sidekick-shared 0.26.5 → 0.26.6

package/dist/accounts.js

@@ -1,9 +1,14 @@
 "use strict";
 /**
- * Multi-account management for Claude Max subscriptions.
+ * Multi-account management for Claude Code logins.
  *
- * Handles saving, listing, switching, and removing Claude accounts.
+ * Handles saving, listing, switching, syncing, and removing Claude accounts.
  * Both the VS Code extension and CLI consume this module.
+ *
+ * Model: the live home (`CLAUDE_CONFIG_DIR` or `~/.claude`) is the source of
+ * truth for whichever account is logged in right now; every saved profile is a
+ * backup that the sync core keeps fresh, because Claude Code rotates the
+ * refresh token on every refresh and a stale snapshot is a dead login.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -39,11 +44,20 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.storeClaudeProfileIdentity = storeClaudeProfileIdentity;
+exports.storeClaudeProfileCredentials = storeClaudeProfileCredentials;
+exports.readStoredClaudeAccount = readStoredClaudeAccount;
 exports.readAccountRegistry = readAccountRegistry;
 exports.writeAccountRegistry = writeAccountRegistry;
 exports.readActiveClaudeAccount = readActiveClaudeAccount;
 exports.addCurrentAccount = addCurrentAccount;
+exports.withClaudeAuthSwapLock = withClaudeAuthSwapLock;
+exports.syncClaudeLiveStateUnlocked = syncClaudeLiveStateUnlocked;
+exports.syncClaudeLiveState = syncClaudeLiveState;
+exports.cleanupAbandonedClaudeLogins = cleanupAbandonedClaudeLogins;
 exports.switchToAccount = switchToAccount;
+exports.switchToAccountAsync = switchToAccountAsync;
+exports.applyClaudeProfileToLiveHome = applyClaudeProfileToLiveHome;
 exports.resolveActiveClaudeHome = resolveActiveClaudeHome;
 exports.applyActiveClaudeToLiveHome = applyActiveClaudeToLiveHome;
 exports.reconcileClaudeAuthState = reconcileClaudeAuthState;
@@ -54,29 +68,16 @@ exports.resolveActiveClaudeAccount = resolveActiveClaudeAccount;
 exports.isMultiAccountEnabled = isMultiAccountEnabled;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const os = __importStar(require("os"));
 const credentialIO_1 = require("./credentialIO");
 const atomic_1 = require("./writers/atomic");
 const accountRegistry_1 = require("./accountRegistry");
 const claudeProfiles_1 = require("./claudeProfiles");
+const claudeCredentials_1 = require("./claudeCredentials");
+const accountHealth_1 = require("./accountHealth");
+const accountSwitch_1 = require("./accountSwitch");
+const accountSyncTypes_1 = require("./accountSyncTypes");
+const processDetection_1 = require("./processDetection");
 // ── Paths ────────────────────────────────────────────────────────────────
-function getClaudeDir() {
-    return path.join(os.homedir(), '.claude');
-}
-function getClaudeConfigPath() {
-    // Primary: ~/.claude/.claude.json
-    const primary = path.join(getClaudeDir(), '.claude.json');
-    try {
-        const data = JSON.parse(fs.readFileSync(primary, 'utf8'));
-        if (data?.oauthAccount)
-            return primary;
-    }
-    catch {
-        /* fall through */
-    }
-    // Fallback: ~/.claude.json (some Claude Code versions store config here)
-    return path.join(os.homedir(), '.claude.json');
-}
 function getCredentialsDir() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'credentials');
 }
@@ -104,15 +105,34 @@ function readOauthAccountFromConfigPath(filePath) {
     const parsed = readJsonOrNull(filePath);
     return parsed?.oauthAccount ?? null;
 }
-function writeClaudeProfileConfig(uuid, oauthAccount) {
+/** Store a profile's identity (`oauthAccount`) in its home and the flat backup. */
+function storeClaudeProfileIdentity(uuid, oauthAccount) {
     (0, atomic_1.atomicWriteJsonSync)(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json'), { oauthAccount });
+    try {
+        (0, atomic_1.atomicWriteJsonSync)(path.join(getConfigsDir(), `${uuid}.config.json`), oauthAccount);
+    }
+    catch {
+        /* the profile home is canonical; the flat copy is a fallback */
+    }
 }
-function writeClaudeProfileCredentials(uuid, credentials) {
+/**
+ * The single chokepoint for storing a Claude credential in a profile: profile
+ * home store (suffixed Keychain item on macOS, file elsewhere), the flat
+ * backup, and the secret-free health sidecar.
