sidekick-shared 0.26.5 → 0.26.6

package/dist/accountManager.js

@@ -42,6 +42,8 @@ exports.finalizeAccountLoginAsync = finalizeAccountLoginAsync;
 exports.spawnAccountLogin = spawnAccountLogin;
 exports.switchAccount = switchAccount;
 exports.switchAccountAsync = switchAccountAsync;
+exports.getLastSwitch = getLastSwitch;
+exports.undoLastSwitch = undoLastSwitch;
 exports.listAllAccounts = listAllAccounts;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
@@ -53,11 +55,9 @@ const accounts_1 = require("./accounts");
 const claudeProfiles_1 = require("./claudeProfiles");
 const credentialIO_1 = require("./credentialIO");
 const codexProfiles_1 = require("./codexProfiles");
-function getClaudeProfileDir(loginId) {
-    return path.dirname((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
-}
+const accountSwitch_1 = require("./accountSwitch");
 function getPendingClaudeProfilePath(loginId) {
-    return path.join(getClaudeProfileDir(loginId), 'profile.json');
+    return path.join((0, claudeProfiles_1.getClaudeProfileDir)(loginId), 'profile.json');
 }
 function readPendingClaudeProfile(loginId) {
     try {
@@ -79,11 +79,21 @@ function removePendingClaudeProfile(loginId) {
         /* best effort */
     }
 }
-function getClaudeCredentialsBackupPath(uuid) {
-    return path.join((0, accountRegistry_1.getAccountsDir)(), 'credentials', `${uuid}.credentials.json`);
-}
-function getClaudeConfigBackupPath(uuid) {
-    return path.join((0, accountRegistry_1.getAccountsDir)(), 'configs', `${uuid}.config.json`);
+/**
+ * A fresh `CLAUDE_CONFIG_DIR` puts the CLI through first-run onboarding before
+ * the login prompt. Seeding the onboarding flag keeps the isolated login on the
+ * sign-in flow only; `oauthAccount` is written by the CLI itself.
+ */
+function seedClaudeLoginHome(home) {
+    const configPath = path.join(home, '.claude.json');
+    if (fs.existsSync(configPath))
+        return;
+    try {
+        (0, atomic_1.atomicWriteJsonSync)(configPath, { hasCompletedOnboarding: true });
+    }
+    catch {
+        /* the CLI creates the file itself */
+    }
 }
 function readClaudeOauthAccount(home) {
     try {
@@ -94,7 +104,7 @@ function readClaudeOauthAccount(home) {
         return null;
     }
 }
-function copyClaudeProfileToCanonicalHome(sourceHome, accountUuid, credentials) {
+function copyClaudeProfileToCanonicalHome(sourceHome, accountUuid, credentials, oauthAccount) {
     const canonicalHome = (0, claudeProfiles_1.getClaudeProfileHome)(accountUuid);
     fs.mkdirSync(canonicalHome, { recursive: true, mode: 0o700 });
     if (path.resolve(sourceHome) !== path.resolve(canonicalHome)) {
@@ -105,27 +115,40 @@ function copyClaudeProfileToCanonicalHome(sourceHome, accountUuid, credentials)
             // The credential and identity files are re-written below when possible.
         }
     }
-    const sourceConfig = path.join(sourceHome, '.claude.json');
-    if (fs.existsSync(sourceConfig)) {
-        fs.copyFileSync(sourceConfig, path.join(canonicalHome, '.claude.json'));
-    }
-    (0, credentialIO_1.writeActiveCredentials)(credentials, canonicalHome);
+    (0, accounts_1.storeClaudeProfileIdentity)(accountUuid, oauthAccount);
+    (0, accounts_1.storeClaudeProfileCredentials)(accountUuid, credentials, 'login');
 }
 function parseClaudeLoginArgs(raw) {
     const trimmed = raw?.trim();
     return trimmed ? trimmed.split(/\s+/) : null;
 }
+/**
+ * `claude auth login` signs in without the interactive first-run flow the bare
+ * `claude /login` form triggers in a fresh config directory. Override with
+ * `SIDEKICK_CLAUDE_LOGIN_ARGS` (space separated) for older CLIs.
