexAccountAsync;
 exports.reconcileCodexAuthState = reconcileCodexAuthState;
+exports.reconcileCodexAuthStateAsync = reconcileCodexAuthStateAsync;
 exports.removeCodexAccount = removeCodexAccount;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -55,6 +61,10 @@ const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const accountRegistry_1 = require("./accountRegistry");
+// auth.json must be copied byte-for-byte (atomicWriteFile, not atomicWriteJson):
+// re-serializing would drop fields added by newer codex versions, and the
+// rotated refresh token inside is only valid in its freshest form.
+const atomic_1 = require("./writers/atomic");
 // Codex refreshes OAuth tokens at most every 8 days; a stored refresh token
 // older than that may already be rejected by the auth server.
 const STALE_AUTH_THRESHOLD_MS = 8 * 24 * 60 * 60 * 1000;
@@ -110,44 +120,6 @@ function getCodexProfileStatePath(profileId) {
 function ensureCodexProfileDirs(profileId) {
     fs.mkdirSync(getCodexProfileHome(profileId), { recursive: true, mode: 0o700 });
 }
-function atomicWriteJson(filePath, data, mode = 0o600) {
-    const tmp = filePath + '.tmp';
-    const json = JSON.stringify(data, null, 2);
-    JSON.parse(json);
-    try {
-        fs.writeFileSync(tmp, json, { encoding: 'utf8', mode });
-        fs.renameSync(tmp, filePath);
-    }
-    catch (err) {
-        try {
-            fs.unlinkSync(tmp);
-        }
-        catch {
-            /* nothing to clean up */
-        }
-        throw err;
-    }
-}
-// auth.json must be copied byte-for-byte: re-serializing would drop fields
-// added by newer codex versions, and the rotated refresh token inside is
-// only valid in its freshest form.
-function atomicWriteFile(filePath, content, mode = 0o600) {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-    const tmp = filePath + '.tmp';
-    try {
-        fs.writeFileSync(tmp, content, { encoding: 'utf8', mode });
-        fs.renameSync(tmp, filePath);
-    }
-    catch (err) {
-        try {
-            fs.unlinkSync(tmp);
-        }
-        catch {
-            /* nothing to clean up */
-        }
-        throw err;
-    }
-}
 function readFileOrNull(filePath) {
     try {
         return fs.readFileSync(filePath, 'utf8');
@@ -166,7 +138,7 @@ function readPendingProfile(profileId) {
 }
 function writePendingProfile(profileId, pending) {
     ensureCodexProfileDirs(profileId);
-    atomicWriteJson(getCodexProfileStatePath(profileId), pending);
+    (0, atomic_1.atomicWriteJsonSync)(getCodexProfileStatePath(profileId), pending);
 }
 function copyIfExists(source, destination) {
     if (!fs.existsSync(source))
@@ -268,38 +240,63 @@ function readMetadataFromLegacyCredentials(codexHome) {
     }
     return {};
 }
+const PROBE_TIMEOUT_MS = 4000;
+function parseCodexLoginStatusOutput(status, stdout) {
+    const trimmed = stdout.trim();
+    if (status === 0 && /^Logged in/i.test(trimmed)) {
+        if (/API key/i.test(trimmed)) {
+            return { loggedIn: true, authMode: 'api-key' };
+        }
+        if (/ChatGPT/i.test(trimmed)) {
+            return { loggedIn: true, authMode: 'chatgpt' };
+        }
+        return { loggedIn: true };
+    }
+    return { loggedIn: false };
+}
+/**
+ * Blocks the caller's event loop for up to {@link PROBE_TIMEOUT_MS}. Async code
+ * paths must use {@link getCodexLoginStatusAsync} instead — external consumers
+ * embed this package in processes where a blocked event loop freezes all IPC.
+ */
 function getCodexLoginStatus(codexHome) {
     try {
         const env = { ...process.env, CODEX_HOME: codexHome };
         const result = (0, child_process_1.spawnSync)('codex', ['login', 'status'], {
             encoding: 'utf8',
             env,
-            timeout: 4000,
+            timeout: PROBE_TIMEOUT_MS,
             killSignal: 'SIGKILL',
         });
-        const stdout = String(result.stdout ?? '').trim();
-        if (result.status === 0 && /^Logged in/i.test(stdout)) {
-            if (/API key/i.test(stdout)) {
-                return { loggedIn: true, authMode: 'api-key' };
-            }
-            if (/ChatGPT/i.test(stdout)) {
-                return { loggedIn: true, authMode: 'chatgpt' };
-            }
-            return { loggedIn: true };
-        }
+        return parseCodexLoginStatusOutput(result.status, String(result.stdout ?? ''));
     }
     catch {
         // Ignore missing CLI or spawn errors.