+ */
+function storeClaudeProfileCredentials(uuid, credentials, source) {
     (0, credentialIO_1.writeActiveCredentials)(credentials, (0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+    try {
+        (0, atomic_1.atomicWriteJsonSync)(path.join(getCredentialsDir(), `${uuid}.credentials.json`), credentials);
+    }
+    catch {
+        /* the profile home is canonical; the flat copy is a fallback */
+    }
+    (0, accountHealth_1.writeClaudeHealthSidecar)(uuid, credentials, source);
 }
-function writeClaudeProfileMirror(uuid, credentials, oauthAccount) {
-    writeClaudeProfileConfig(uuid, oauthAccount);
-    writeClaudeProfileCredentials(uuid, credentials);
+function writeClaudeProfileMirror(uuid, credentials, oauthAccount, source) {
+    storeClaudeProfileIdentity(uuid, oauthAccount);
+    storeClaudeProfileCredentials(uuid, credentials, source);
 }
 function readFlatClaudeCredentials(uuid) {
     return readJsonOrNull(path.join(getCredentialsDir(), `${uuid}.credentials.json`));
@@ -133,7 +153,7 @@ function readStoredClaudeAccount(uuid) {
     const flatOauthAccount = readFlatClaudeOauthAccount(uuid);
     if (flatCredentials && flatOauthAccount) {
         try {
-            writeClaudeProfileMirror(uuid, flatCredentials, flatOauthAccount);
+            writeClaudeProfileMirror(uuid, flatCredentials, flatOauthAccount, 'migration');
         }
         catch {
             // Flat backups remain the fallback when profile materialization fails.
@@ -143,45 +163,21 @@ function readStoredClaudeAccount(uuid) {
     return null;
 }
 function readCurrentLiveOauthAccount() {
-    return readOauthAccountFromConfigPath(getClaudeConfigPath());
-}
-function backupCurrentClaudeLiveHome() {
-    const currentActive = readActiveClaudeAccount();
-    if (!currentActive)
-        return;
-    const originalCreds = (0, credentialIO_1.readActiveCredentials)();
-    const originalOauthAccount = readCurrentLiveOauthAccount();
-    if (originalCreds) {
-        try {
-            (0, atomic_1.atomicWriteJsonSync)(path.join(getCredentialsDir(), `${currentActive.uuid}.credentials.json`), originalCreds);
-            writeClaudeProfileCredentials(currentActive.uuid, originalCreds);
-        }
-        catch {
-            // Best effort only.
-        }
-    }
-    if (originalOauthAccount) {
-        try {
-            (0, atomic_1.atomicWriteJsonSync)(path.join(getConfigsDir(), `${currentActive.uuid}.config.json`), originalOauthAccount);
-            writeClaudeProfileConfig(currentActive.uuid, originalOauthAccount);
-        }
-        catch {
-            // Best effort only.
-        }
-    }
+    return readOauthAccountFromConfigPath((0, claudeProfiles_1.getClaudeConfigPath)());
 }
 function mergeOauthAccountIntoLiveConfig(oauthAccount) {
     let configObj = {};
+    const configPath = (0, claudeProfiles_1.getClaudeConfigPath)();
     try {
-        configObj = JSON.parse(fs.readFileSync(getClaudeConfigPath(), 'utf8'));
+        configObj = JSON.parse(fs.readFileSync(configPath, 'utf8'));
     }
     catch {
         // File may not exist yet.
