sidekick-shared 0.26.5 → 0.26.6

package/dist/codexProfiles.js

@@ -33,10 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSystemCodexHome = getSystemCodexHome;
+exports.CODEX_KEYRING_FIX_HINT = exports.getCodexCredentialStoreMode = exports.getSystemCodexHome = exports.getCodexProfileHome = exports.getCodexProfilesDir = void 0;
 exports.getCodexMonitoringHomes = getCodexMonitoringHomes;
-exports.getCodexProfilesDir = getCodexProfilesDir;
-exports.getCodexProfileHome = getCodexProfileHome;
+exports.storeCodexProfileAuth = storeCodexProfileAuth;
+exports.parseCodexLoginStatusOutput = parseCodexLoginStatusOutput;
+exports.getCodexLoginStatus = getCodexLoginStatus;
+exports.getCodexLoginStatusAsync = getCodexLoginStatusAsync;
 exports.readCodexAccountMetadata = readCodexAccountMetadata;
 exports.readCodexAccountMetadataAsync = readCodexAccountMetadataAsync;
 exports.isCodexProfileAuthenticated = isCodexProfileAuthenticated;
@@ -50,13 +52,17 @@ exports.prepareCodexAccount = prepareCodexAccount;
 exports.prepareCodexAccountAsync = prepareCodexAccountAsync;
 exports.finalizeCodexAccount = finalizeCodexAccount;
 exports.finalizeCodexAccountAsync = finalizeCodexAccountAsync;
+exports.withCodexAuthSwapLock = withCodexAuthSwapLock;
+exports.dedupeCodexProfiles = dedupeCodexProfiles;
+exports.syncCodexLiveStateUnlocked = syncCodexLiveStateUnlocked;
+exports.syncCodexLiveState = syncCodexLiveState;
+exports.cleanupAbandonedCodexLogins = cleanupAbandonedCodexLogins;
 exports.switchToCodexAccount = switchToCodexAccount;
 exports.switchToCodexAccountAsync = switchToCodexAccountAsync;
 exports.reconcileCodexAuthState = reconcileCodexAuthState;
 exports.reconcileCodexAuthStateAsync = reconcileCodexAuthStateAsync;
 exports.removeCodexAccount = removeCodexAccount;
 const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
@@ -65,16 +71,19 @@ const accountRegistry_1 = require("./accountRegistry");
 // re-serializing would drop fields added by newer codex versions, and the
 // rotated refresh token inside is only valid in its freshest form.
 const atomic_1 = require("./writers/atomic");
-// Codex refreshes OAuth tokens at most every 8 days; a stored refresh token
-// older than that may already be rejected by the auth server.
-const STALE_AUTH_THRESHOLD_MS = 8 * 24 * 60 * 60 * 1000;
-function getDefaultSystemCodexHome() {
-    return path.join(os.homedir(), '.codex');
-}
-function getExplicitCodexHome() {
-    const explicitHome = process.env.CODEX_HOME?.trim();
-    return explicitHome ? explicitHome : null;
-}
+const codexAuth_1 = require("./codexAuth");
+const codexPaths_1 = require("./codexPaths");
+const accountHealth_1 = require("./accountHealth");
+const accountSwitch_1 = require("./accountSwitch");
+const accountSyncTypes_1 = require("./accountSyncTypes");
+const processDetection_1 = require("./processDetection");
+const quotaSnapshots_1 = require("./quotaSnapshots");
+var codexPaths_2 = require("./codexPaths");
+Object.defineProperty(exports, "getCodexProfilesDir", { enumerable: true, get: function () { return codexPaths_2.getCodexProfilesDir; } });
+Object.defineProperty(exports, "getCodexProfileHome", { enumerable: true, get: function () { return codexPaths_2.getCodexProfileHome; } });
+Object.defineProperty(exports, "getSystemCodexHome", { enumerable: true, get: function () { return codexPaths_2.getSystemCodexHome; } });
+Object.defineProperty(exports, "getCodexCredentialStoreMode", { enumerable: true, get: function () { return codexPaths_2.getCodexCredentialStoreMode; } });
+exports.CODEX_KEYRING_FIX_HINT = 'Set `cli_auth_credentials_store = "file"` in ~/.codex/config.toml and run `codex login` again.';
 function dedupePaths(paths) {
     const seen = new Set();
     const unique = [];
@@ -87,58 +96,32 @@ function dedupePaths(paths) {
     }
     return unique;
 }
-function getSystemCodexHome() {
-    return getExplicitCodexHome() ?? getDefaultSystemCodexHome();
-}
 function getCodexMonitoringHomes() {
-    const explicitHome = getExplicitCodexHome();
+    const explicitHome = (0, codexPaths_1.getExplicitCodexHome)();
     if (explicitHome)
         return [explicitHome];
     // The system home is the single live home; profile homes only matter for
     // sessions recorded back when they doubled as live CODEX_HOMEs.