     }
     return { loggedIn: false };
 }
+function getCodexLoginStatusAsync(codexHome) {
+    return new Promise((resolve) => {
+        try {
+            const env = { ...process.env, CODEX_HOME: codexHome };
+            (0, child_process_1.execFile)('codex', ['login', 'status'], { encoding: 'utf8', env, timeout: PROBE_TIMEOUT_MS, killSignal: 'SIGKILL' }, (error, stdout) => {
+                // A missing CLI, non-zero exit, or timeout all mean "not logged in".
+                resolve(error ? { loggedIn: false } : parseCodexLoginStatusOutput(0, String(stdout ?? '')));
+            });
+        }
+        catch {
+            resolve({ loggedIn: false });
+        }
+    });
+}
+/** Sync sibling of {@link detectRunningCodexProcessAsync}; see the event-loop caveat above. */
 function detectRunningCodexProcess() {
     if (process.platform === 'win32')
         return false;
     try {
         return ((0, child_process_1.spawnSync)('pgrep', ['-x', 'codex'], {
             encoding: 'utf8',
-            timeout: 4000,
+            timeout: PROBE_TIMEOUT_MS,
             killSignal: 'SIGKILL',
         }).status === 0);
     }
@@ -307,7 +304,20 @@ function detectRunningCodexProcess() {
         return false;
     }
 }
-function readCodexAccountMetadata(codexHome) {
+function detectRunningCodexProcessAsync() {
+    if (process.platform === 'win32')
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        try {
+            (0, child_process_1.execFile)('pgrep', ['-x', 'codex'], { encoding: 'utf8', timeout: PROBE_TIMEOUT_MS, killSignal: 'SIGKILL' }, (error) => resolve(!error));
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+/** File-based metadata only — never spawns the codex CLI. */
+function readCodexAccountMetadataFromFiles(codexHome) {
     const fromAuth = readMetadataFromAuthJson(codexHome);
     if (fromAuth.email || fromAuth.workspaceId || fromAuth.planType || fromAuth.authMode) {
         return fromAuth;
@@ -316,20 +326,30 @@ function readCodexAccountMetadata(codexHome) {
     if (fromLegacy.authMode) {
         return fromLegacy;
     }
-    const status = getCodexLoginStatus(codexHome);
-    if (status.loggedIn) {
-        return {
-            authMode: status.authMode ?? 'unknown',
-        };
-    }
-    return {};
+    return null;
+}
+function metadataFromLoginStatus(status) {
+    return status.loggedIn ? { authMode: status.authMode ?? 'unknown' } : {};
+}
+function readCodexAccountMetadata(codexHome) {
+    return (readCodexAccountMetadataFromFiles(codexHome) ??
+        metadataFromLoginStatus(getCodexLoginStatus(codexHome)));
+}
+/** {@link readCodexAccountMetadata} without blocking the event loop on the CLI probe. */
+async function readCodexAccountMetadataAsync(codexHome) {
+    return (readCodexAccountMetadataFromFiles(codexHome) ??
