sidekick-shared 0.26.5 → 0.26.6

package/dist/claudeCredentials.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Pure helpers over the Claude Code credential blob (`claudeAiOauth`). No I/O.
+ */
+export interface ClaudeOauthCredentials {
+    accessToken: string;
+    refreshToken?: string;
+    /** Access token expiry, ms since epoch (~8 h after issue). */
+    expiresAt?: number;
+    /** Refresh token expiry, ms since epoch (~3 weeks after issue on current builds). */
+    refreshTokenExpiresAt?: number;
+    scopes?: string[];
+    subscriptionType?: string;
+    rateLimitTier?: string;
+}
+/** Lifetime of a Claude Code access token. */
+export declare const CLAUDE_ACCESS_TOKEN_LIFETIME_MS: number;
+/**
+ * Refresh-token lifetime observed on Claude Code 2.1.x. Used only to estimate
+ * the refresh expiry of snapshots captured before the CLI recorded it.
+ */
+export declare const CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS: number;
+/** Parse the stored blob, tolerating the `mcpOAuth` sibling and unknown keys. */
+export declare function parseClaudeCredentialBlob(blob: unknown): ClaudeOauthCredentials | null;
+/**
+ * Monotonic freshness clock: every refresh issues a new access token with a
+ * later `expiresAt`, so the larger value is the newer credential.
+ */
+export declare function claudeCredentialFreshness(credentials: ClaudeOauthCredentials | null): number;
+/** True when `candidate` is strictly newer than `existing`. */
+export declare function isNewerClaudeCredential(candidate: ClaudeOauthCredentials | null, existing: ClaudeOauthCredentials | null): boolean;
+/**
+ * When the refresh-token expiry was recorded, use it; otherwise estimate it
+ * from the access-token issue time. Returns `estimated: true` for the latter.
+ */
+export declare function resolveClaudeRefreshExpiry(credentials: ClaudeOauthCredentials | null): {
+    refreshExpiresAt: number;
+    estimated: boolean;
+} | null;

package/dist/claudeCredentials.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Pure helpers over the Claude Code credential blob (`claudeAiOauth`). No I/O.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS = exports.CLAUDE_ACCESS_TOKEN_LIFETIME_MS = void 0;
+exports.parseClaudeCredentialBlob = parseClaudeCredentialBlob;
+exports.claudeCredentialFreshness = claudeCredentialFreshness;
+exports.isNewerClaudeCredential = isNewerClaudeCredential;
+exports.resolveClaudeRefreshExpiry = resolveClaudeRefreshExpiry;
+/** Lifetime of a Claude Code access token. */
+exports.CLAUDE_ACCESS_TOKEN_LIFETIME_MS = 8 * 60 * 60 * 1000;
+/**
+ * Refresh-token lifetime observed on Claude Code 2.1.x. Used only to estimate
+ * the refresh expiry of snapshots captured before the CLI recorded it.
+ */
+exports.CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS = 21 * 24 * 60 * 60 * 1000;
+function finiteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+/** Parse the stored blob, tolerating the `mcpOAuth` sibling and unknown keys. */
+function parseClaudeCredentialBlob(blob) {
+    if (!blob || typeof blob !== 'object')
+        return null;
+    const oauth = blob.claudeAiOauth;
+    if (!oauth || typeof oauth !== 'object')
+        return null;
+    const record = oauth;
+    if (typeof record.accessToken !== 'string' || !record.accessToken)
+        return null;
+    return {
+        accessToken: record.accessToken,
+        refreshToken: typeof record.refreshToken === 'string' ? record.refreshToken : undefined,
+        expiresAt: finiteNumber(record.expiresAt),
+        refreshTokenExpiresAt: finiteNumber(record.refreshTokenExpiresAt),
+        scopes: Array.isArray(record.scopes)
+            ? record.scopes.filter((scope) => typeof scope === 'string')
+            : undefined,
+        subscriptionType: typeof record.subscriptionType === 'string' ? record.subscriptionType : undefined,
+        rateLimitTier: typeof record.rateLimitTier === 'string' ? record.rateLimitTier : undefined,
+    };
+}
+/**
+ * Monotonic freshness clock: every refresh issues a new access token with a
+ * later `expiresAt`, so the larger value is the newer credential.
+ */
+function claudeCredentialFreshness(credentials) {
+    if (!credentials)
+        return 0;
+    return credentials.expiresAt ?? credentials.refreshTokenExpiresAt ?? 0;
+}
+/** True when `candidate` is strictly newer than `existing`. */
+function isNewerClaudeCredential(candidate, existing) {
+    return claudeCredentialFreshness(candidate) > claudeCredentialFreshness(existing);
+}
+/**
+ * When the refresh-token expiry was recorded, use it; otherwise estimate it
+ * from the access-token issue time. Returns `estimated: true` for the latter.
+ */
+function resolveClaudeRefreshExpiry(credentials) {
+    if (!credentials)
+        return null;
+    if (credentials.refreshTokenExpiresAt !== undefined) {
+        return { refreshExpiresAt: credentials.refreshTokenExpiresAt, estimated: false };
+    }
+    if (credentials.expiresAt !== undefined) {
+        const issuedAt = credentials.expiresAt - exports.CLAUDE_ACCESS_TOKEN_LIFETIME_MS;
+        return {
+            refreshExpiresAt: issuedAt + exports.CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS,
+            estimated: true,
+        };
+    }
+    return null;
+}

