sidekick-shared 0.26.5 → 0.26.6

package/dist/accountSwitch.js

@@ -0,0 +1,115 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLastSwitchPath = getLastSwitchPath;
+exports.readLastSwitch = readLastSwitch;
+exports.writeLastSwitch = writeLastSwitch;
+exports.clearLastSwitch = clearLastSwitch;
+exports.switchFailure = switchFailure;
+exports.finishSwitchResult = finishSwitchResult;
+/**
+ * Shared shape of a verified account switch plus the undo record. The
+ * provider-specific switch cores live in accounts.ts (Claude) and
+ * codexProfiles.ts (Codex); accountManager.ts exposes the provider-agnostic
+ * `switchAccount*` and `undoLastSwitch` entry points.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const accountRegistry_1 = require("./accountRegistry");
+const atomic_1 = require("./writers/atomic");
+function providerDirName(provider) {
+    return provider === 'codex' ? 'codex' : 'claude';
+}
+function getLastSwitchPath(provider) {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), providerDirName(provider), 'last-switch.json');
+}
+function readLastSwitch(provider) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(getLastSwitchPath(provider), 'utf8'));
+        return parsed && typeof parsed.token === 'string' && typeof parsed.to === 'string'
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeLastSwitch(provider, from, to) {
+    const record = {
+        token: (0, crypto_1.randomUUID)(),
+        provider,
+        from,
+        to,
+        at: new Date().toISOString(),
+    };
+    (0, atomic_1.atomicWriteJsonSync)(getLastSwitchPath(provider), record);
+    return record;
+}
+function clearLastSwitch(provider) {
+    try {
+        fs.rmSync(getLastSwitchPath(provider), { force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
+function switchFailure(provider, accountId, error, extra = {}) {
+    return {
+        success: false,
+        error,
+        provider,
+        accountId,
+        previousAccountId: null,
+        verified: false,
+        verification: 'none',
+        warnings: [],
+        hints: [],
+        runningConsumers: [],
+        ...extra,
+    };
+}
+/** Fold per-consumer warnings into a result; keeps `warning` (legacy) in sync. */
+function finishSwitchResult(result) {
+    const warnings = [
+        ...result.warnings,
+        ...result.runningConsumers.map((consumer) => consumer.reachability),
+    ];
+    return {
+        ...result,
+        warnings,
+        warning: warnings.length ? warnings.join(' ') : undefined,
+    };
+}

package/dist/accountSync.d.ts

@@ -0,0 +1,30 @@
+import type { AccountProviderId } from './accountRegistry';
+import { type SyncReason, type SyncReport } from './accountSyncTypes';
+export interface SyncLiveAccountStateOptions {
+    providers?: AccountProviderId[];
+    reason?: SyncReason;
+    /**
+     * Skip the sync when the live files have not changed since the last pass
+     * (default for `watch`/`poll`). On macOS the Keychain cannot be fingerprinted
+     * cheaply, so a Claude fold still runs at most every `keychainFoldIntervalMs`.
+     */
+    onlyIfChanged?: boolean;
+    keychainFoldIntervalMs?: number;
+    now?: number;
+}
+/**
+ * Reconcile the live logins with the saved profiles for both providers.
+ * Safe to call from watchers: re-entrant calls return an empty report, and
+ * `onlyIfChanged` short-circuits when the live files are unchanged.
+ */
+export declare function syncLiveAccountStateSync(options?: SyncLiveAccountStateOptions): SyncReport;
+/** Promise-returning twin of {@link syncLiveAccountStateSync} for async hosts. */
+export declare function syncLiveAccountState(options?: SyncLiveAccountStateOptions): Promise<SyncReport>;
+/** Forget the change fingerprints (tests, or after an external reset). */
+export declare function _resetSyncFingerprints(): void;
+export interface CleanupAbandonedLoginsResult {
+    claude: string[];
+    codex: string[];
+}
+/** Remove isolated login homes that never authenticated (both providers). */
+export declare function cleanupAbandonedLogins(olderThanMs?: number, now?: number): CleanupAbandonedLoginsResult;