-    const homes = [getDefaultSystemCodexHome()];
+    const homes = [(0, codexPaths_1.getDefaultSystemCodexHome)()];
     for (const profile of listCodexAccounts()) {
-        const profileHome = getCodexProfileHome(profile.id);
+        const profileHome = (0, codexPaths_1.getCodexProfileHome)(profile.id);
         if (fs.existsSync(path.join(profileHome, 'sessions'))) {
             homes.push(profileHome);
         }
     }
     return dedupePaths(homes);
 }
-function getCodexProfilesDir() {
-    return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'profiles');
-}
-function getCodexProfileDir(profileId) {
-    return path.join(getCodexProfilesDir(), profileId);
-}
-function getCodexProfileHome(profileId) {
-    return path.join(getCodexProfileDir(profileId), 'codex-home');
-}
-function getCodexProfileStatePath(profileId) {
-    return path.join(getCodexProfileDir(profileId), 'profile.json');
-}
-function ensureCodexProfileDirs(profileId) {
-    fs.mkdirSync(getCodexProfileHome(profileId), { recursive: true, mode: 0o700 });
-}
-function readFileOrNull(filePath) {
-    try {
-        return fs.readFileSync(filePath, 'utf8');
-    }
-    catch {
-        return null;
-    }
-}
 function readPendingProfile(profileId) {
     try {
-        return JSON.parse(fs.readFileSync(getCodexProfileStatePath(profileId), 'utf8'));
+        return JSON.parse(fs.readFileSync((0, codexPaths_1.getCodexProfileStatePath)(profileId), 'utf8'));
     }
     catch {
         return null;
     }
 }
 function writePendingProfile(profileId, pending) {
-    ensureCodexProfileDirs(profileId);
-    (0, atomic_1.atomicWriteJsonSync)(getCodexProfileStatePath(profileId), pending);
+    (0, codexPaths_1.ensureCodexProfileDirs)(profileId);
+    (0, atomic_1.atomicWriteJsonSync)((0, codexPaths_1.getCodexProfileStatePath)(profileId), pending);
 }
 function copyIfExists(source, destination) {
     if (!fs.existsSync(source))
@@ -147,75 +130,36 @@ function copyIfExists(source, destination) {
     fs.copyFileSync(source, destination);
     return true;
 }
+/**
+ * Copy the live `config.toml` into a profile home, forcing file-based
+ * credential storage so an isolated `codex login` writes `auth.json` (a
+ * keyring entry keyed to the profile home could never be swapped).
+ */
 function copySourceCodexConfig(sourceHome, targetHome) {
-    copyIfExists(path.join(sourceHome, 'config.toml'), path.join(targetHome, 'config.toml'));
+    const source = (0, codexPaths_1.readFileOrNull)(path.join(sourceHome, 'config.toml')) ?? '';
+    (0, atomic_1.atomicWriteFileSync)(path.join(targetHome, 'config.toml'), (0, codexPaths_1.forceFileCredentialStore)(source));
 }
 function importCurrentCodexAuth(sourceHome, targetHome) {
     const authCopied = copyIfExists(path.join(sourceHome, 'auth.json'), path.join(targetHome, 'auth.json'));
     const legacyCredsCopied = copyIfExists(path.join(sourceHome, '.credentials.json'), path.join(targetHome, '.credentials.json'));
     return authCopied || legacyCredsCopied;
 }
-function parseJwtPayload(jwt) {
-    const parts = jwt.split('.');
-    if (parts.length < 2)
-        return null;
-    try {
-        const payload = Buffer.from(parts[1], 'base64url').toString('utf8');
-        return JSON.parse(payload);
-    }
-    catch {
-        return null;
-    }
-}
-function parseAuthJson(raw) {
-    if (!raw)
-        return null;
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-function readAuthIdentityFromRaw(raw) {
-    const parsed = parseAuthJson(raw);
-    if (!parsed)
-        return null;
-    const idToken = parsed.tokens?.id_token;
-    const claims = idToken ? parseJwtPayload(idToken) : null;
-    const profileClaims = claims?.['https://api.openai.com/profile'];
-    const authClaims = claims?.['https://api.openai.com/auth'];
-    const email = typeof claims?.email === 'string'
-        ? claims.email
-        : typeof profileClaims?.email === 'string'
-            ? profileClaims.email
-            : undefined;
-    const workspaceId = typeof authClaims?.chatgpt_account_id === 'string'
-        ? authClaims.chatgpt_account_id
-        : parsed.tokens?.account_id;
-    const planType = typeof authClaims?.chatgpt_plan_type === 'string' ? authClaims.chatgpt_plan_type : undefined;
-    const authMode = parsed.OPENAI_API_KEY || parsed.auth_mode === 'api_key' ? 'api-key' : 'chatgpt';
-    return { email, workspaceId, planType, authMode };
-}
-function readLastRefresh(raw, fallbackPath) {
-    const parsed = parseAuthJson(raw);
-    if (parsed?.last_refresh) {
-        const ts = Date.parse(parsed.last_refresh);
-        if (!Number.isNaN(ts))
-            return ts;
-    }
-    if (fallbackPath) {
-        try {
-            return fs.statSync(fallbackPath).mtimeMs;
-        }
-        catch {
-            /* fall through */
-        }
-    }
-    return null;
+/**
+ * The single chokepoint for storing a Codex credential in a profile: the raw
+ * `auth.json` bytes (never re-serialized), the legacy `.credentials.json`
+ * when present, and the secret-free health sidecar.