+ */
 function resolveClaudeLoginCommand(opts = {}) {
     if (opts.loginCommand)
         return opts.loginCommand;
     return {
         command: 'claude',
-        args: parseClaudeLoginArgs(process.env.SIDEKICK_CLAUDE_LOGIN_ARGS) ?? ['/login'],
+        args: parseClaudeLoginArgs(process.env.SIDEKICK_CLAUDE_LOGIN_ARGS) ?? ['auth', 'login'],
     };
 }
 function beginAccountLogin(provider, label, opts = {}) {
     if (provider === 'codex') {
-        const prepared = (0, codexProfiles_1.prepareCodexAccount)(label);
+        const existing = opts.existingAccountId
+            ? (0, codexProfiles_1.listCodexAccounts)().find((account) => account.id === opts.existingAccountId)
+            : undefined;
+        if (opts.existingAccountId && !existing) {
+            return { success: false, error: `Codex account ${opts.existingAccountId} not found.` };
+        }
+        // A re-login uses a throwaway label: finalize folds the fresh credentials
+        // into the existing profile by identity and keeps its label.
+        const effectiveLabel = existing
+            ? `${existing.label ?? existing.email ?? 'codex'} (re-login ${(0, crypto_1.randomUUID)().slice(0, 8)})`
+            : label.trim() || `Codex ${(0, codexProfiles_1.listCodexAccounts)().length + 1}`;
+        const prepared = (0, codexProfiles_1.prepareCodexAccount)(effectiveLabel);
         if (!prepared.success || !prepared.profileId || !prepared.codexHome) {
             return { success: false, error: prepared.error ?? 'Could not prepare Codex account login.' };
         }
@@ -135,6 +158,7 @@ function beginAccountLogin(provider, label, opts = {}) {
                 loginId: prepared.profileId,
                 alreadyComplete: true,
                 configDir: prepared.codexHome,
+                existingAccountId: existing?.id,
             };
         }
         const loginCommand = opts.loginCommand ?? { command: 'codex', args: ['login'] };
@@ -145,18 +169,23 @@ function beginAccountLogin(provider, label, opts = {}) {
             args: loginCommand.args,
             env: { CODEX_HOME: prepared.codexHome },
             configDir: prepared.codexHome,
+            existingAccountId: existing?.id,
         };
     }
-    const trimmedLabel = label.trim();
-    if (!trimmedLabel) {
-        return { success: false, error: 'Claude accounts require a non-empty label.' };
+    const existing = opts.existingAccountId
+        ? (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((account) => account.id === opts.existingAccountId)
+        : undefined;
+    if (opts.existingAccountId && !existing) {
+        return { success: false, error: `Claude account ${opts.existingAccountId} not found.` };
     }
     const loginId = (0, crypto_1.randomUUID)();
     const home = (0, claudeProfiles_1.getClaudeProfileHome)(loginId);
     writePendingClaudeProfile(loginId, {
-        label: trimmedLabel,
-        addedAt: new Date().toISOString(),
+        label: existing?.label ?? label.trim(),
+        addedAt: existing?.addedAt ?? new Date().toISOString(),
+        existingAccountId: existing?.id,
     });
+    seedClaudeLoginHome(home);
     const loginCommand = resolveClaudeLoginCommand(opts);
     return {
         success: true,
@@ -164,7 +193,9 @@ function beginAccountLogin(provider, label, opts = {}) {
         command: loginCommand.command,
         args: loginCommand.args,
         env: { CLAUDE_CONFIG_DIR: home },
+        envUnset: [claudeProfiles_1.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV],
         configDir: home,
+        existingAccountId: existing?.id,
     };
 }
 function getClaudeAccountLoginStatus(loginId) {
@@ -235,28 +266,51 @@ function finalizeClaudeAccountLogin(loginId, opts = {}) {
         return { success: false, error: 'Could not read Claude profile config.' };
     }
     const pending = readPendingClaudeProfile(loginId);
-    (0, atomic_1.atomicWriteJsonSync)(getClaudeCredentialsBackupPath(identity.uuid), credentials);
-    (0, atomic_1.atomicWriteJsonSync)(getClaudeConfigBackupPath(identity.uuid), oauthAccount);
-    copyClaudeProfileToCanonicalHome(home, identity.uuid, credentials);
+    const existing = (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((account) => (account.providerAccountId ?? account.id) === identity.uuid);
+    copyClaudeProfileToCanonicalHome(home, identity.uuid, credentials, oauthAccount);