package/dist/claudeProfiles.d.ts

@@ -1,12 +1,52 @@
+/**
+ * Claude Code honours this variable ahead of `CLAUDE_CONFIG_DIR` when it
+ * derives the keychain item name. Any `claude` child sidekick spawns must not
+ * inherit it, or the login would land in an item nobody else reads.
+ */
+export declare const CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV = "CLAUDE_SECURESTORAGE_CONFIG_DIR";
 export interface ClaudeProfileIdentity {
     email: string;
     uuid: string;
 }
+export declare function getDefaultClaudeHome(): string;
+/** True when this process runs against the default `~/.claude` home. */
+export declare function isDefaultClaudeHome(): boolean;
+/**
+ * The home the `claude` CLI reads and writes for this process: `CLAUDE_CONFIG_DIR`
+ * when set, else `~/.claude`. Every "live" credential or identity read goes
+ * through this so sidekick follows the same home the CLI does.
+ */
+export declare function getLiveClaudeHome(): string;
 export declare function getClaudeProfilesDir(): string;
+export declare function getClaudeProfileDir(uuid: string): string;
 export declare function getClaudeProfileHome(uuid: string): string;
 export declare function ensureClaudeProfileDirs(uuid: string): void;
+/**
+ * Claude Code hashes the NFC-normalised config directory; macOS hands paths
+ * back decomposed (NFD), so a home directory with a non-ASCII name would
+ * otherwise hash differently from the item the CLI wrote.
+ */
 export declare function claudeKeychainSuffix(configDir: string): string;
+/**
+ * Keychain service name for a config directory. Claude Code drops the suffix
+ * when `CLAUDE_CONFIG_DIR` is unset — not when the path merely equals
+ * `~/.claude` — so the no-argument form follows the process environment.
+ */
 export declare function claudeKeychainService(configDir?: string): string;
+/** The keychain account name Claude Code uses: the unix username, sanitised. */
+export declare function claudeKeychainAccountName(): string;
+/** Environment for spawning `claude` against a specific home. */
+export declare function buildClaudeChildEnv(home: string, baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Where the identity (`oauthAccount`) of a Claude home lives. Recent Claude
+ * Code versions keep it in `<home>/.claude.json`; older ones (and the default
+ * home on this machine's history) use `~/.claude.json`. Prefer the in-home file
+ * when it carries an identity, otherwise fall back to the legacy location for
+ * the default home only.
+ */
+export declare function getClaudeConfigPath(home?: string): string;
+/** Identity of the account currently logged in to a Claude home (default: the live home). */
+export declare function readLiveClaudeIdentity(home?: string): ClaudeProfileIdentity | null;
 export declare function readClaudeProfileIdentity(home: string): ClaudeProfileIdentity | null;
 export declare function keychainServiceExists(service: string): boolean;
 export declare function isClaudeProfileAuthenticated(home: string): boolean;