+        metadataFromLoginStatus(await getCodexLoginStatusAsync(codexHome)));
+}
+function hasCodexCredentialFiles(codexHome) {
+    return (fs.existsSync(path.join(codexHome, 'auth.json')) ||
+        fs.existsSync(path.join(codexHome, '.credentials.json')));
 }
 function isCodexProfileAuthenticated(codexHome) {
-    if (fs.existsSync(path.join(codexHome, 'auth.json')) ||
-        fs.existsSync(path.join(codexHome, '.credentials.json'))) {
-        return true;
-    }
-    return getCodexLoginStatus(codexHome).loggedIn;
+    return hasCodexCredentialFiles(codexHome) || getCodexLoginStatus(codexHome).loggedIn;
+}
+/** {@link isCodexProfileAuthenticated} without blocking the event loop on the CLI probe. */
+async function isCodexProfileAuthenticatedAsync(codexHome) {
+    return hasCodexCredentialFiles(codexHome) || (await getCodexLoginStatusAsync(codexHome)).loggedIn;
 }
 function ensureUniqueCodexLabel(label, excludeId) {
     const normalized = label.trim().toLowerCase();
@@ -405,14 +425,14 @@ function getCodexExecutionEnv(baseEnv = process.env) {
         CODEX_HOME: resolveSidekickCodexHome(),
     };
 }
-function prepareCodexAccount(label) {
+function prepareCodexAccountCore(label) {
     const trimmedLabel = label.trim();
     if (!trimmedLabel) {
-        return { success: false, error: 'Codex accounts require a non-empty label.' };
+        return { result: { success: false, error: 'Codex accounts require a non-empty label.' } };
     }
     const labelError = ensureUniqueCodexLabel(trimmedLabel);
     if (labelError) {
-        return { success: false, error: labelError };
+        return { result: { success: false, error: labelError } };
     }
     const profileId = (0, crypto_1.randomUUID)();
     const codexHome = getCodexProfileHome(profileId);
@@ -425,55 +445,85 @@ function prepareCodexAccount(label) {
     copySourceCodexConfig(sourceHome, codexHome);
     const imported = importCurrentCodexAuth(sourceHome, codexHome);
     if (imported) {
-        const finalized = finalizeCodexAccount(profileId);
-        return {
-            ...finalized,
-            profileId,
-            codexHome,
-            needsLogin: false,
-        };
+        return { finalize: { profileId, codexHome } };
     }
-    return {
-        success: true,
-        profileId,
-        codexHome,
-        needsLogin: true,
-    };
+    return { result: { success: true, profileId, codexHome, needsLogin: true } };
 }
-function finalizeCodexAccount(profileId, opts = {}) {
+function prepareCodexAccount(label) {
+    const step = prepareCodexAccountCore(label);
+    if ('finalize' in step) {
+        const finalized = finalizeCodexAccount(step.finalize.profileId);
+        return { ...finalized, ...step.finalize, needsLogin: false };
+    }
+    return step.result;
+}
+/** {@link prepareCodexAccount} without blocking the event loop on CLI probes. */
+async function prepareCodexAccountAsync(label) {
+    const step = prepareCodexAccountCore(label);
+    if ('finalize' in step) {
+        const finalized = await finalizeCodexAccountAsync(step.finalize.profileId);
+        return { ...finalized, ...step.finalize, needsLogin: false };
+    }
+    return step.result;
+}
+function finalizeCodexAccountCore(profileId, opts, probes) {
     const pending = readPendingProfile(profileId);
     if (!pending) {
-        return { success: false, error: `Codex profile ${profileId} was not prepared.` };
+        return { result: { success: false, error: `Codex profile ${profileId} was not prepared.` } };
     }
     const codexHome = getCodexProfileHome(profileId);
-    if (!isCodexProfileAuthenticated(codexHome)) {
-        return { success: false, error: 'Codex profile is not authenticated yet.' };
+    if (!probes.authenticated) {
+        return { result: { success: false, error: 'Codex profile is not authenticated yet.' } };
     }
-    const metadata = readCodexAccountMetadata(codexHome);
     const profile = {
         id: profileId,
         providerId: 'codex',
         label: pending.label,
-        email: metadata.email,
+        email: probes.metadata.email,
         addedAt: pending.addedAt,
-        metadata,
+        metadata: probes.metadata,
     };
     (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
     if (opts.activate === false) {
-        return { success: true };
+        return { result: { success: true } };
     }
-    const hasCredentialFiles = fs.existsSync(path.join(codexHome, 'auth.json')) ||
-        fs.existsSync(path.join(codexHome, '.credentials.json'));
-    if (!hasCredentialFiles) {
+    if (!hasCodexCredentialFiles(codexHome)) {
         // Authenticated via the OS keyring — there are no credential files to
         // swap, so the registry pointer is all we can update.