     }
     configObj.oauthAccount = oauthAccount;
-    (0, atomic_1.atomicWriteJsonSync)(getClaudeConfigPath(), configObj);
+    (0, atomic_1.atomicWriteJsonSync)(configPath, configObj);
 }
-// ── Registry operations ──────────────────────────────────────────────────
+// ── Registry operations (legacy v1 view over the shared v2 registry) ───────
 function readAccountRegistry() {
     const registry = (0, accountRegistry_1.readSavedAccountRegistry)();
     if (!registry)
@@ -203,11 +199,11 @@ function readAccountRegistry() {
 function writeAccountRegistry(registry) {
     (0, accountRegistry_1.replaceSavedAccountProfiles)('claude-code', mapClaudeProfiles(registry), registry.activeAccountUuid);
 }
-/** For callers already holding the registry lock (see withSavedAccountRegistryLock). */
-function writeAccountRegistryUnlocked(registry) {
-    (0, accountRegistry_1.replaceSavedAccountProfilesUnlocked)('claude-code', mapClaudeProfiles(registry), registry.activeAccountUuid);
-}
 function mapClaudeProfiles(registry) {
+    const existing = new Map((0, accountRegistry_1.listSavedAccountProfiles)('claude-code').map((profile) => [
+        profile.providerAccountId ?? profile.id,
+        profile,
+    ]));
     return registry.accounts.map((account) => ({
         id: account.uuid,
         providerId: 'claude-code',
@@ -216,28 +212,26 @@ function mapClaudeProfiles(registry) {
         label: account.label,
         addedAt: account.addedAt,
         metadata: {
+            ...existing.get(account.uuid)?.metadata,
             email: account.email,
         },
     }));
 }
 // ── Read active Claude account ───────────────────────────────────────────
 function readActiveClaudeAccount() {
-    try {
-        const content = fs.readFileSync(getClaudeConfigPath(), 'utf8');
-        const parsed = JSON.parse(content);
-        const email = parsed?.oauthAccount?.emailAddress;
-        const uuid = parsed?.oauthAccount?.accountUuid;
-        if (!email || !uuid)
-            return null;
-        return { email, uuid };
-    }
-    catch {
-        return null;
-    }
+    return (0, claudeProfiles_1.readLiveClaudeIdentity)();
+}
+function findClaudeProfile(uuid) {
+    return ((0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((profile) => (profile.providerAccountId ?? profile.id) === uuid) ?? null);
+}
+function findClaudeProfileForIdentity(identity) {
+    const profiles = (0, accountRegistry_1.listSavedAccountProfiles)('claude-code');
+    return (profiles.find((p) => (p.providerAccountId ?? p.id) === identity.uuid) ??
+        profiles.find((p) => (p.email ?? p.metadata?.email) === identity.email) ??
+        null);
 }
 // ── Add current account ──────────────────────────────────────────────────
 function addCurrentAccount(label) {
-    // 1. Read current Claude identity
     const active = readActiveClaudeAccount();
     if (!active) {
         return {
@@ -245,130 +239,277 @@ function addCurrentAccount(label) {
             error: 'No active Claude account found. Sign in with `claude` first.',
         };
     }
-    // 2. Read current credentials (platform-aware: Keychain on macOS, file on Linux)
     const credBlob = (0, credentialIO_1.readActiveCredentials)();
     if (!credBlob) {
         return { success: false, error: 'Could not read Claude credentials.' };
     }
-    // 3. Read oauthAccount section from .claude.json
-    let configBlob;
-    try {
-        const raw = JSON.parse(fs.readFileSync(getClaudeConfigPath(), 'utf8'));
-        configBlob = raw.oauthAccount;
-    }
-    catch {
+    const configBlob = readCurrentLiveOauthAccount();
+    if (!configBlob) {
         return { success: false, error: 'Could not read Claude config file.' };
     }
     ensureDirs();
-    // 4–7 are one read-modify-write of the registry: hold the registry lock
-    // across them so a concurrent add from another process is not dropped
-    // when this write replaces the whole Claude profile set.
+    try {
+        writeClaudeProfileMirror(active.uuid, credBlob, configBlob, 'login');
+    }
+    catch (err) {
+        return { success: false, error: `Failed to back up Claude credentials: ${err}` };
+    }
+    // One read-modify-write of the registry under the lock so a concurrent add
+    // from another process is never dropped.