package/dist/claudeProfiles.js

@@ -33,48 +33,139 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV = void 0;
+exports.getDefaultClaudeHome = getDefaultClaudeHome;
+exports.isDefaultClaudeHome = isDefaultClaudeHome;
+exports.getLiveClaudeHome = getLiveClaudeHome;
 exports.getClaudeProfilesDir = getClaudeProfilesDir;
+exports.getClaudeProfileDir = getClaudeProfileDir;
 exports.getClaudeProfileHome = getClaudeProfileHome;
 exports.ensureClaudeProfileDirs = ensureClaudeProfileDirs;
 exports.claudeKeychainSuffix = claudeKeychainSuffix;
 exports.claudeKeychainService = claudeKeychainService;
+exports.claudeKeychainAccountName = claudeKeychainAccountName;
+exports.buildClaudeChildEnv = buildClaudeChildEnv;
+exports.getClaudeConfigPath = getClaudeConfigPath;
+exports.readLiveClaudeIdentity = readLiveClaudeIdentity;
 exports.readClaudeProfileIdentity = readClaudeProfileIdentity;
 exports.keychainServiceExists = keychainServiceExists;
 exports.isClaudeProfileAuthenticated = isClaudeProfileAuthenticated;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const accountRegistry_1 = require("./accountRegistry");
 const DEFAULT_CLAUDE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
+const KEYCHAIN_ACCOUNT_PATTERN = /^[a-zA-Z0-9._-]+$/;
+const KEYCHAIN_FALLBACK_ACCOUNT = 'claude-code-user';
+/**
+ * Claude Code honours this variable ahead of `CLAUDE_CONFIG_DIR` when it
+ * derives the keychain item name. Any `claude` child sidekick spawns must not
+ * inherit it, or the login would land in an item nobody else reads.
+ */
+exports.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV = 'CLAUDE_SECURESTORAGE_CONFIG_DIR';
+function getDefaultClaudeHome() {
+    return path.join(os.homedir(), '.claude');
+}
+/** True when this process runs against the default `~/.claude` home. */
+function isDefaultClaudeHome() {
+    return !process.env.CLAUDE_CONFIG_DIR?.trim();
+}
+/**
+ * The home the `claude` CLI reads and writes for this process: `CLAUDE_CONFIG_DIR`
+ * when set, else `~/.claude`. Every "live" credential or identity read goes
+ * through this so sidekick follows the same home the CLI does.
+ */
+function getLiveClaudeHome() {
+    const explicit = process.env.CLAUDE_CONFIG_DIR?.trim();
+    return explicit ? explicit : getDefaultClaudeHome();
+}
 function getClaudeProfilesDir() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'claude', 'profiles');
 }
+function getClaudeProfileDir(uuid) {
+    return path.join(getClaudeProfilesDir(), uuid);
+}
 function getClaudeProfileHome(uuid) {
-    return path.join(getClaudeProfilesDir(), uuid, 'home');
+    return path.join(getClaudeProfileDir(uuid), 'home');
 }
 function ensureClaudeProfileDirs(uuid) {
     fs.mkdirSync(getClaudeProfileHome(uuid), { recursive: true, mode: 0o700 });
 }
+/**
+ * Claude Code hashes the NFC-normalised config directory; macOS hands paths
+ * back decomposed (NFD), so a home directory with a non-ASCII name would
+ * otherwise hash differently from the item the CLI wrote.
+ */
 function claudeKeychainSuffix(configDir) {
-    return (0, crypto_1.createHash)('sha256').update(configDir).digest('hex').slice(0, 8);
+    return (0, crypto_1.createHash)('sha256').update(configDir.normalize('NFC')).digest('hex').slice(0, 8);
 }
+/**
+ * Keychain service name for a config directory. Claude Code drops the suffix
+ * when `CLAUDE_CONFIG_DIR` is unset — not when the path merely equals
+ * `~/.claude` — so the no-argument form follows the process environment.
+ */
 function claudeKeychainService(configDir) {
-    return configDir
-        ? `${DEFAULT_CLAUDE_KEYCHAIN_SERVICE}-${claudeKeychainSuffix(configDir)}`
+    const dir = configDir ?? (isDefaultClaudeHome() ? undefined : getLiveClaudeHome());
+    return dir
+        ? `${DEFAULT_CLAUDE_KEYCHAIN_SERVICE}-${claudeKeychainSuffix(dir)}`
         : DEFAULT_CLAUDE_KEYCHAIN_SERVICE;
 }
-function readClaudeProfileIdentity(home) {
+/** The keychain account name Claude Code uses: the unix username, sanitised. */
+function claudeKeychainAccountName() {
+    let name;
     try {
-        const raw = JSON.parse(fs.readFileSync(path.join(home, '.claude.json'), 'utf8'));
-        const email = raw?.oauthAccount?.emailAddress;
-        const uuid = raw?.oauthAccount?.accountUuid;
-        return typeof email === 'string' && typeof uuid === 'string' ? { email, uuid } : null;
+        name = process.env.USER || os.userInfo().username;
+    }
+    catch {
+        name = undefined;
+    }
+    return name && KEYCHAIN_ACCOUNT_PATTERN.test(name) ? name : KEYCHAIN_FALLBACK_ACCOUNT;
+}
+/** Environment for spawning `claude` against a specific home. */
+function buildClaudeChildEnv(home, baseEnv = process.env) {
+    const env = { ...baseEnv, CLAUDE_CONFIG_DIR: home };
+    delete env[exports.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV];
+    return env;
+}
+function readOauthAccount(configPath) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        return raw?.oauthAccount && typeof raw.oauthAccount === 'object' ? raw.oauthAccount : null;
     }
     catch {
         return null;
     }
 }
+/**
+ * Where the identity (`oauthAccount`) of a Claude home lives. Recent Claude
+ * Code versions keep it in `<home>/.claude.json`; older ones (and the default
+ * home on this machine's history) use `~/.claude.json`. Prefer the in-home file
+ * when it carries an identity, otherwise fall back to the legacy location for
+ * the default home only.
+ */
+function getClaudeConfigPath(home = getLiveClaudeHome()) {
+    const primary = path.join(home, '.claude.json');
+    if (readOauthAccount(primary))
+        return primary;
+    if (path.resolve(home) === path.resolve(getDefaultClaudeHome())) {
+        return path.join(os.homedir(), '.claude.json');
+    }
+    return primary;
+}
+function identityFromOauthAccount(oauthAccount) {
+    const email = oauthAccount?.emailAddress;
+    const uuid = oauthAccount?.accountUuid;
+    return typeof email === 'string' && typeof uuid === 'string' ? { email, uuid } : null;
+}
+/** Identity of the account currently logged in to a Claude home (default: the live home). */
+function readLiveClaudeIdentity(home = getLiveClaudeHome()) {
+    return identityFromOauthAccount(readOauthAccount(getClaudeConfigPath(home)));
+}
+function readClaudeProfileIdentity(home) {
+    return identityFromOauthAccount(readOauthAccount(path.join(home, '.claude.json')));
+}
 function keychainServiceExists(service) {
     try {
         (0, child_process_1.execFileSync)('security', ['find-generic-password', '-s', service], {
@@ -90,7 +181,8 @@ function keychainServiceExists(service) {
 }
 function isClaudeProfileAuthenticated(home) {
     const hasCredentials = process.platform === 'darwin'
-        ? keychainServiceExists(claudeKeychainService(home))
+        ? keychainServiceExists(claudeKeychainService(home)) ||
+            fs.existsSync(path.join(home, '.credentials.json'))
         : fs.existsSync(path.join(home, '.credentials.json'));
     return hasCredentials && readClaudeProfileIdentity(home) !== null;
 }