         (0, accountRegistry_1.setActiveSavedAccount)('codex', profileId);
         return {
-            success: true,
-            warning: 'Codex stores credentials in the OS keyring; sidekick cannot swap them per account, so `codex` keeps using the keyring credentials.',
+            result: {
+                success: true,
+                warning: 'Codex stores credentials in the OS keyring; sidekick cannot swap them per account, so `codex` keeps using the keyring credentials.',
+            },
         };
     }
-    return performCodexAuthSwap(profile);
+    return { swap: profile };
+}
+function finalizeCodexAccount(profileId, opts = {}) {
+    if (!readPendingProfile(profileId)) {
+        return { success: false, error: `Codex profile ${profileId} was not prepared.` };
+    }
+    const codexHome = getCodexProfileHome(profileId);
+    const authenticated = isCodexProfileAuthenticated(codexHome);
+    const step = finalizeCodexAccountCore(profileId, opts, {
+        authenticated,
+        metadata: authenticated ? readCodexAccountMetadata(codexHome) : {},
+    });
+    return 'swap' in step ? performCodexAuthSwap(step.swap) : step.result;
+}
+/** {@link finalizeCodexAccount} without blocking the event loop on CLI probes. */
+async function finalizeCodexAccountAsync(profileId, opts = {}) {
+    if (!readPendingProfile(profileId)) {
+        return { success: false, error: `Codex profile ${profileId} was not prepared.` };
+    }
+    const codexHome = getCodexProfileHome(profileId);
+    const authenticated = await isCodexProfileAuthenticatedAsync(codexHome);
+    const step = finalizeCodexAccountCore(profileId, opts, {
+        authenticated,
+        metadata: authenticated ? await readCodexAccountMetadataAsync(codexHome) : {},
+    });
+    return 'swap' in step ? performCodexAuthSwapAsync(step.swap) : step.result;
 }
 function getCodexStashDir() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'stash');
@@ -484,11 +534,11 @@ function stashLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
         let stashPath = null;
         if (liveAuthRaw) {
             stashPath = path.join(getCodexStashDir(), `auth-${stamp}.json`);
-            atomicWriteFile(stashPath, liveAuthRaw);
+            (0, atomic_1.atomicWriteFileSync)(stashPath, liveAuthRaw);
         }
         if (liveLegacyRaw) {
             const legacyStashPath = path.join(getCodexStashDir(), `credentials-${stamp}.json`);
-            atomicWriteFile(legacyStashPath, liveLegacyRaw);
+            (0, atomic_1.atomicWriteFileSync)(legacyStashPath, liveLegacyRaw);
             stashPath = stashPath ?? legacyStashPath;
         }
         return stashPath;
@@ -537,11 +587,13 @@ function syncBackLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
         }
         const profileHome = getCodexProfileHome(profile.id);
         if (liveAuthRaw)
-            atomicWriteFile(path.join(profileHome, 'auth.json'), liveAuthRaw);
+            (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, 'auth.json'), liveAuthRaw);
         if (liveLegacyRaw)
-            atomicWriteFile(path.join(profileHome, '.credentials.json'), liveLegacyRaw);
+            (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, '.credentials.json'), liveLegacyRaw);
         try {
-            const metadata = readCodexAccountMetadata(profileHome);
+            // File-based metadata only: this runs with auth files just written, and
+            // the CLI-probe fallback must never spawn while the swap lock is held.
+            const metadata = readCodexAccountMetadataFromFiles(profileHome) ?? {};
             (0, accountRegistry_1.upsertSavedAccountProfile)({
                 ...profile,
                 email: metadata.email ?? profile.email,
@@ -557,13 +609,70 @@ function syncBackLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
         return { warning: `Could not back up live Codex credentials: ${err}` };
     }
 }
+/**
+ * Serializes live-auth mutations across processes. Codex rotates refresh
+ * tokens, so two interleaved swaps stashing and restoring auth.json can
+ * resurrect a stale token and permanently invalidate the login. Lock ordering:
+ * this lock is taken first and the registry lock (inside setActiveSavedAccount
+ * / upsertSavedAccountProfile) inside it — never the reverse.
+ */
+function withCodexAuthSwapLock(operation) {
+    const lockDir = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex');
+    fs.mkdirSync(lockDir, { recursive: true, mode: 0o700 });
+    return (0, atomic_1.withFileLockSync)(path.join(lockDir, 'auth-swap.lock'), operation);
+}
+/**
+ * CLI probes are resolved before the auth-swap lock is taken — never spawn a
+ * child process while holding it. The keyring probe is skipped (false) when
+ * live credential files exist, because the swap only consults it in their
+ * absence.