package/dist/accountSync.js

@@ -0,0 +1,180 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncLiveAccountStateSync = syncLiveAccountStateSync;
+exports.syncLiveAccountState = syncLiveAccountState;
+exports._resetSyncFingerprints = _resetSyncFingerprints;
+exports.cleanupAbandonedLogins = cleanupAbandonedLogins;
+/**
+ * Continuous reconciliation between the live provider logins and sidekick's
+ * saved profiles. One engine replaces the old bootstrap/reconcile/backup
+ * paths: it registers logins sidekick has never seen, folds rotated tokens
+ * back into their profile, merges duplicate Codex seats, and re-points the
+ * active pointer at whatever is really logged in.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const accounts_1 = require("./accounts");
+const claudeProfiles_1 = require("./claudeProfiles");
+const codexProfiles_1 = require("./codexProfiles");
+const codexPaths_1 = require("./codexPaths");
+const accountSyncTypes_1 = require("./accountSyncTypes");
+const DEFAULT_KEYCHAIN_FOLD_INTERVAL_MS = 10 * 60 * 1000;
+const fingerprints = {
+    'claude-code': {},
+    codex: {},
+};
+let syncInProgress = false;
+function statStamp(filePath) {
+    try {
+        const stat = fs.statSync(filePath);
+        return `${stat.mtimeMs}:${stat.size}`;
+    }
+    catch {
+        return 'absent';
+    }
+}
+function claudeFingerprint() {
+    const home = (0, claudeProfiles_1.getLiveClaudeHome)();
+    const identity = (0, claudeProfiles_1.readLiveClaudeIdentity)();
+    // Fingerprint the identity, not the config file: Claude Code rewrites
+    // `~/.claude.json` on nearly every prompt, which would defeat the
+    // `onlyIfChanged` short-circuit and the macOS keychain fold interval.
+    return [
+        identity?.uuid ?? 'none',
+        identity?.email ?? '',
+        statStamp(path.join(home, '.credentials.json')),
+    ].join('|');
+}
+function codexFingerprint() {
+    const home = (0, codexPaths_1.getSystemCodexHome)();
+    return [
+        statStamp(path.join(home, 'auth.json')),
+        statStamp(path.join(home, '.credentials.json')),
+    ].join('|');
+}
+function sourceForReason(reason) {
+    return reason === 'pre-switch' ? 'switch' : 'live-sync';
+}
+function shouldSync(provider, fingerprint, options) {
+    if (!options.onlyIfChanged)
+        return true;
+    const state = fingerprints[provider];
+    if (state.fingerprint !== fingerprint)
+        return true;
+    if (provider === 'claude-code' && process.platform === 'darwin') {
+        // The Keychain item can change without touching any watched file.
+        return (state.lastFoldAt ?? 0) + options.keychainFoldIntervalMs <= options.now;
+    }
+    return false;
+}
+/** Sync one provider under its swap lock; never throws. */
+function syncProvider(provider, reason, options) {
+    const fingerprint = provider === 'codex' ? codexFingerprint() : claudeFingerprint();
+    if (!shouldSync(provider, fingerprint, options)) {
+        return { ...(0, accountSyncTypes_1.emptyProviderSyncReport)(), skipped: 'unchanged' };
+    }
+    const source = sourceForReason(reason);
+    let report;
+    try {
+        report =
+            provider === 'codex'
+                ? (0, codexProfiles_1.withCodexAuthSwapLock)(() => (0, codexProfiles_1.syncCodexLiveStateUnlocked)(source))
+                : (0, accounts_1.withClaudeAuthSwapLock)(() => (0, accounts_1.syncClaudeLiveStateUnlocked)(source));
+    }
+    catch (err) {
+        return { warnings: [`Could not acquire the ${provider} account-switch lock: ${err}`] };
+    }
+    fingerprints[provider] = {
+        // Re-fingerprint after the sync: folding rewrites nothing in the live home,
+        // but registering touches accounts.json, which is also watched.
+        fingerprint: provider === 'codex' ? codexFingerprint() : claudeFingerprint(),
+        lastFoldAt: options.now,
+    };
+    return report;
+}
+/**
+ * Reconcile the live logins with the saved profiles for both providers.
+ * Safe to call from watchers: re-entrant calls return an empty report, and
+ * `onlyIfChanged` short-circuits when the live files are unchanged.
+ */
+function syncLiveAccountStateSync(options = {}) {
+    const reason = options.reason ?? 'manual';
+    const now = options.now ?? Date.now();
+    const resolved = {
+        onlyIfChanged: options.onlyIfChanged ?? (reason === 'watch' || reason === 'poll'),
+        keychainFoldIntervalMs: options.keychainFoldIntervalMs ?? DEFAULT_KEYCHAIN_FOLD_INTERVAL_MS,
+        now,
+    };
+    const providers = options.providers ?? ['claude-code', 'codex'];
+    const report = {
+        claude: { ...(0, accountSyncTypes_1.emptyProviderSyncReport)(), skipped: 'not-requested' },
+        codex: { ...(0, accountSyncTypes_1.emptyProviderSyncReport)(), skipped: 'not-requested' },
+        ranAt: now,
+        reason,
+    };
+    if (syncInProgress) {
+        report.claude.skipped = 'in-progress';
+        report.codex.skipped = 'in-progress';
+        return report;
+    }
+    syncInProgress = true;
+    try {
+        if (providers.includes('claude-code'))
+            report.claude = syncProvider('claude-code', reason, resolved);
+        if (providers.includes('codex'))
+            report.codex = syncProvider('codex', reason, resolved);
+    }
+    finally {
+        syncInProgress = false;
+    }
+    return report;
+}
+/** Promise-returning twin of {@link syncLiveAccountStateSync} for async hosts. */
+async function syncLiveAccountState(options = {}) {
+    return syncLiveAccountStateSync(options);
+}
+/** Forget the change fingerprints (tests, or after an external reset). */
+function _resetSyncFingerprints() {
+    fingerprints['claude-code'] = {};
+    fingerprints.codex = {};
+}
+/** Remove isolated login homes that never authenticated (both providers). */
+function cleanupAbandonedLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Date.now()) {
+    return {
+        claude: (0, accounts_1.cleanupAbandonedClaudeLogins)(olderThanMs, now),
+        codex: (0, codexProfiles_1.cleanupAbandonedCodexLogins)(olderThanMs, now),
+    };
+}