package/dist/codexAuth.d.ts

@@ -0,0 +1,32 @@
+export interface CodexAuthJsonFile {
+    auth_mode?: string;
+    OPENAI_API_KEY?: string;
+    last_refresh?: string;
+    tokens?: {
+        id_token?: string;
+        access_token?: string;
+        refresh_token?: string;
+        account_id?: string;
+    };
+}
+export interface CodexAuthIdentity {
+    email?: string;
+    workspaceId?: string;
+    planType?: string;
+    authMode: 'chatgpt' | 'api-key';
+}
+export declare const STALE_AUTH_THRESHOLD_MS: number;
+export declare function parseJwtPayload<T>(jwt: string): T | null;
+export declare function parseAuthJson(raw: string | null): CodexAuthJsonFile | null;
+export declare function readAuthIdentityFromRaw(raw: string | null): CodexAuthIdentity | null;
+export declare function readLastRefresh(raw: string | null, fallbackPath?: string): number | null;
+/** Expiry (ms since epoch) of the access token JWT, when it carries `exp`. */
+export declare function readAccessTokenExpiry(raw: string | null): number | null;
+/** Workspace id first (a ChatGPT workspace is one seat), then email. */
+export declare function identitiesMatch(a: {
+    email?: string;
+    workspaceId?: string;
+} | null | undefined, b: {
+    email?: string;
+    workspaceId?: string;
+} | null | undefined): boolean;