+ */
+function resolveCodexSwapProbesSync() {
+    const systemHome = getSystemCodexHome();
+    return {
+        codexRunning: detectRunningCodexProcess(),
+        systemKeyringLoggedIn: hasCodexCredentialFiles(systemHome)
+            ? false
+            : getCodexLoginStatus(systemHome).loggedIn,
+    };
+}
+async function resolveCodexSwapProbesAsync() {
+    const systemHome = getSystemCodexHome();
+    return {
+        codexRunning: await detectRunningCodexProcessAsync(),
+        systemKeyringLoggedIn: hasCodexCredentialFiles(systemHome)
+            ? false
+            : (await getCodexLoginStatusAsync(systemHome)).loggedIn,
+    };
+}
 function performCodexAuthSwap(target) {
+    const probes = resolveCodexSwapProbesSync();
+    try {
+        return withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, probes));
+    }
+    catch (err) {
+        // Keep the non-throwing result contract when the lock cannot be acquired.
+        return { success: false, error: `Could not acquire the account-switch lock: ${err}` };
+    }
+}
+async function performCodexAuthSwapAsync(target) {
+    const probes = await resolveCodexSwapProbesAsync();
+    try {
+        // The sync lock is fine here: probes are pre-resolved, so the critical
+        // section is only fast local-filesystem work.
+        return withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, probes));
+    }
+    catch (err) {
+        return { success: false, error: `Could not acquire the account-switch lock: ${err}` };
+    }
+}
+function performCodexAuthSwapCore(target, probes) {
     const systemHome = getSystemCodexHome();
     const liveAuthPath = path.join(systemHome, 'auth.json');
     const liveLegacyPath = path.join(systemHome, '.credentials.json');
     const liveAuthRaw = readFileOrNull(liveAuthPath);
     const liveLegacyRaw = readFileOrNull(liveLegacyPath);
-    if (!liveAuthRaw && !liveLegacyRaw && getCodexLoginStatus(systemHome).loggedIn) {
+    if (!liveAuthRaw && !liveLegacyRaw && probes.systemKeyringLoggedIn) {
         return {
             success: false,
             error: 'Codex stores credentials in the OS keyring; file-based account switching is not supported. Set `cli_auth_credentials_store = "file"` in ~/.codex/config.toml and run `codex login` again.',
@@ -587,7 +696,7 @@ function performCodexAuthSwap(target) {
         };
     }
     const warnings = [];
-    if (detectRunningCodexProcess()) {
+    if (probes.codexRunning) {
         warnings.push('A codex process appears to be running; restart codex sessions so they pick up the switched account.');
     }
     // If the live file already belongs to the target account it is the freshest
@@ -607,10 +716,11 @@ function performCodexAuthSwap(target) {
     if (liveMatchesTarget) {
         try {
             if (liveAuthRaw)
-                atomicWriteFile(targetAuthPath, liveAuthRaw);
+                (0, atomic_1.atomicWriteFileSync)(targetAuthPath, liveAuthRaw);
             if (liveLegacyRaw)
-                atomicWriteFile(path.join(profileHome, '.credentials.json'), liveLegacyRaw);
-            const metadata = readCodexAccountMetadata(profileHome);
+                (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, '.credentials.json'), liveLegacyRaw);
+            // File-based metadata only — see the swap-lock note above.