+ */
+function storeCodexProfileAuth(profileId, authRaw, legacyRaw, source) {
+    const profileHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
+    if (authRaw)
+        (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, 'auth.json'), authRaw);
+    if (legacyRaw)
+        (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, '.credentials.json'), legacyRaw);
+    if (authRaw)
+        (0, accountHealth_1.writeCodexHealthSidecar)(profileId, authRaw, source);
 }
 function readMetadataFromAuthJson(codexHome) {
-    const identity = readAuthIdentityFromRaw(readFileOrNull(path.join(codexHome, 'auth.json')));
+    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)((0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')));
     if (!identity)
         return {};
     return {
@@ -289,33 +233,6 @@ function getCodexLoginStatusAsync(codexHome) {
         }
     });
 }
-/** Sync sibling of {@link detectRunningCodexProcessAsync}; see the event-loop caveat above. */
-function detectRunningCodexProcess() {
-    if (process.platform === 'win32')
-        return false;
-    try {
-        return ((0, child_process_1.spawnSync)('pgrep', ['-x', 'codex'], {
-            encoding: 'utf8',
-            timeout: PROBE_TIMEOUT_MS,
-            killSignal: 'SIGKILL',
-        }).status === 0);
-    }
-    catch {
-        return false;
-    }
-}
-function detectRunningCodexProcessAsync() {
-    if (process.platform === 'win32')
-        return Promise.resolve(false);
-    return new Promise((resolve) => {
-        try {
-            (0, child_process_1.execFile)('pgrep', ['-x', 'codex'], { encoding: 'utf8', timeout: PROBE_TIMEOUT_MS, killSignal: 'SIGKILL' }, (error) => resolve(!error));
-        }
-        catch {
-            resolve(false);
-        }
-    });
-}
 /** File-based metadata only — never spawns the codex CLI. */
 function readCodexAccountMetadataFromFiles(codexHome) {
     const fromAuth = readMetadataFromAuthJson(codexHome);
@@ -365,7 +282,13 @@ function getActiveCodexAccount() {
 function resolveSidekickCodexHome() {
     // Account switching swaps auth.json inside the system home, so the system
     // home (or an explicit CODEX_HOME) is always the single live home.
-    return getSystemCodexHome();
+    return (0, codexPaths_1.getSystemCodexHome)();
+}
+function profileIdentity(profile) {
+    return {
+        email: profile.email ?? profile.metadata?.email,
+        workspaceId: profile.metadata?.workspaceId,
+    };
 }
 /**
  * Resolves the *currently logged-in* Codex account for display, preferring the
@@ -382,7 +305,7 @@ function resolveSidekickCodexHome() {
  */
 function resolveActiveCodexAccount(options = {}) {
     const selfHeal = options.selfHeal ?? true;
-    const identity = readAuthIdentityFromRaw(readFileOrNull(path.join(resolveSidekickCodexHome(), 'auth.json')));
+    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)((0, codexPaths_1.readFileOrNull)(path.join(resolveSidekickCodexHome(), 'auth.json')));
     if (identity && (identity.email || identity.workspaceId)) {
         const match = findProfileForIdentity(identity);
         if (match) {
@@ -393,7 +316,7 @@ function resolveActiveCodexAccount(options = {}) {
                 // disk) must never break display, extension activation, or the quota
                 // watcher's hot path. We still return the correct live identity below.