     return (0, accountRegistry_1.withSavedAccountRegistryLock)(() => {
-        // 4. Load or create registry
-        const registry = readAccountRegistry() ?? {
-            version: 1,
-            activeAccountUuid: null,
-            accounts: [],
-        };
-        // 5. Check if account already exists — update credentials + label
-        const existing = registry.accounts.find((a) => a.uuid === active.uuid);
-        if (existing) {
-            if (label !== undefined)
-                existing.label = label;
-            (0, atomic_1.atomicWriteJsonSync)(path.join(getCredentialsDir(), `${active.uuid}.credentials.json`), credBlob);
-            (0, atomic_1.atomicWriteJsonSync)(path.join(getConfigsDir(), `${active.uuid}.config.json`), configBlob);
-            try {
-                writeClaudeProfileMirror(active.uuid, credBlob, configBlob);
-            }
-            catch {
-                /* flat backups remain available */
-            }
-            registry.activeAccountUuid = active.uuid;
-            writeAccountRegistryUnlocked(registry);
-            return { success: true };
-        }
-        // 6. New account — back up credentials
-        (0, atomic_1.atomicWriteJsonSync)(path.join(getCredentialsDir(), `${active.uuid}.credentials.json`), credBlob);
-        (0, atomic_1.atomicWriteJsonSync)(path.join(getConfigsDir(), `${active.uuid}.config.json`), configBlob);
-        try {
-            writeClaudeProfileMirror(active.uuid, credBlob, configBlob);
-        }
-        catch {
-            /* flat backups remain available */
-        }
-        // 7. Add entry
-        registry.accounts.push({
-            uuid: active.uuid,
+        const existing = findClaudeProfile(active.uuid);
+        const id = existing?.id ?? active.uuid;
+        (0, accountRegistry_1.upsertSavedAccountProfileUnlocked)({
+            id,
+            providerId: 'claude-code',
+            providerAccountId: active.uuid,
             email: active.email,
-            label,
-            addedAt: new Date().toISOString(),
+            label: label !== undefined ? label || undefined : existing?.label,
+            addedAt: existing?.addedAt ?? new Date().toISOString(),
+            metadata: {
+                ...existing?.metadata,
+                email: active.email,
+                origin: existing?.metadata?.origin ?? 'manual',
+            },
         });
-        registry.activeAccountUuid = active.uuid;
-        writeAccountRegistryUnlocked(registry);
+        (0, accountRegistry_1.setActiveSavedAccountUnlocked)('claude-code', id);
         return { success: true };
     });
 }
-// ── Switch to account ────────────────────────────────────────────────────
+// ── Live-state sync ──────────────────────────────────────────────────────
 /**
  * Serializes live Claude credential swaps across processes so two concurrent
  * switchers cannot interleave their backup/write/rollback sequences. It cannot
  * exclude Claude Code's own writes to the live home — only our switchers. Lock
  * ordering: this lock first, the registry lock (inside setActiveSavedAccount)
- * inside it — never the reverse.
+ * inside it — never the reverse. Never spawn a child process while holding it.
  */
 function withClaudeAuthSwapLock(operation) {
     const lockDir = path.join((0, accountRegistry_1.getAccountsDir)(), 'claude');
     fs.mkdirSync(lockDir, { recursive: true, mode: 0o700 });
     return (0, atomic_1.withFileLockSync)(path.join(lockDir, 'auth-swap.lock'), operation);
 }
-function switchToAccount(uuid) {
+/**
+ * Fold the live login into the saved profiles: register an unknown login
+ * (label = email), refresh the matching profile's backup when the live
+ * credential is newer, and re-point the active pointer at it. Caller holds the
+ * swap lock. Never throws; problems land in `warnings`.
+ */
+function syncClaudeLiveStateUnlocked(source = 'live-sync') {
+    const report = (0, accountSyncTypes_1.emptyProviderSyncReport)();
     try {
-        // Keep the non-throwing result contract when the lock cannot be acquired.