+            const metadata = readCodexAccountMetadataFromFiles(profileHome) ?? {};
             (0, accountRegistry_1.upsertSavedAccountProfile)({
                 ...target,
                 email: metadata.email ?? target.email,
@@ -633,11 +743,11 @@ function performCodexAuthSwap(target) {
     const restoreLiveFiles = () => {
         try {
             if (liveAuthRaw)
-                atomicWriteFile(liveAuthPath, liveAuthRaw);
+                (0, atomic_1.atomicWriteFileSync)(liveAuthPath, liveAuthRaw);
             else
                 fs.rmSync(liveAuthPath, { force: true });
             if (liveLegacyRaw)
-                atomicWriteFile(liveLegacyPath, liveLegacyRaw);
+                (0, atomic_1.atomicWriteFileSync)(liveLegacyPath, liveLegacyRaw);
             else
                 fs.rmSync(liveLegacyPath, { force: true });
         }
@@ -647,14 +757,14 @@ function performCodexAuthSwap(target) {
     };
     try {
         if (targetAuthRaw) {
-            atomicWriteFile(liveAuthPath, targetAuthRaw);
+            (0, atomic_1.atomicWriteFileSync)(liveAuthPath, targetAuthRaw);
             if (targetLegacyRaw)
-                atomicWriteFile(liveLegacyPath, targetLegacyRaw);
+                (0, atomic_1.atomicWriteFileSync)(liveLegacyPath, targetLegacyRaw);
             else if (liveLegacyRaw)
                 fs.rmSync(liveLegacyPath, { force: true });
         }
         else {
-            atomicWriteFile(liveLegacyPath, targetLegacyRaw);
+            (0, atomic_1.atomicWriteFileSync)(liveLegacyPath, targetLegacyRaw);
             if (liveAuthRaw)
                 fs.rmSync(liveAuthPath, { force: true });
         }
@@ -679,15 +789,56 @@ function switchToCodexAccount(profileId) {
     }
     return performCodexAuthSwap(target);
 }
+/** {@link switchToCodexAccount} without blocking the event loop on CLI probes. */
+async function switchToCodexAccountAsync(profileId) {
+    const target = listCodexAccounts().find((account) => account.id === profileId);
+    if (!target) {
+        return { success: false, error: `Codex account ${profileId} not found.` };
+    }
+    return performCodexAuthSwapAsync(target);
+}
+/**
+ * The reconcile flow consults the keyring probe only when the migration has
+ * not run yet and the system home has no auth.json; skip the spawn otherwise.
+ */
+function needsReconcileKeyringProbe() {
+    const markerPath = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', '.live-auth-migrated-v1');
+    if (fs.existsSync(markerPath))
+        return false;
+    return !fs.existsSync(path.join(getSystemCodexHome(), 'auth.json'));
+}
 // One-time migration for installs created when profile homes doubled as live
 // CODEX_HOMEs: the active profile's auth.json may hold a fresher rotated
 // refresh token than the system home. Best-effort: never throws.
 function reconcileCodexAuthState() {
+    try {
+        const systemKeyringLoggedIn = needsReconcileKeyringProbe()
+            ? getCodexLoginStatus(getSystemCodexHome()).loggedIn
+            : false;
+        withCodexAuthSwapLock(() => reconcileCodexAuthStateCore({ systemKeyringLoggedIn }));
+    }
+    catch {
+        // Reconciliation must never break startup — including a lock timeout.
+    }
+}
+/** {@link reconcileCodexAuthState} without blocking the event loop on CLI probes. */
+async function reconcileCodexAuthStateAsync() {
+    try {
+        const systemKeyringLoggedIn = needsReconcileKeyringProbe()
+            ? (await getCodexLoginStatusAsync(getSystemCodexHome())).loggedIn
+            : false;
+        withCodexAuthSwapLock(() => reconcileCodexAuthStateCore({ systemKeyringLoggedIn }));
+    }
+    catch {
+        // Reconciliation must never break startup — including a lock timeout.
+    }
+}
+function reconcileCodexAuthStateCore(probes) {
     try {
         const markerPath = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', '.live-auth-migrated-v1');
         if (fs.existsSync(markerPath))
             return;
-        const writeMarker = () => atomicWriteFile(markerPath, new Date().toISOString() + '\n');
+        const writeMarker = () => (0, atomic_1.atomicWriteFileSync)(markerPath, new Date().toISOString() + '\n');
         const active = getActiveCodexAccount();
         if (!active) {
             writeMarker();
@@ -706,9 +857,10 @@ function reconcileCodexAuthState() {
         if (!liveAuthRaw) {
             // No live credentials (account was added via isolated login and never
             // promoted). Promote the active profile's copy unless codex is logged
-            // in through the OS keyring.
-            if (!getCodexLoginStatus(systemHome).loggedIn) {
-                atomicWriteFile(liveAuthPath, profileAuthRaw);
+            // in through the OS keyring. The probe was resolved before the swap
+            // lock was taken — never spawn while holding it.