                 try {
-                    (0, accountRegistry_1.setActiveSavedAccount)('codex', match.id);
+                    (0, accountRegistry_1.setActiveSavedAccount)('codex', match.id, { silent: true });
                 }
                 catch {
                     /* keep going with the live identity */
@@ -427,6 +350,13 @@ function getCodexExecutionEnv(baseEnv = process.env) {
         CODEX_HOME: resolveSidekickCodexHome(),
     };
 }
+function keyringRefusal(mode) {
+    return {
+        success: false,
+        needsLogin: false,
+        error: `Codex stores credentials in the OS keyring (cli_auth_credentials_store = "${mode}"); sidekick can only switch file-based logins. ${exports.CODEX_KEYRING_FIX_HINT}`,
+    };
+}
 function prepareCodexAccountCore(label) {
     const trimmedLabel = label.trim();
     if (!trimmedLabel) {
@@ -436,17 +366,60 @@ function prepareCodexAccountCore(label) {
     if (labelError) {
         return { result: { success: false, error: labelError } };
     }
+    const sourceHome = (0, codexPaths_1.getSystemCodexHome)();
+    const storeMode = (0, codexPaths_1.getCodexCredentialStoreMode)(sourceHome);
+    const liveAuthPresent = hasCodexCredentialFiles(sourceHome);
+    if (storeMode === 'keyring' || (storeMode === 'auto' && !liveAuthPresent)) {
+        return { result: keyringRefusal(storeMode) };
+    }
     const profileId = (0, crypto_1.randomUUID)();
-    const codexHome = getCodexProfileHome(profileId);
-    ensureCodexProfileDirs(profileId);
+    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
+    (0, codexPaths_1.ensureCodexProfileDirs)(profileId);
     writePendingProfile(profileId, {
         label: trimmedLabel,
         addedAt: new Date().toISOString(),
     });
-    const sourceHome = getSystemCodexHome();
     copySourceCodexConfig(sourceHome, codexHome);
     const imported = importCurrentCodexAuth(sourceHome, codexHome);
     if (imported) {
+        // The live login may already be saved under another profile: fold into it
+        // instead of creating a duplicate seat.
+        const identity = (0, codexAuth_1.readAuthIdentityFromRaw)((0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')));
+        const existing = identity
+            ? findProfileForIdentity(identity, { fallbackToActive: false })
+            : null;
+        if (existing) {
+            try {
+                const liveRefresh = (0, codexAuth_1.readLastRefresh)((0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')));
+                const storedRefresh = (0, codexAuth_1.readLastRefresh)((0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getCodexProfileHome)(existing.id), 'auth.json')));
+                const storedIsNewer = storedRefresh !== null && liveRefresh !== null && storedRefresh > liveRefresh;
+                if (!storedIsNewer) {
+                    storeCodexProfileAuth(existing.id, (0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')), (0, codexPaths_1.readFileOrNull)(path.join(codexHome, '.credentials.json')), 'login');
+                }
+            }
+            catch {
+                /* the existing backup stays as it was */
+            }
+            fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
+            const relabel = existing.metadata?.origin === 'live-sync' && existing.label === existing.email
+                ? {
+                    ...existing,
+                    label: trimmedLabel,
+                    metadata: { ...existing.metadata, origin: 'manual' },
+                }
+                : existing;
+            if (relabel !== existing)
+                (0, accountRegistry_1.upsertSavedAccountProfile)(relabel);
+            return {
+                result: {
+                    success: true,
+                    profileId: existing.id,
+                    codexHome: (0, codexPaths_1.getCodexProfileHome)(existing.id),
+                    needsLogin: false,
+                    warning: `This Codex login is already saved as "${relabel.label ?? existing.email ?? existing.id}".`,
+                },
+            };
+        }
         return { finalize: { profileId, codexHome } };
     }
     return { result: { success: true, profileId, codexHome, needsLogin: true } };
@@ -471,23 +444,59 @@ async function prepareCodexAccountAsync(label) {
 function finalizeCodexAccountCore(profileId, opts, probes) {
     const pending = readPendingProfile(profileId);
     if (!pending) {
-        return { result: { success: false, error: `Codex profile ${profileId} was not prepared.` } };
+        // Already finalized: `prepareCodexAccount` folds a live login that is
+        // already saved into its profile and reports `needsLogin: false`, and the
+        // login flow then finalizes that profile id. Activate it if asked.
+        const saved = listCodexAccounts().find((profile) => profile.id === profileId);
+        if (!saved) {
+            return { result: { success: false, error: `Codex profile ${profileId} was not prepared.` } };
+        }
+        if (opts.activate === false)
+            return { result: { success: true, profileId } };
+        return { swap: saved };
     }
-    const codexHome = getCodexProfileHome(profileId);
+    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
     if (!probes.authenticated) {
         return { result: { success: false, error: 'Codex profile is not authenticated yet.' } };
     }
+    // A fresh isolated login for an account that is already saved: fold into the
+    // existing profile rather than registering a second seat.