+    const warnings = [];
+    if (pending?.existingAccountId && pending.existingAccountId !== identity.uuid) {
+        warnings.push(`You signed in as ${identity.email}, which is a different account from the one you chose to re-authenticate; it was saved separately.`);
+    }
     (0, accountRegistry_1.upsertSavedAccountProfile)({
-        id: identity.uuid,
+        id: existing?.id ?? identity.uuid,
         providerId: 'claude-code',
         providerAccountId: identity.uuid,
         email: identity.email,
-        label: pending?.label,
-        addedAt: pending?.addedAt ?? new Date().toISOString(),
+        label: existing?.label ?? (pending?.label || identity.email),
+        addedAt: existing?.addedAt ?? pending?.addedAt ?? new Date().toISOString(),
         metadata: {
+            ...existing?.metadata,
             email: identity.email,
+            origin: 'login',
         },
     });
     removePendingClaudeProfile(loginId);
     if (loginId !== identity.uuid) {
         removePendingClaudeProfile(identity.uuid);
+        // The temporary home's keychain item holds live tokens; nothing references it now.
+        (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
+        try {
+            fs.rmSync((0, claudeProfiles_1.getClaudeProfileDir)(loginId), { recursive: true, force: true });
+        }
+        catch {
+            /* the temporary login home is disposable */
+        }
     }
     if (opts.activate === false) {
-        return { success: true };
+        return { success: true, warning: warnings.length ? warnings.join(' ') : undefined };
+    }
+    if ((0, accounts_1.readActiveClaudeAccount)()?.uuid === identity.uuid) {
+        // Re-login of the account that is already live: the new token replaces
+        // the live one (which may be the dead credential that prompted the login).
+        const applied = (0, accounts_1.applyClaudeProfileToLiveHome)(identity.uuid);
+        if (!applied.success)
+            return applied;
     }
-    return (0, accounts_1.switchToAccount)(identity.uuid);
+    const switched = (0, accounts_1.switchToAccount)(identity.uuid);
+    return warnings.length
+        ? { ...switched, warning: [switched.warning, ...warnings].filter(Boolean).join(' ') }
+        : switched;
 }
 function emitStatus(opts, status) {
     opts.onStatus?.(status);
@@ -283,11 +337,48 @@ function waitForNextPoll(ms, signal) {
         signal?.addEventListener('abort', onAbort, { once: true });
     });
 }
+/** Most recent modification inside an isolated login home (the CLI writes as the user progresses). */
+function latestHomeActivity(home) {
+    if (!home)
+        return 0;
+    let latest = 0;
+    const candidates = [
+        home,
+        ...['.claude.json', '.credentials.json', 'auth.json', 'config.toml'].map((f) => path.join(home, f)),
+    ];
+    for (const candidate of candidates) {
+        try {
+            latest = Math.max(latest, fs.statSync(candidate).mtimeMs);
+        }
+        catch {
+            /* absent */
+        }
+    }
+    return latest;
+}
+function discardPendingLogin(provider, loginId) {
+    try {
+        const dir = provider === 'codex'
+            ? path.dirname((0, codexProfiles_1.getCodexProfileHome)(loginId))
+            : (0, claudeProfiles_1.getClaudeProfileDir)(loginId);
+        if (!dir.startsWith((0, accountRegistry_1.getAccountsDir)()))
+            return;
+        if (provider === 'claude-code')
+            (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
 async function spawnAccountLogin(provider, label, opts = {}) {
     if (opts.signal?.aborted) {
         return { success: false, error: 'Account login aborted.' };
     }
-    const begin = beginAccountLogin(provider, label, { loginCommand: opts.loginCommand });
+    const begin = beginAccountLogin(provider, label, {
+        loginCommand: opts.loginCommand,
+        existingAccountId: opts.existingAccountId,
+    });
     if (!begin.success)
         return { success: false, error: begin.error };
     if (begin.alreadyComplete) {
@@ -299,16 +390,25 @@ async function spawnAccountLogin(provider, label, opts = {}) {
     let childExited = false;
     let childExitCode = null;
     const childState = {};
-    const timeoutMs = opts.timeoutMs ?? 180_000;
-    const deadline = Date.now() + timeoutMs;