package/dist/codexAuth.js

@@ -0,0 +1,127 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STALE_AUTH_THRESHOLD_MS = void 0;
+exports.parseJwtPayload = parseJwtPayload;
+exports.parseAuthJson = parseAuthJson;
+exports.readAuthIdentityFromRaw = readAuthIdentityFromRaw;
+exports.readLastRefresh = readLastRefresh;
+exports.readAccessTokenExpiry = readAccessTokenExpiry;
+exports.identitiesMatch = identitiesMatch;
+/**
+ * Pure helpers over the Codex CLI `auth.json` payload. No filesystem access
+ * beyond an optional mtime fallback, no child processes.
+ */
+const fs = __importStar(require("fs"));
+// Codex refreshes OAuth tokens at most every 8 days; a stored refresh token
+// older than that may already be rejected by the auth server.
+exports.STALE_AUTH_THRESHOLD_MS = 8 * 24 * 60 * 60 * 1000;
+function parseJwtPayload(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length < 2)
+        return null;
+    try {
+        const payload = Buffer.from(parts[1], 'base64url').toString('utf8');
+        return JSON.parse(payload);
+    }
+    catch {
+        return null;
+    }
+}
+function parseAuthJson(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readAuthIdentityFromRaw(raw) {
+    const parsed = parseAuthJson(raw);
+    if (!parsed)
+        return null;
+    const idToken = parsed.tokens?.id_token;
+    const claims = idToken ? parseJwtPayload(idToken) : null;
+    const profileClaims = claims?.['https://api.openai.com/profile'];
+    const authClaims = claims?.['https://api.openai.com/auth'];
+    const email = typeof claims?.email === 'string'
+        ? claims.email
+        : typeof profileClaims?.email === 'string'
+            ? profileClaims.email
+            : undefined;
+    const workspaceId = typeof authClaims?.chatgpt_account_id === 'string'
+        ? authClaims.chatgpt_account_id
+        : parsed.tokens?.account_id;
+    const planType = typeof authClaims?.chatgpt_plan_type === 'string' ? authClaims.chatgpt_plan_type : undefined;
+    const authMode = parsed.OPENAI_API_KEY || parsed.auth_mode === 'api_key' ? 'api-key' : 'chatgpt';
+    return { email, workspaceId, planType, authMode };
+}
+function readLastRefresh(raw, fallbackPath) {
+    const parsed = parseAuthJson(raw);
+    if (parsed?.last_refresh) {
+        const ts = Date.parse(parsed.last_refresh);
+        if (!Number.isNaN(ts))
+            return ts;
+    }
+    if (fallbackPath) {
+        try {
+            return fs.statSync(fallbackPath).mtimeMs;
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    return null;
+}
+/** Expiry (ms since epoch) of the access token JWT, when it carries `exp`. */
+function readAccessTokenExpiry(raw) {
+    const parsed = parseAuthJson(raw);
+    const accessToken = parsed?.tokens?.access_token;
+    if (!accessToken)
+        return null;
+    const claims = parseJwtPayload(accessToken);
+    return typeof claims?.exp === 'number' && Number.isFinite(claims.exp) ? claims.exp * 1000 : null;
+}
+/** Workspace id first (a ChatGPT workspace is one seat), then email. */
+function identitiesMatch(a, b) {
+    if (!a || !b)
+        return false;
+    if (a.workspaceId && b.workspaceId)
+        return a.workspaceId === b.workspaceId;
+    return Boolean(a.email && b.email && a.email === b.email);
+}

package/dist/codexPaths.d.ts

@@ -0,0 +1,21 @@
+export declare function getDefaultSystemCodexHome(): string;
+export declare function getExplicitCodexHome(): string | null;
+/** The home the `codex` CLI reads for this process: `CODEX_HOME` or `~/.codex`. */
+export declare function getSystemCodexHome(): string;
+export declare function getCodexProfilesDir(): string;
+export declare function getCodexProfileDir(profileId: string): string;
+export declare function getCodexProfileHome(profileId: string): string;
+export declare function getCodexProfileStatePath(profileId: string): string;
+export declare function ensureCodexProfileDirs(profileId: string): void;
+export declare function readFileOrNull(filePath: string): string | null;
+export type CodexCredentialStoreMode = 'file' | 'keyring' | 'auto' | 'ephemeral' | 'unknown';
+/**
+ * How the `codex` CLI persists credentials for a home, from its `config.toml`.
+ * `unknown` means the key is absent (older CLIs: file; newer CLIs: auto).
+ */
+export declare function getCodexCredentialStoreMode(codexHome?: string): CodexCredentialStoreMode;
+/**
+ * Rewrite a `config.toml` so an isolated login writes `auth.json` instead of a
+ * keyring entry sidekick could never swap. Adds the key when absent.
+ */
+export declare function forceFileCredentialStore(configToml: string): string;