+    const authRaw = (0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json'));
+    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(authRaw);
+    const existing = identity ? findProfileForIdentity(identity, { fallbackToActive: false }) : null;
+    if (existing && existing.id !== profileId) {
+        storeCodexProfileAuth(existing.id, authRaw, (0, codexPaths_1.readFileOrNull)(path.join(codexHome, '.credentials.json')), 'login');
+        fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
+        const merged = {
+            ...existing,
+            label: existing.metadata?.origin === 'live-sync' ? pending.label : existing.label,
+            email: probes.metadata.email ?? existing.email,
+            metadata: { ...existing.metadata, ...probes.metadata, origin: 'login' },
+        };
+        (0, accountRegistry_1.upsertSavedAccountProfile)(merged);
+        if (opts.activate === false)
+            return { result: { success: true, profileId: existing.id } };
+        return { swap: merged };
+    }
     const profile = {
         id: profileId,
         providerId: 'codex',
         label: pending.label,
         email: probes.metadata.email,
         addedAt: pending.addedAt,
-        metadata: probes.metadata,
+        metadata: { ...probes.metadata, origin: 'login' },
     };
     (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
+    if (authRaw)
+        (0, accountHealth_1.writeCodexHealthSidecar)(profileId, authRaw, 'login');
+    try {
+        fs.rmSync((0, codexPaths_1.getCodexProfileStatePath)(profileId), { force: true });
+    }
+    catch {
+        /* the pending marker is advisory */
+    }
     if (opts.activate === false) {
-        return { result: { success: true } };
+        return { result: { success: true, profileId } };
     }
     if (!hasCodexCredentialFiles(codexHome)) {
         // Authenticated via the OS keyring — there are no credential files to
@@ -496,7 +505,8 @@ function finalizeCodexAccountCore(profileId, opts, probes) {
         return {
             result: {
                 success: true,
-                warning: 'Codex stores credentials in the OS keyring; sidekick cannot swap them per account, so `codex` keeps using the keyring credentials.',
+                profileId,
+                warning: `Codex stores credentials in the OS keyring; sidekick cannot swap them per account, so \`codex\` keeps using the keyring credentials. ${exports.CODEX_KEYRING_FIX_HINT}`,
             },
         };
     }
@@ -504,29 +514,34 @@ function finalizeCodexAccountCore(profileId, opts, probes) {
 }
 function finalizeCodexAccount(profileId, opts = {}) {
     if (!readPendingProfile(profileId)) {
-        return { success: false, error: `Codex profile ${profileId} was not prepared.` };
+        // Already finalized: the core activates a saved profile without probing.
+        const step = finalizeCodexAccountCore(profileId, opts, { authenticated: false, metadata: {} });
+        return 'swap' in step ? performCodexAuthSwap(step.swap, {}) : step.result;
     }
-    const codexHome = getCodexProfileHome(profileId);
+    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
     const authenticated = isCodexProfileAuthenticated(codexHome);
     const step = finalizeCodexAccountCore(profileId, opts, {
         authenticated,
         metadata: authenticated ? readCodexAccountMetadata(codexHome) : {},
     });
-    return 'swap' in step ? performCodexAuthSwap(step.swap) : step.result;
+    return 'swap' in step ? performCodexAuthSwap(step.swap, {}) : step.result;
 }
 /** {@link finalizeCodexAccount} without blocking the event loop on CLI probes. */
 async function finalizeCodexAccountAsync(profileId, opts = {}) {
     if (!readPendingProfile(profileId)) {
-        return { success: false, error: `Codex profile ${profileId} was not prepared.` };
+        // Already finalized: the core activates a saved profile without probing.
+        const step = finalizeCodexAccountCore(profileId, opts, { authenticated: false, metadata: {} });
+        return 'swap' in step ? performCodexAuthSwapAsync(step.swap, {}) : step.result;
     }
-    const codexHome = getCodexProfileHome(profileId);
+    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
     const authenticated = await isCodexProfileAuthenticatedAsync(codexHome);
     const step = finalizeCodexAccountCore(profileId, opts, {
         authenticated,
         metadata: authenticated ? await readCodexAccountMetadataAsync(codexHome) : {},
     });
-    return 'swap' in step ? performCodexAuthSwapAsync(step.swap) : step.result;
+    return 'swap' in step ? performCodexAuthSwapAsync(step.swap, {}) : step.result;
 }
+// ── Stash / identity matching ────────────────────────────────────────────
 function getCodexStashDir() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'stash');
 }
@@ -549,7 +564,7 @@ function stashLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
         return null;
     }
 }
-function findProfileForIdentity(identity) {
+function findProfileForIdentity(identity, options = {}) {
     const profiles = listCodexAccounts();
     if (identity?.workspaceId) {
         const byWorkspace = profiles.find((profile) => profile.metadata?.workspaceId === identity.workspaceId);
@@ -561,67 +576,238 @@ function findProfileForIdentity(identity) {
         if (byEmail)
             return byEmail;
     }
-    if (!identity?.workspaceId && !identity?.email) {
+    if (!identity?.workspaceId && !identity?.email && options.fallbackToActive !== false) {
         // API-key auth or unparseable tokens carry no identity; assume the live
         // file belongs to whichever account the registry says is active.