-        return withClaudeAuthSwapLock(() => switchToAccountUnlocked(uuid));
+        const identity = readActiveClaudeAccount();
+        if (!identity) {
+            report.skipped = 'logged-out';
+            return report;
+        }
+        let profile = findClaudeProfileForIdentity(identity);
+        if (!profile) {
+            profile = {
+                id: identity.uuid,
+                providerId: 'claude-code',
+                providerAccountId: identity.uuid,
+                email: identity.email,
+                label: identity.email,
+                addedAt: new Date().toISOString(),
+                metadata: { email: identity.email, origin: 'live-sync' },
+            };
+            ensureDirs();
+            (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
+            report.registered = { id: profile.id, email: identity.email };
+        }
+        else if (profile.email !== identity.email && identity.email) {
+            profile = {
+                ...profile,
+                email: identity.email,
+                metadata: { ...profile.metadata, email: identity.email },
+            };
+            (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
+        }
+        const uuid = profile.providerAccountId ?? profile.id;
+        const liveBlob = (0, credentialIO_1.readActiveCredentials)();
+        const live = (0, claudeCredentials_1.parseClaudeCredentialBlob)(liveBlob);
+        if (live) {
+            const sidecar = (0, accountHealth_1.readHealthSidecar)('claude-code', uuid);
+            const storedFreshness = sidecar?.accessExpiresAt ?? sidecar?.refreshExpiresAt ?? 0;
+            const liveFreshness = (0, claudeCredentials_1.claudeCredentialFreshness)(live);
+            const needsFold = !sidecar ||
+                liveFreshness > storedFreshness ||
+                (liveFreshness === storedFreshness &&
+                    !fs.existsSync(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json')));
+            if (needsFold) {
+                try {
+                    writeClaudeProfileMirror(uuid, liveBlob, readCurrentLiveOauthAccount() ?? {
+                        emailAddress: identity.email,
+                        accountUuid: identity.uuid,
+                    }, source);
+                    report.folded = profile.id;
+                }
+                catch (err) {
+                    report.warnings.push(`Could not back up the live Claude credentials: ${err}`);
+                }
+            }
+        }
+        else if (liveBlob === null) {
+            report.warnings.push('The live Claude credential store could not be read.');
+        }
+        const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
+        if (!active || active.id !== profile.id) {
+            (0, accountRegistry_1.setActiveSavedAccount)('claude-code', profile.id, { silent: true });
+            report.repointed = profile.id;
+        }
     }
     catch (err) {
-        return { success: false, error: `Could not acquire the account-switch lock: ${err}` };
+        report.warnings.push(`Claude account sync failed: ${err}`);
     }
+    return report;
 }
-function switchToAccountUnlocked(uuid) {
-    const registry = readAccountRegistry();
-    if (!registry) {
-        return { success: false, error: 'No account registry found. Save an account first.' };
+/** {@link syncClaudeLiveStateUnlocked} under the swap lock. */
+function syncClaudeLiveState(source = 'live-sync') {
+    try {
+        return withClaudeAuthSwapLock(() => syncClaudeLiveStateUnlocked(source));
     }
-    const target = registry.accounts.find((a) => a.uuid === uuid);
-    if (!target) {
-        return { success: false, error: `Account ${uuid} not found in registry.` };
+    catch (err) {
+        return { warnings: [`Could not acquire the account-switch lock: ${err}`] };
     }
-    // 1. Back up current credentials + config (for whichever Claude account is live).
-    let originalCreds = null;
-    let originalConfig = null;
-    originalCreds = (0, credentialIO_1.readActiveCredentials)();
+}
+/**
+ * Remove isolated login homes that never authenticated (the user closed the
+ * browser, the login timed out) once they are older than `olderThanMs`.
+ * Returns the removed login ids.
+ */
+function cleanupAbandonedClaudeLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Date.now()) {
+    const removed = [];
+    let entries = [];
     try {
-        originalConfig = fs.readFileSync(getClaudeConfigPath(), 'utf8');
+        entries = fs.readdirSync((0, claudeProfiles_1.getClaudeProfilesDir)());
     }
     catch {
-        /* no existing config to back up */
+        return removed;
+    }
+    const registered = new Set((0, accountRegistry_1.listSavedAccountProfiles)('claude-code').map((p) => p.id));
+    for (const loginId of entries) {
+        if (registered.has(loginId))
+            continue;
+        const dir = (0, claudeProfiles_1.getClaudeProfileDir)(loginId);
+        const pendingPath = path.join(dir, 'profile.json');
+        const pending = readJsonOrNull(pendingPath);
+        if (!pending)
+            continue;
+        const home = (0, claudeProfiles_1.getClaudeProfileHome)(loginId);
+        if ((0, claudeProfiles_1.isClaudeProfileAuthenticated)(home))
+            continue;
+        const addedAt = pending.addedAt ? Date.parse(pending.addedAt) : NaN;
+        const age = Number.isNaN(addedAt) ? Number.POSITIVE_INFINITY : now - addedAt;
+        if (age < olderThanMs)
+            continue;
+        try {
+            (0, credentialIO_1.deleteStoredCredentials)(home);
+            fs.rmSync(dir, { recursive: true, force: true });
+            removed.push(loginId);
+        }
+        catch {
+            /* best effort */
+        }
     }
+    return removed;
+}
+// ── Switch to account ────────────────────────────────────────────────────
+function switchToAccount(uuid, options = {}) {
+    const consumers = (0, processDetection_1.detectRunningAccountConsumersSync)('claude-code');
+    return runClaudeSwitch(uuid, options, consumers);
+}
+/** {@link switchToAccount} with the process probe off the event loop. */
+async function switchToAccountAsync(uuid, options = {}) {
+    const consumers = await (0, processDetection_1.detectRunningAccountConsumers)('claude-code');
+    return runClaudeSwitch(uuid, options, consumers);
+}
+function runClaudeSwitch(uuid, options, consumers) {
     try {
-        backupCurrentClaudeLiveHome();
+        // Keep the non-throwing result contract when the lock cannot be acquired.