package/dist/accountSyncTypes.d.ts

@@ -0,0 +1,25 @@
+/** Reports produced by the live-state sync engine (see accountSync.ts). */
+export interface ProviderSyncReport {
+    /** A live login that had no saved profile was registered under this id. */
+    registered?: {
+        id: string;
+        email?: string;
+    };
+    /** The live credential was folded into this profile's backup. */
+    folded?: string;
+    /** The active pointer was moved to this profile to match the live login. */
+    repointed?: string;
+    /** Duplicate profiles merged away (ids of the removed losers). */
+    merged?: string[];
+    /** Why nothing was synced (`logged-out`, `keyring`, `no-identity`, `unchanged`). */
+    skipped?: string;
+    warnings: string[];
+}
+export type SyncReason = 'startup' | 'watch' | 'poll' | 'pre-switch' | 'manual';
+export interface SyncReport {
+    claude: ProviderSyncReport;
+    codex: ProviderSyncReport;
+    ranAt: number;
+    reason: SyncReason;
+}
+export declare function emptyProviderSyncReport(): ProviderSyncReport;

package/dist/accountSyncTypes.js

@@ -0,0 +1,7 @@
+"use strict";
+/** Reports produced by the live-state sync engine (see accountSync.ts). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptyProviderSyncReport = emptyProviderSyncReport;
+function emptyProviderSyncReport() {
+    return { warnings: [] };
+}