         return getActiveCodexAccount();
     }
     return null;
 }
-// Codex rotates the refresh token whenever it refreshes auth.json, so the
-// live file is always the freshest copy of its account. Before replacing it,
-// preserve it in the matching profile's backup — or stash it if it belongs to
-// no saved account. Best-effort: never throws.
-function syncBackLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
-    if (!liveAuthRaw && !liveLegacyRaw)
-        return {};
+// ── Live-state sync ──────────────────────────────────────────────────────
+/**
+ * Serializes live-auth mutations across processes. Codex rotates refresh
+ * tokens, so two interleaved swaps stashing and restoring auth.json can
+ * resurrect a stale token and permanently invalidate the login. Lock ordering:
+ * this lock is taken first and the registry lock (inside setActiveSavedAccount
+ * / upsertSavedAccountProfile) inside it — never the reverse. Never spawn a
+ * child process while holding it.
+ */
+function withCodexAuthSwapLock(operation) {
+    const lockDir = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex');
+    fs.mkdirSync(lockDir, { recursive: true, mode: 0o700 });
+    return (0, atomic_1.withFileLockSync)(path.join(lockDir, 'auth-swap.lock'), operation);
+}
+/**
+ * Merge duplicate Codex profiles (same workspace, else same email). The oldest
+ * profile keeps its id and label, receives the freshest `auth.json` and the
+ * quota snapshot, and the active pointer; losers are stashed, never deleted.
+ * Returns the removed ids. Caller holds the swap lock.
+ */
+function dedupeCodexProfiles() {
+    const removed = [];
+    const profiles = listCodexAccounts();
+    const groups = new Map();
+    for (const profile of profiles) {
+        const key = profile.metadata?.workspaceId
+            ? `ws:${profile.metadata.workspaceId}`
+            : (profile.email ?? profile.metadata?.email)
+                ? `email:${profile.email ?? profile.metadata?.email}`
+                : `id:${profile.id}`;
+        groups.set(key, [...(groups.get(key) ?? []), profile]);
+    }
+    for (const group of groups.values()) {
+        if (group.length < 2)
+            continue;
+        const sorted = [...group].sort((a, b) => Date.parse(a.addedAt) - Date.parse(b.addedAt));
+        const keeper = sorted[0];
+        const keeperAuthPath = path.join((0, codexPaths_1.getCodexProfileHome)(keeper.id), 'auth.json');
+        let freshestRaw = (0, codexPaths_1.readFileOrNull)(keeperAuthPath);
+        let freshestAt = (0, codexAuth_1.readLastRefresh)(freshestRaw, keeperAuthPath) ?? -1;
+        const activeId = (0, accountRegistry_1.getActiveSavedAccount)('codex')?.id;
+        for (const loser of sorted.slice(1)) {
+            const loserAuthPath = path.join((0, codexPaths_1.getCodexProfileHome)(loser.id), 'auth.json');
+            const loserRaw = (0, codexPaths_1.readFileOrNull)(loserAuthPath);
+            const loserAt = (0, codexAuth_1.readLastRefresh)(loserRaw, loserAuthPath) ?? -1;
+            if (loserRaw && loserAt > freshestAt) {
+                freshestRaw = loserRaw;
+                freshestAt = loserAt;
+            }
+            try {
+                if (!(0, quotaSnapshots_1.readQuotaSnapshot)('codex', keeper.id)) {
+                    const snapshot = (0, quotaSnapshots_1.readQuotaSnapshot)('codex', loser.id);
+                    if (snapshot)
+                        (0, quotaSnapshots_1.writeQuotaSnapshot)('codex', keeper.id, snapshot);
+                }
+            }
+            catch {
+                /* quota re-key is best-effort */
+            }
+            try {
+                const stashDir = path.join(getCodexStashDir(), `dup-${loser.id}-${new Date().toISOString().replace(/[:.]/g, '-')}`);
+                fs.mkdirSync(path.dirname(stashDir), { recursive: true, mode: 0o700 });
+                fs.renameSync((0, codexPaths_1.getCodexProfileDir)(loser.id), stashDir);
+            }
+            catch {
+                fs.rmSync((0, codexPaths_1.getCodexProfileDir)(loser.id), { recursive: true, force: true });
+            }
+            (0, accountRegistry_1.removeSavedAccountProfile)('codex', loser.id);
+            removed.push(loser.id);
+            if (activeId === loser.id)
+                (0, accountRegistry_1.setActiveSavedAccount)('codex', keeper.id, { silent: true });
+        }
+        if (freshestRaw && freshestRaw !== (0, codexPaths_1.readFileOrNull)(keeperAuthPath)) {
+            storeCodexProfileAuth(keeper.id, freshestRaw, null, 'migration');
+        }
+        const metadata = readCodexAccountMetadataFromFiles((0, codexPaths_1.getCodexProfileHome)(keeper.id)) ?? {};
+        (0, accountRegistry_1.upsertSavedAccountProfile)({
+            ...keeper,
+            email: metadata.email ?? keeper.email,
+            metadata: { ...keeper.metadata, ...metadata },
+        });
+    }
+    return removed;
+}
+/**
+ * Fold the live `auth.json` into the saved profiles: register an unknown login
+ * (label = email), refresh the matching profile's backup when the live file is
+ * newer, and re-point the active pointer at it. Caller holds the swap lock.