+        return withClaudeAuthSwapLock(() => switchToAccountUnlocked(uuid, options, consumers));
     }
-    catch {
-        /* best effort */
+    catch (err) {
+        return (0, accountSwitch_1.switchFailure)('claude-code', uuid, `Could not acquire the account-switch lock: ${err}`);
+    }
+}
+function switchToAccountUnlocked(uuid, options, consumers) {
+    const target = findClaudeProfile(uuid);
+    if (!target) {
+        return (0, accountSwitch_1.switchFailure)('claude-code', uuid, `Account ${uuid} not found in registry.`);
+    }
+    const targetName = target.label ?? target.email ?? uuid;
+    // Refuse to treat one of our own profile homes as the live home: a shell
+    // that eval'd `sidekick accounts env` would otherwise overwrite that profile.
+    const liveHome = path.resolve((0, claudeProfiles_1.getLiveClaudeHome)());
+    const profilesDir = path.resolve((0, claudeProfiles_1.getClaudeProfilesDir)());
+    if (liveHome === profilesDir || liveHome.startsWith(profilesDir + path.sep)) {
+        return (0, accountSwitch_1.switchFailure)('claude-code', uuid, `CLAUDE_CONFIG_DIR points at a sidekick profile home (${liveHome}); unset it before switching accounts.`);
+    }
+    // Phase 1: capture the outgoing login (rotated refresh token included) and
+    // register it if sidekick has never seen it. Only then is the "previous"
+    // account known: it is whatever was really live, not the stale pointer.
+    const sync = syncClaudeLiveStateUnlocked('switch');
+    const previousAccountId = (0, accountRegistry_1.getActiveSavedAccount)('claude-code')?.id ?? null;
+    const base = {
+        success: true,
+        provider: 'claude-code',
+        accountId: target.id,
+        previousAccountId,
+        verified: false,
+        verification: 'none',
+        warnings: [...sync.warnings],
+        hints: [],
+        runningConsumers: consumers,
+        email: target.email,
+    };
+    if (readActiveClaudeAccount()?.uuid === uuid) {
+        if (previousAccountId !== target.id)
+            (0, accountRegistry_1.setActiveSavedAccount)('claude-code', target.id);
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            alreadyActive: true,
+            verified: true,
+            verification: 'store',
+            health: (0, accountHealth_1.getAccountHealth)('claude-code', target.id),
+            hints: [`${targetName} is already the active Claude account.`],
+        });
+    }
+    // Materialise pre-migration flat backups into the profile home first so the
+    // health probe (and the install) read one canonical store.
+    const stored = readStoredClaudeAccount(uuid);
+    if (!stored) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            needsLogin: true,
+            error: `Stored credentials for "${targetName}" not found; sign in again.`,
+        });
+    }
+    // Preflight: never install a credential we already know is dead.
+    const health = (0, accountHealth_1.getAccountHealth)('claude-code', target.id, { probe: 'store' });
+    base.health = health;
+    if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            needsLogin: true,
+            error: `Stored credentials for "${targetName}" have ${health.state === 'missing' ? 'not been saved' : 'expired'}; sign in again.`,
+        });
+    }
+    if (health.state === 'expiring' && health.reason) {
+        base.warnings.push(`"${targetName}": ${health.reason}`);
     }
+    // Snapshot the live state for rollback.