+    const inactivityMs = opts.timeoutMs ?? 180_000;
+    const maxMs = opts.maxTimeoutMs ?? 900_000;
+    const startedAt = Date.now();
+    let lastActivity = startedAt;
+    let lastSeenMtime = latestHomeActivity(begin.configDir);
+    const env = provider === 'codex'
+        ? { ...process.env, ...(begin.env ?? {}) }
+        : (0, claudeProfiles_1.buildClaudeChildEnv)(begin.configDir ?? '', process.env);
+    for (const name of begin.envUnset ?? [])
+        delete env[name];
     let child;
     try {
         child = (0, child_process_1.spawn)(begin.command, begin.args ?? [], {
-            env: { ...process.env, ...(begin.env ?? {}) },
+            env,
             stdio: opts.stdio ?? 'inherit',
         });
     }
     catch (err) {
+        discardPendingLogin(provider, begin.loginId);
         return { success: false, error: `Could not spawn account login: ${err}` };
     }
     child.on('exit', (code) => {
@@ -319,12 +419,15 @@ async function spawnAccountLogin(provider, label, opts = {}) {
         childExited = true;
         childState.spawnError = error;
     });
+    const abort = () => {
+        child.kill();
+        discardPendingLogin(provider, begin.loginId);
+        emitStatus(opts, { state: 'failed', error: 'Account login aborted.' });
+        return { success: false, error: 'Account login aborted.' };
+    };
     while (true) {
-        if (opts.signal?.aborted) {
-            child.kill();
-            emitStatus(opts, { state: 'failed', error: 'Account login aborted.' });
-            return { success: false, error: 'Account login aborted.' };
-        }
+        if (opts.signal?.aborted)
+            return abort();
         const status = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
         if (status.state === 'authenticated') {
             return finalizeAccountLoginAsync(provider, begin.loginId, {
@@ -334,6 +437,7 @@ async function spawnAccountLogin(provider, label, opts = {}) {
         if (childExited) {
             if (childState.spawnError) {
                 const error = `Could not spawn account login: ${childState.spawnError.message}`;
+                discardPendingLogin(provider, begin.loginId);
                 emitStatus(opts, { state: 'failed', error });
                 return { success: false, error };
             }
@@ -343,34 +447,63 @@ async function spawnAccountLogin(provider, label, opts = {}) {
                     activate: opts.activate ?? true,
                 });
             }
+            discardPendingLogin(provider, begin.loginId);
             emitStatus(opts, {
                 state: 'failed',
                 error: `Account login exited before authentication completed${childExitCode === null ? '.' : ` (exit ${childExitCode}).`}`,
             });
             return { success: false, error: 'Account login did not complete.' };
         }
-        const remainingMs = deadline - Date.now();
+        const now = Date.now();
+        const mtime = latestHomeActivity(begin.configDir);
+        if (mtime > lastSeenMtime) {
+            lastSeenMtime = mtime;
+            lastActivity = now;
+        }
+        const remainingMs = Math.min(inactivityMs - (now - lastActivity), maxMs - (now - startedAt));
         if (remainingMs <= 0) {
+            child.kill();
+            discardPendingLogin(provider, begin.loginId);
             emitStatus(opts, { state: 'failed', error: 'Account login timed out.' });
             return { success: false, error: 'Account login timed out.' };
         }
         const shouldContinue = await waitForNextPoll(Math.min(2_000, remainingMs), opts.signal);
-        if (!shouldContinue) {
-            child.kill();
-            emitStatus(opts, { state: 'failed', error: 'Account login aborted.' });
-            return { success: false, error: 'Account login aborted.' };
-        }
+        if (!shouldContinue)
+            return abort();
     }
 }
-function switchAccount(provider, id) {
-    return provider === 'codex' ? (0, codexProfiles_1.switchToCodexAccount)(id) : (0, accounts_1.switchToAccount)(id);
+function switchAccount(provider, id, options = {}) {
+    return provider === 'codex' ? (0, codexProfiles_1.switchToCodexAccount)(id, options) : (0, accounts_1.switchToAccount)(id, options);
 }
 /**
- * {@link switchAccount} without blocking the event loop on codex CLI probes.