+ * Never throws; problems land in `warnings`.
+ */
+function syncCodexLiveStateUnlocked(source = 'live-sync', probes = {}) {
+    const report = (0, accountSyncTypes_1.emptyProviderSyncReport)();
     try {
-        const identity = readAuthIdentityFromRaw(liveAuthRaw);
-        const profile = findProfileForIdentity(identity);
-        if (!profile) {
-            const stashPath = stashLiveCodexAuth(liveAuthRaw, liveLegacyRaw);
-            return {
-                stashPath: stashPath ?? undefined,
-                warning: stashPath
-                    ? `Live Codex credentials did not match any saved account; stashed at ${stashPath}.`
-                    : 'Live Codex credentials did not match any saved account and could not be stashed.',
+        const merged = dedupeCodexProfiles();
+        if (merged.length)
+            report.merged = merged;
+        const systemHome = (0, codexPaths_1.getSystemCodexHome)();
+        const liveAuthPath = path.join(systemHome, 'auth.json');
+        const liveAuthRaw = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
+        const liveLegacyRaw = (0, codexPaths_1.readFileOrNull)(path.join(systemHome, '.credentials.json'));
+        if (!liveAuthRaw && !liveLegacyRaw) {
+            const mode = (0, codexPaths_1.getCodexCredentialStoreMode)(systemHome);
+            if (probes.systemKeyringLoggedIn || mode === 'keyring' || mode === 'auto') {
+                report.skipped = 'keyring';
+                report.warnings.push(`Codex keeps its login in the OS keyring; sidekick cannot switch it. ${exports.CODEX_KEYRING_FIX_HINT}`);
+            }
+            else {
+                report.skipped = 'logged-out';
+            }
+            return report;
+        }
+        const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(liveAuthRaw);
+        let profile = findProfileForIdentity(identity, { fallbackToActive: false });
+        if (!profile && identity && (identity.email || identity.workspaceId)) {
+            const profileId = (0, crypto_1.randomUUID)();
+            profile = {
+                id: profileId,
+                providerId: 'codex',
+                label: identity.email ?? identity.workspaceId,
+                email: identity.email,
+                addedAt: new Date().toISOString(),
+                metadata: {
+                    email: identity.email,
+                    workspaceId: identity.workspaceId,
+                    planType: identity.planType,
+                    authMode: identity.authMode,
+                    origin: 'live-sync',
+                },
             };
+            (0, codexPaths_1.ensureCodexProfileDirs)(profileId);
+            copySourceCodexConfig(systemHome, (0, codexPaths_1.getCodexProfileHome)(profileId));
+            (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
+            report.registered = { id: profileId, email: identity.email };
         }
-        const profileHome = getCodexProfileHome(profile.id);
-        if (liveAuthRaw)
-            (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, 'auth.json'), liveAuthRaw);
-        if (liveLegacyRaw)
-            (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, '.credentials.json'), liveLegacyRaw);
-        try {
-            // File-based metadata only: this runs with auth files just written, and
-            // the CLI-probe fallback must never spawn while the swap lock is held.
-            const metadata = readCodexAccountMetadataFromFiles(profileHome) ?? {};
-            (0, accountRegistry_1.upsertSavedAccountProfile)({
-                ...profile,
-                email: metadata.email ?? profile.email,
-                metadata: { ...profile.metadata, ...metadata },
-            });
+        else if (!profile) {
+            // API-key auth or an unparseable token: fold into the active profile
+            // only when it is itself an api-key login; otherwise stash.