+            if (!probes.systemKeyringLoggedIn) {
+                (0, atomic_1.atomicWriteFileSync)(liveAuthPath, profileAuthRaw);
             }
             writeMarker();
             return;
@@ -726,10 +878,10 @@ function reconcileCodexAuthState() {
                 // The profile copy was the live home under the old model and holds
                 // the valid rotated refresh token — promote it.
                 stashLiveCodexAuth(liveAuthRaw, null);
-                atomicWriteFile(liveAuthPath, profileAuthRaw);
+                (0, atomic_1.atomicWriteFileSync)(liveAuthPath, profileAuthRaw);
             }
             else {
-                atomicWriteFile(profileAuthPath, liveAuthRaw);
+                (0, atomic_1.atomicWriteFileSync)(profileAuthPath, liveAuthRaw);
             }
         }
         else {
@@ -738,7 +890,7 @@ function reconcileCodexAuthState() {
             // one, and refresh its backup.
             const matching = findProfileForIdentity(liveIdentity);
             if (matching && matching.id !== active.id) {
-                atomicWriteFile(path.join(getCodexProfileHome(matching.id), 'auth.json'), liveAuthRaw);
+                (0, atomic_1.atomicWriteFileSync)(path.join(getCodexProfileHome(matching.id), 'auth.json'), liveAuthRaw);
                 (0, accountRegistry_1.setActiveSavedAccount)('codex', matching.id);
             }
         }

package/dist/context/sessionContext.js

@@ -12,6 +12,7 @@ exports.createSessionContextProjector = createSessionContextProjector;
 exports.readSessionContextSnapshot = readSessionContextSnapshot;
 const EventAggregator_1 = require("../aggregation/EventAggregator");
 const modelContext_1 = require("../modelContext");
+const mcpToolName_1 = require("../parsers/mcpToolName");
 const tokenEstimation_1 = require("../tokenEstimation");
 const DEFAULT_CONTEXT_SOURCE_LIMIT = 200;
 const DEFAULT_SNIPPET_MAX_CHARS = 240;
@@ -490,10 +491,7 @@ function inferMcpServer(toolName, input) {
     const explicit = input._sidekickMcpServerName ?? input.server_name ?? input.serverName;
     if (typeof explicit === 'string' && explicit.trim())
         return explicit.trim();
-    const match = /^mcp__([^_]+(?:_[^_]+)*)__/.exec(toolName);
-    if (match)
-        return match[1];
-    return undefined;
+    return (0, mcpToolName_1.parseMcpToolName)(toolName)?.serverName;
 }
 function extractText(content) {
     if (typeof content === 'string')

package/dist/ensureDefaultAccounts.js

@@ -72,14 +72,14 @@ async function ensureDefaultClaudeAccount(options) {
 function cleanupPendingCodexProfile(profileId) {
     fs.rmSync(path.join((0, codexProfiles_1.getCodexProfilesDir)(), profileId), { recursive: true, force: true });
 }
-function ensureDefaultCodexAccount(options) {
+async function ensureDefaultCodexAccount(options) {
     try {
         if ((0, codexProfiles_1.getActiveCodexAccount)())
             return 'skipped';
         const systemAuthPath = path.join((0, codexProfiles_1.getSystemCodexHome)(), 'auth.json');
         if (!fs.existsSync(systemAuthPath))
             return 'skipped';
-        const result = (0, codexProfiles_1.prepareCodexAccount)('Default');
+        const result = await (0, codexProfiles_1.prepareCodexAccountAsync)('Default');
         if (result.success && !result.needsLogin)
             return 'registered';
         if (result.profileId) {
@@ -95,7 +95,7 @@ function ensureDefaultCodexAccount(options) {
 }
 async function ensureDefaultAccounts(options) {
     const claude = await ensureDefaultClaudeAccount(options);
-    const codex = ensureDefaultCodexAccount(options);
+    const codex = await ensureDefaultCodexAccount(options);
     try {
         (0, accounts_1.reconcileClaudeAuthState)();
     }
@@ -103,7 +103,7 @@ async function ensureDefaultAccounts(options) {
         logFailure(options, 'Claude auth reconciliation failed.', error);
     }
     try {
-        (0, codexProfiles_1.reconcileCodexAuthState)();
+        await (0, codexProfiles_1.reconcileCodexAuthStateAsync)();
     }
     catch (error) {
         logFailure(options, 'Codex auth reconciliation failed.', error);