+    const originalCreds = (0, credentialIO_1.readActiveCredentials)();
+    let originalConfig = null;
     try {
-        (0, accountRegistry_1.setActiveSavedAccount)('claude-code', uuid);
+        originalConfig = fs.readFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), 'utf8');
     }
-    catch (err) {
-        return { success: false, error: `Failed to update account registry: ${err}` };
+    catch {
+        /* no existing config to back up */
     }
-    const applied = applyActiveClaudeToLiveHomeUnlocked();
-    if (!applied.success) {
-        try {
-            (0, accountRegistry_1.setActiveSavedAccount)('claude-code', registry.activeAccountUuid);
-        }
-        catch {
-            /* rollback failed */
-        }
+    const rollback = () => {
         if (originalCreds) {
             try {
                 (0, credentialIO_1.writeActiveCredentials)(originalCreds);
@@ -377,22 +518,104 @@ function switchToAccountUnlocked(uuid) {
                 /* rollback failed */
             }
         }
-        if (originalConfig) {
+        if (originalConfig !== null) {
             try {
-                fs.writeFileSync(getClaudeConfigPath(), originalConfig);
+                fs.writeFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), originalConfig);
             }
             catch {
                 /* rollback failed */
             }
         }
-        return applied;
+        try {
+            (0, accountRegistry_1.setActiveSavedAccount)('claude-code', previousAccountId, { silent: true });
+        }
+        catch {
+            /* rollback failed */
+        }
+    };
+    // Install.
+    try {
+        (0, credentialIO_1.writeActiveCredentials)(stored.credentials);
+        mergeOauthAccountIntoLiveConfig(stored.oauthAccount);
+    }
+    catch (err) {
+        rollback();
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            error: `Failed to write Claude credentials: ${err}`,
+        });
+    }
+    // Verify by re-reading the live store.
+    const installed = (0, claudeCredentials_1.parseClaudeCredentialBlob)((0, credentialIO_1.readActiveCredentials)());
+    const expected = (0, claudeCredentials_1.parseClaudeCredentialBlob)(stored.credentials);
+    const liveIdentity = readActiveClaudeAccount();
+    const verified = installed !== null &&
+        expected !== null &&
+        installed.accessToken === expected.accessToken &&
+        liveIdentity?.uuid === uuid;
+    if (!verified) {
+        rollback();
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            verification: 'failed',
+            error: `The live Claude credential store did not reflect the switch to "${targetName}"; the previous login was restored.`,
+        });
+    }
+    // Pointer last: a crash before this line leaves the registry pointing at the
+    // previous account, which the next sync repairs from the live identity.
+    try {
+        (0, accountRegistry_1.setActiveSavedAccount)('claude-code', target.id);
+    }
+    catch (err) {
+        rollback();
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            error: `Failed to update account registry: ${err}`,
+        });
+    }
+    let undoToken;
+    try {
+        undoToken = (0, accountSwitch_1.writeLastSwitch)('claude-code', previousAccountId, target.id).token;
+    }
+    catch {
+        base.warnings.push('The switch succeeded but could not be recorded for undo.');
+    }
+    return (0, accountSwitch_1.finishSwitchResult)({
+        ...base,
+        verified: true,
+        verification: 'store',
+        undoToken,
+        hints: [`New claude sessions use ${target.email ?? targetName}.`],
+    });
+}
+/**
+ * Install a saved profile's credentials into the live home without changing
+ * which account is active: used right after a re-login of the live account,
+ * whose freshly minted token must replace the (possibly dead) live one.
+ */
+function applyClaudeProfileToLiveHome(uuid) {
+    try {
+        return withClaudeAuthSwapLock(() => {
+            const stored = readStoredClaudeAccount(uuid);
+            if (!stored) {
+                return { success: false, error: `Stored credentials for ${uuid} not found.` };
+            }
+            (0, credentialIO_1.writeActiveCredentials)(stored.credentials);
+            mergeOauthAccountIntoLiveConfig(stored.oauthAccount);
+            return { success: true };
+        });
+    }
+    catch (err) {
+        return { success: false, error: `Could not install the refreshed credentials: ${err}` };
     }
-    return applied;
 }
 function resolveActiveClaudeHome() {
     const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
     if (!active)
-        return getClaudeDir();
+        return (0, claudeProfiles_1.getLiveClaudeHome)();
     return (0, claudeProfiles_1.getClaudeProfileHome)(active.providerAccountId ?? active.id);
 }
 function applyActiveClaudeToLiveHome() {
@@ -417,7 +640,7 @@ function applyActiveClaudeToLiveHomeUnlocked() {
     const originalCreds = (0, credentialIO_1.readActiveCredentials)();
     let originalConfig = null;
     try {
-        originalConfig = fs.readFileSync(getClaudeConfigPath(), 'utf8');
+        originalConfig = fs.readFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), 'utf8');
     }
     catch {
         /* no existing config to back up */
@@ -450,7 +673,7 @@ function applyActiveClaudeToLiveHomeUnlocked() {
         }
         if (originalConfig) {
             try {
-                fs.writeFileSync(getClaudeConfigPath(), originalConfig);
+                fs.writeFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), originalConfig);
             }
             catch {
                 /* rollback failed */
@@ -478,7 +701,7 @@ function reconcileClaudeAuthState() {
                     const oauthAccount = readFlatClaudeOauthAccount(uuid);
                     if (!credentials || !oauthAccount)
                         continue;
-                    writeClaudeProfileMirror(uuid, credentials, oauthAccount);
+                    writeClaudeProfileMirror(uuid, credentials, oauthAccount, 'migration');
                 }
                 catch {
                     // Migration is best-effort per account.