package/dist/codexPaths.js

@@ -0,0 +1,117 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultSystemCodexHome = getDefaultSystemCodexHome;
+exports.getExplicitCodexHome = getExplicitCodexHome;
+exports.getSystemCodexHome = getSystemCodexHome;
+exports.getCodexProfilesDir = getCodexProfilesDir;
+exports.getCodexProfileDir = getCodexProfileDir;
+exports.getCodexProfileHome = getCodexProfileHome;
+exports.getCodexProfileStatePath = getCodexProfileStatePath;
+exports.ensureCodexProfileDirs = ensureCodexProfileDirs;
+exports.readFileOrNull = readFileOrNull;
+exports.getCodexCredentialStoreMode = getCodexCredentialStoreMode;
+exports.forceFileCredentialStore = forceFileCredentialStore;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const accountRegistry_1 = require("./accountRegistry");
+function getDefaultSystemCodexHome() {
+    return path.join(os.homedir(), '.codex');
+}
+function getExplicitCodexHome() {
+    const explicitHome = process.env.CODEX_HOME?.trim();
+    return explicitHome ? explicitHome : null;
+}
+/** The home the `codex` CLI reads for this process: `CODEX_HOME` or `~/.codex`. */
+function getSystemCodexHome() {
+    return getExplicitCodexHome() ?? getDefaultSystemCodexHome();
+}
+function getCodexProfilesDir() {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'profiles');
+}
+function getCodexProfileDir(profileId) {
+    return path.join(getCodexProfilesDir(), profileId);
+}
+function getCodexProfileHome(profileId) {
+    return path.join(getCodexProfileDir(profileId), 'codex-home');
+}
+function getCodexProfileStatePath(profileId) {
+    return path.join(getCodexProfileDir(profileId), 'profile.json');
+}
+function ensureCodexProfileDirs(profileId) {
+    fs.mkdirSync(getCodexProfileHome(profileId), { recursive: true, mode: 0o700 });
+}
+function readFileOrNull(filePath) {
+    try {
+        return fs.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+const STORE_MODE_PATTERN = /^\s*cli_auth_credentials_store\s*=\s*"([a-z]+)"/m;
+/**
+ * How the `codex` CLI persists credentials for a home, from its `config.toml`.
+ * `unknown` means the key is absent (older CLIs: file; newer CLIs: auto).
+ */
+function getCodexCredentialStoreMode(codexHome = getSystemCodexHome()) {
+    const config = readFileOrNull(path.join(codexHome, 'config.toml'));
+    const match = config?.match(STORE_MODE_PATTERN);
+    const value = match?.[1];
+    return value === 'file' || value === 'keyring' || value === 'auto' || value === 'ephemeral'
+        ? value
+        : 'unknown';
+}
+/**
+ * Rewrite a `config.toml` so an isolated login writes `auth.json` instead of a
+ * keyring entry sidekick could never swap. Adds the key when absent.
+ */
+function forceFileCredentialStore(configToml) {
+    if (STORE_MODE_PATTERN.test(configToml)) {
+        return configToml.replace(STORE_MODE_PATTERN, 'cli_auth_credentials_store = "file"');
+    }
+    const line = 'cli_auth_credentials_store = "file"';
+    const trimmed = configToml.replace(/\s*$/, '');
+    if (!trimmed)
+        return `${line}\n`;
+    // A key after a `[table]` header belongs to that table: keep this one at the
+    // top level by inserting it before the first table header.
+    const firstTable = trimmed.search(/^\s*\[/m);
+    if (firstTable === -1)
+        return `${trimmed}\n${line}\n`;
+    const head = trimmed.slice(0, firstTable).replace(/\s*$/, '');
+    return `${head ? `${head}\n` : ''}${line}\n\n${trimmed.slice(firstTable).replace(/^\s*/, '')}\n`;
+}