+ * {@link switchAccount} without blocking the event loop on CLI/process probes.
  * The Claude path still performs bounded synchronous keychain reads on macOS.
  */
-async function switchAccountAsync(provider, id) {
-    return provider === 'codex' ? (0, codexProfiles_1.switchToCodexAccountAsync)(id) : (0, accounts_1.switchToAccount)(id);
+async function switchAccountAsync(provider, id, options = {}) {
+    return provider === 'codex'
+        ? (0, codexProfiles_1.switchToCodexAccountAsync)(id, options)
+        : (0, accounts_1.switchToAccountAsync)(id, options);
+}
+function getLastSwitch(provider) {
+    return (0, accountSwitch_1.readLastSwitch)(provider);
+}
+/**
+ * Switch back to the account that was live before the last recorded switch.
+ * With `token`, the record must match (a stale Undo button never reverts a
+ * newer switch).
+ */
+async function undoLastSwitch(provider, token) {
+    const record = (0, accountSwitch_1.readLastSwitch)(provider);
+    if (!record) {
+        return (0, accountSwitch_1.switchFailure)(provider, '', 'There is no account switch to undo.');
+    }
+    if (token && token !== record.token) {
+        return (0, accountSwitch_1.switchFailure)(provider, record.from ?? '', 'A newer account switch has happened since; nothing was undone.');
+    }
+    if (!record.from) {
+        return (0, accountSwitch_1.switchFailure)(provider, '', 'The previous state had no saved account to return to.');
+    }
+    return switchAccountAsync(provider, record.from);
 }
 function listAllAccounts() {
     return {

package/dist/accountRegistry.d.ts

@@ -1,11 +1,15 @@
 import type { AccountProviderId } from './providerIds';
 export { ACCOUNT_PROVIDER_IDS } from './providerIds';
 export type { AccountProviderId } from './providerIds';
+/** How a saved profile came to exist. */
+export type AccountProfileOrigin = 'login' | 'manual' | 'live-sync' | 'migration';
 export interface AccountIdentityMetadata {
     email?: string;
     workspaceId?: string;
     planType?: string;
     authMode?: 'chatgpt' | 'api-key' | 'unknown';
+    /** `live-sync` marks accounts sidekick registered from a login it observed. */
+    origin?: AccountProfileOrigin;
 }
 export interface SavedAccountProfile {
     id: string;
@@ -63,6 +67,10 @@ export declare function listSavedAccountProfiles(providerId?: AccountProviderId)
 export declare function getActiveSavedAccount(providerId: AccountProviderId): SavedAccountProfile | null;
 export declare function upsertSavedAccountProfile(profile: SavedAccountProfile): SavedAccountRegistry;
 export declare function setActiveSavedAccount(providerId: AccountProviderId, accountId: string | null, options?: RegistryWriteOptions): SavedAccountRegistry;
+/** {@link upsertSavedAccountProfile} for callers already inside {@link withSavedAccountRegistryLock}. */
+export declare function upsertSavedAccountProfileUnlocked(profile: SavedAccountProfile): SavedAccountRegistry;
+/** {@link setActiveSavedAccount} for callers already inside {@link withSavedAccountRegistryLock}. */
+export declare function setActiveSavedAccountUnlocked(providerId: AccountProviderId, accountId: string | null, options?: RegistryWriteOptions): SavedAccountRegistry;
 export declare function replaceSavedAccountProfiles(providerId: AccountProviderId, accounts: SavedAccountProfile[], activeId: string | null): SavedAccountRegistry;
 /**
  * Same as {@link replaceSavedAccountProfiles} without taking the registry
@@ -70,3 +78,5 @@ export declare function replaceSavedAccountProfiles(providerId: AccountProviderI
  */
 export declare function replaceSavedAccountProfilesUnlocked(providerId: AccountProviderId, accounts: SavedAccountProfile[], activeId: string | null): SavedAccountRegistry;