@@ -497,35 +720,32 @@ function reconcileClaudeAuthState() {
 }
 // ── Remove account ───────────────────────────────────────────────────────
 function removeAccount(uuid) {
-    // One read-modify-write under the registry lock (see addCurrentAccount).
+    // One read-modify-write of the registry under the lock (see addCurrentAccount).
     return (0, accountRegistry_1.withSavedAccountRegistryLock)(() => {
-        const registry = readAccountRegistry();
-        if (!registry) {
-            return { success: false, error: 'No account registry found.' };
-        }
-        const idx = registry.accounts.findIndex((a) => a.uuid === uuid);
-        if (idx === -1) {
+        const profile = findClaudeProfile(uuid);
+        if (!profile) {
             return { success: false, error: `Account ${uuid} not found.` };
         }
-        // Remove backed-up files
-        try {
-            fs.unlinkSync(path.join(getCredentialsDir(), `${uuid}.credentials.json`));
-        }
-        catch {
-            /* ok */
+        // Remove backed-up files and the profile home (credential store included).
+        for (const filePath of [
+            path.join(getCredentialsDir(), `${uuid}.credentials.json`),
+            path.join(getConfigsDir(), `${uuid}.config.json`),
+        ]) {
+            try {
+                fs.unlinkSync(filePath);
+            }
+            catch {
+                /* ok */
+            }
         }
         try {
-            fs.unlinkSync(path.join(getConfigsDir(), `${uuid}.config.json`));
+            (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+            fs.rmSync((0, claudeProfiles_1.getClaudeProfileDir)(profile.id), { recursive: true, force: true });
         }
         catch {
             /* ok */
         }
-        // Remove from registry
-        registry.accounts.splice(idx, 1);
-        if (registry.activeAccountUuid === uuid) {
-            registry.activeAccountUuid = registry.accounts[0]?.uuid ?? null;
-        }
-        writeAccountRegistryUnlocked(registry);
+        (0, accountRegistry_1.removeSavedAccountProfileUnlocked)('claude-code', profile.id);
         return { success: true };
     });
 }
@@ -551,22 +771,21 @@ function getActiveAccount() {
 }
 /**
  * Resolves the *currently logged-in* Claude account for display, preferring the
- * live `~/.claude/.claude.json` identity over the saved registry pointer (which
- * only sidekick's own switch flow updates and therefore goes stale after a native
+ * live `.claude.json` identity over the saved registry pointer (which only
+ * sidekick's own switch flow updates and therefore goes stale after a native
  * `claude /login`).
  *
  * Safe self-heal: when the live account matches a saved profile (by account UUID,
  * email as fallback) that isn't the current active pointer, the pointer is
  * re-pointed so registry-keyed data tracks reality too. Never creates or deletes
- * profiles; an unknown live account is shown as-is with no label and no write.
+ * profiles; an unknown live account is shown as-is with no label and no write
+ * (the sync engine registers it on the next startup or watch event).
  */
 function resolveActiveClaudeAccount(options = {}) {
     const selfHeal = options.selfHeal ?? true;
     const live = readActiveClaudeAccount();
     if (live) {
-        const profiles = (0, accountRegistry_1.listSavedAccountProfiles)('claude-code');
-        const match = profiles.find((p) => (p.providerAccountId ?? p.id) === live.uuid) ??
-            profiles.find((p) => (p.email ?? p.metadata?.email) === live.email);
+        const match = findClaudeProfileForIdentity(live);
         if (match) {
             const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
             // Hot paths (the status line runs on every prompt) pass selfHeal: false