package/dist/accounts.d.ts

@@ -1,10 +1,18 @@
 /**
- * Multi-account management for Claude Max subscriptions.
+ * Multi-account management for Claude Code logins.
  *
- * Handles saving, listing, switching, and removing Claude accounts.
+ * Handles saving, listing, switching, syncing, and removing Claude accounts.
  * Both the VS Code extension and CLI consume this module.
+ *
+ * Model: the live home (`CLAUDE_CONFIG_DIR` or `~/.claude`) is the source of
+ * truth for whichever account is logged in right now; every saved profile is a
+ * backup that the sync core keeps fresh, because Claude Code rotates the
+ * refresh token on every refresh and a stale snapshot is a dead login.
  */
 import { type ResolvedActiveAccount } from './accountRegistry';
+import { type AccountHealthSource } from './accountHealth';
+import { type SwitchAccountOptions, type SwitchAccountResult } from './accountSwitch';
+import { type ProviderSyncReport } from './accountSyncTypes';
 export interface AccountEntry {
     uuid: string;
     email: string;
@@ -28,11 +36,54 @@ export interface AccountManagerResult {
     profileId?: string;
     codexHome?: string;
 }
+/** Store a profile's identity (`oauthAccount`) in its home and the flat backup. */
+export declare function storeClaudeProfileIdentity(uuid: string, oauthAccount: unknown): void;
+/**
+ * The single chokepoint for storing a Claude credential in a profile: profile
+ * home store (suffixed Keychain item on macOS, file elsewhere), the flat
+ * backup, and the secret-free health sidecar.
+ */
+export declare function storeClaudeProfileCredentials(uuid: string, credentials: unknown, source: AccountHealthSource): void;
+export declare function readStoredClaudeAccount(uuid: string): {
+    credentials: unknown;
+    oauthAccount: unknown;
+} | null;
 export declare function readAccountRegistry(): AccountRegistry | null;
 export declare function writeAccountRegistry(registry: AccountRegistry): void;
 export declare function readActiveClaudeAccount(): ActiveAccountInfo | null;
 export declare function addCurrentAccount(label?: string): AccountManagerResult;
-export declare function switchToAccount(uuid: string): AccountManagerResult;
+/**
+ * Serializes live Claude credential swaps across processes so two concurrent
+ * switchers cannot interleave their backup/write/rollback sequences. It cannot
+ * exclude Claude Code's own writes to the live home — only our switchers. Lock
+ * ordering: this lock first, the registry lock (inside setActiveSavedAccount)
+ * inside it — never the reverse. Never spawn a child process while holding it.
+ */
+export declare function withClaudeAuthSwapLock<T>(operation: () => T): T;
+/**
+ * Fold the live login into the saved profiles: register an unknown login
+ * (label = email), refresh the matching profile's backup when the live
+ * credential is newer, and re-point the active pointer at it. Caller holds the
+ * swap lock. Never throws; problems land in `warnings`.
+ */
+export declare function syncClaudeLiveStateUnlocked(source?: AccountHealthSource): ProviderSyncReport;
+/** {@link syncClaudeLiveStateUnlocked} under the swap lock. */
+export declare function syncClaudeLiveState(source?: AccountHealthSource): ProviderSyncReport;
+/**
+ * Remove isolated login homes that never authenticated (the user closed the
+ * browser, the login timed out) once they are older than `olderThanMs`.
+ * Returns the removed login ids.
+ */
+export declare function cleanupAbandonedClaudeLogins(olderThanMs?: number, now?: number): string[];
+export declare function switchToAccount(uuid: string, options?: SwitchAccountOptions): SwitchAccountResult;
+/** {@link switchToAccount} with the process probe off the event loop. */
+export declare function switchToAccountAsync(uuid: string, options?: SwitchAccountOptions): Promise<SwitchAccountResult>;
+/**
+ * Install a saved profile's credentials into the live home without changing
+ * which account is active: used right after a re-login of the live account,
+ * whose freshly minted token must replace the (possibly dead) live one.
+ */
+export declare function applyClaudeProfileToLiveHome(uuid: string): AccountManagerResult;
 export declare function resolveActiveClaudeHome(): string;
 export declare function applyActiveClaudeToLiveHome(): AccountManagerResult;
 export declare function reconcileClaudeAuthState(): void;
@@ -41,14 +92,15 @@ export declare function listAccounts(): AccountEntry[];
 export declare function getActiveAccount(): AccountEntry | null;
 /**
  * Resolves the *currently logged-in* Claude account for display, preferring the
- * live `~/.claude/.claude.json` identity over the saved registry pointer (which
- * only sidekick's own switch flow updates and therefore goes stale after a native
+ * live `.claude.json` identity over the saved registry pointer (which only
+ * sidekick's own switch flow updates and therefore goes stale after a native
  * `claude /login`).
  *
  * Safe self-heal: when the live account matches a saved profile (by account UUID,
  * email as fallback) that isn't the current active pointer, the pointer is
  * re-pointed so registry-keyed data tracks reality too. Never creates or deletes
- * profiles; an unknown live account is shown as-is with no label and no write.
+ * profiles; an unknown live account is shown as-is with no label and no write
+ * (the sync engine registers it on the next startup or watch event).
  */
 export declare function resolveActiveClaudeAccount(options?: {
     selfHeal?: boolean;