 export declare function removeSavedAccountProfile(providerId: AccountProviderId, accountId: string): SavedAccountProfile | null;
+/** {@link removeSavedAccountProfile} for callers already inside {@link withSavedAccountRegistryLock}. */
+export declare function removeSavedAccountProfileUnlocked(providerId: AccountProviderId, accountId: string): SavedAccountProfile | null;

package/dist/accountRegistry.js

@@ -42,9 +42,12 @@ exports.listSavedAccountProfiles = listSavedAccountProfiles;
 exports.getActiveSavedAccount = getActiveSavedAccount;
 exports.upsertSavedAccountProfile = upsertSavedAccountProfile;
 exports.setActiveSavedAccount = setActiveSavedAccount;
+exports.upsertSavedAccountProfileUnlocked = upsertSavedAccountProfileUnlocked;
+exports.setActiveSavedAccountUnlocked = setActiveSavedAccountUnlocked;
 exports.replaceSavedAccountProfiles = replaceSavedAccountProfiles;
 exports.replaceSavedAccountProfilesUnlocked = replaceSavedAccountProfilesUnlocked;
 exports.removeSavedAccountProfile = removeSavedAccountProfile;
+exports.removeSavedAccountProfileUnlocked = removeSavedAccountProfileUnlocked;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const paths_1 = require("./paths");
@@ -125,6 +128,7 @@ function normalizeRegistry(registry) {
                     workspaceId: account.metadata.workspaceId || undefined,
                     planType: account.metadata.planType || undefined,
                     authMode: account.metadata.authMode || undefined,
+                    origin: account.metadata.origin || undefined,
                 }
                 : undefined,
         }))
@@ -189,7 +193,19 @@ function getActiveSavedAccount(providerId) {
     return (registry.accounts.find((account) => account.providerId === providerId && account.id === activeId) ?? null);
 }
 function upsertSavedAccountProfile(profile) {
-    return mutateSavedAccountRegistry((registry) => {
+    return mutateSavedAccountRegistry(upsertProfile(profile));
+}
+function setActiveSavedAccount(providerId, accountId, options = {}) {
+    return mutateSavedAccountRegistry(setActive(providerId, accountId), options);
+}
+function setActive(providerId, accountId) {
+    return (registry) => {
+        registry.activeByProvider[providerId] = accountId;
+        return registry;
+    };
+}
+function upsertProfile(profile) {
+    return (registry) => {
         const index = registry.accounts.findIndex((account) => account.providerId === profile.providerId && account.id === profile.id);
         if (index >= 0) {
             registry.accounts[index] = profile;
@@ -198,13 +214,15 @@ function upsertSavedAccountProfile(profile) {
             registry.accounts.push(profile);
         }
         return registry;
-    });
+    };
 }
-function setActiveSavedAccount(providerId, accountId, options = {}) {
-    return mutateSavedAccountRegistry((registry) => {
-        registry.activeByProvider[providerId] = accountId;
-        return registry;
-    }, options);
+/** {@link upsertSavedAccountProfile} for callers already inside {@link withSavedAccountRegistryLock}. */
+function upsertSavedAccountProfileUnlocked(profile) {
+    return mutateSavedAccountRegistryUnlocked(upsertProfile(profile));
+}
+/** {@link setActiveSavedAccount} for callers already inside {@link withSavedAccountRegistryLock}. */
+function setActiveSavedAccountUnlocked(providerId, accountId, options = {}) {
+    return mutateSavedAccountRegistryUnlocked(setActive(providerId, accountId), options);
 }
 function replaceProfiles(providerId, accounts, activeId) {
     return (registry) => {
@@ -227,19 +245,21 @@ function replaceSavedAccountProfilesUnlocked(providerId, accounts, activeId) {
 }
 function removeSavedAccountProfile(providerId, accountId) {
     ensureAccountsDir();
-    return (0, atomic_1.withFileLockSync)(getRegistryLockPath(), () => {
-        const registry = readSavedAccountRegistry();
-        if (!registry)
-            return null;
-        const index = registry.accounts.findIndex((account) => account.providerId === providerId && account.id === accountId);
-        if (index === -1)
-            return null;
-        const [removed] = registry.accounts.splice(index, 1);
-        if (registry.activeByProvider[providerId] === accountId) {
-            registry.activeByProvider[providerId] =
-                registry.accounts.find((account) => account.providerId === providerId)?.id ?? null;
-        }
-        writeRegistryUnlocked(registry);
-        return removed;
-    });
+    return (0, atomic_1.withFileLockSync)(getRegistryLockPath(), () => removeSavedAccountProfileUnlocked(providerId, accountId));
+}
+/** {@link removeSavedAccountProfile} for callers already inside {@link withSavedAccountRegistryLock}. */
+function removeSavedAccountProfileUnlocked(providerId, accountId) {
+    const registry = readSavedAccountRegistry();
+    if (!registry)
+        return null;
+    const index = registry.accounts.findIndex((account) => account.providerId === providerId && account.id === accountId);
+    if (index === -1)
+        return null;
+    const [removed] = registry.accounts.splice(index, 1);
+    if (registry.activeByProvider[providerId] === accountId) {
+        registry.activeByProvider[providerId] =
+            registry.accounts.find((account) => account.providerId === providerId)?.id ?? null;
+    }
+    writeRegistryUnlocked(registry);
+    return removed;
 }

package/dist/accountSwitch.d.ts

@@ -0,0 +1,43 @@
+import { type AccountProviderId } from './accountRegistry';
+import type { AccountHealth } from './accountHealth';
+import type { AccountManagerResult } from './accounts';
+import type { RunningAccountConsumer } from './processDetection';
+export type SwitchVerification = 'store' | 'cli' | 'none' | 'failed';
+export interface SwitchAccountResult extends AccountManagerResult {
+    provider: AccountProviderId;
+    accountId: string;
+    previousAccountId: string | null;
+    /** True when the live store was re-read after the write and matched the target. */
+    verified: boolean;
+    verification: SwitchVerification;
+    health?: AccountHealth;
+    warnings: string[];
+    hints: string[];
+    runningConsumers: RunningAccountConsumer[];
+    /** Present after a successful switch that changed the live login. */
+    undoToken?: string;
+    /** True when the target was already the live login and nothing was written. */
+    alreadyActive?: boolean;
+    /** Email of the account now live, when known. */
+    email?: string;
+}
+export interface SwitchAccountOptions {
+    /** Also confirm through the provider CLI after the store check (async paths only). */
+    verifyWithCli?: boolean;
+    /** Switch even when the stored credential is reported expired. */
+    force?: boolean;
+}
+export interface LastSwitchRecord {
+    token: string;
+    provider: AccountProviderId;
+    from: string | null;
+    to: string;
+    at: string;
+}
+export declare function getLastSwitchPath(provider: AccountProviderId): string;
+export declare function readLastSwitch(provider: AccountProviderId): LastSwitchRecord | null;
+export declare function writeLastSwitch(provider: AccountProviderId, from: string | null, to: string): LastSwitchRecord;
+export declare function clearLastSwitch(provider: AccountProviderId): void;
+export declare function switchFailure(provider: AccountProviderId, accountId: string, error: string, extra?: Partial<SwitchAccountResult>): SwitchAccountResult;
+/** Fold per-consumer warnings into a result; keeps `warning` (legacy) in sync. */
+export declare function finishSwitchResult(result: SwitchAccountResult): SwitchAccountResult;