+            const active = getActiveCodexAccount();
+            if (active && active.metadata?.authMode === 'api-key') {
+                profile = active;
+            }
+            else {
+                report.skipped = 'no-identity';
+                return report;
+            }
         }
-        catch {
-            /* metadata refresh is best-effort */
+        // Codex rotates the refresh token in place, so for the same identity the
+        // live file is the freshest copy unless the profile was refreshed on its
+        // own (keep-alive, isolated launch) and both files say when.
+        const profileAuthPath = path.join((0, codexPaths_1.getCodexProfileHome)(profile.id), 'auth.json');
+        const storedRaw = (0, codexPaths_1.readFileOrNull)(profileAuthPath);
+        const storedRefresh = (0, codexAuth_1.readLastRefresh)(storedRaw);
+        const liveRefresh = (0, codexAuth_1.readLastRefresh)(liveAuthRaw);
+        const storedIsNewer = storedRefresh !== null && liveRefresh !== null && storedRefresh > liveRefresh;
+        const newer = liveAuthRaw !== storedRaw && !storedIsNewer;
+        if (newer) {
+            try {
+                storeCodexProfileAuth(profile.id, liveAuthRaw, liveLegacyRaw, source);
+                const metadata = readCodexAccountMetadataFromFiles((0, codexPaths_1.getCodexProfileHome)(profile.id)) ?? {};
+                (0, accountRegistry_1.upsertSavedAccountProfile)({
+                    ...profile,
+                    email: metadata.email ?? profile.email,
+                    metadata: { ...profile.metadata, ...metadata },
+                });
+                report.folded = profile.id;
+            }
+            catch (err) {
+                report.warnings.push(`Could not back up the live Codex credentials: ${err}`);
+            }
+        }
+        const active = (0, accountRegistry_1.getActiveSavedAccount)('codex');
+        if (!active || active.id !== profile.id) {
+            (0, accountRegistry_1.setActiveSavedAccount)('codex', profile.id, { silent: true });
+            report.repointed = profile.id;
         }
-        return { syncedProfileId: profile.id };
     }
     catch (err) {
-        return { warning: `Could not back up live Codex credentials: ${err}` };
+        report.warnings.push(`Codex account sync failed: ${err}`);
+    }
+    return report;
+}
+/** {@link syncCodexLiveStateUnlocked} under the swap lock. */
+function syncCodexLiveState(source = 'live-sync') {
+    try {
+        return withCodexAuthSwapLock(() => syncCodexLiveStateUnlocked(source));
+    }
+    catch (err) {
+        return { warnings: [`Could not acquire the account-switch lock: ${err}`] };
     }
 }
 /**
- * Serializes live-auth mutations across processes. Codex rotates refresh
- * tokens, so two interleaved swaps stashing and restoring auth.json can
- * resurrect a stale token and permanently invalidate the login. Lock ordering:
- * this lock is taken first and the registry lock (inside setActiveSavedAccount
- * / upsertSavedAccountProfile) inside it — never the reverse.
+ * Remove isolated login homes that never authenticated once they are older
+ * than `olderThanMs`. Returns the removed profile ids.
  */
-function withCodexAuthSwapLock(operation) {
-    const lockDir = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex');
-    fs.mkdirSync(lockDir, { recursive: true, mode: 0o700 });
-    return (0, atomic_1.withFileLockSync)(path.join(lockDir, 'auth-swap.lock'), operation);
+function cleanupAbandonedCodexLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Date.now()) {
+    const removed = [];
+    let entries = [];
+    try {
+        entries = fs.readdirSync((0, codexPaths_1.getCodexProfilesDir)());
+    }
+    catch {
+        return removed;
+    }
+    const registered = new Set(listCodexAccounts().map((p) => p.id));
+    for (const profileId of entries) {
+        if (registered.has(profileId))
+            continue;
+        const pending = readPendingProfile(profileId);
+        if (!pending)
+            continue;
+        if (hasCodexCredentialFiles((0, codexPaths_1.getCodexProfileHome)(profileId)))
+            continue;
+        const addedAt = Date.parse(pending.addedAt);
+        const age = Number.isNaN(addedAt) ? Number.POSITIVE_INFINITY : now - addedAt;
+        if (age < olderThanMs)
+            continue;
+        try {
+            fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
+            removed.push(profileId);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+    return removed;
 }
 /**
  * CLI probes are resolved before the auth-swap lock is taken — never spawn a
@@ -630,118 +816,170 @@ function withCodexAuthSwapLock(operation) {
  * absence.
  */
 function resolveCodexSwapProbesSync() {
-    const systemHome = getSystemCodexHome();
+    const systemHome = (0, codexPaths_1.getSystemCodexHome)();
     return {
-        codexRunning: detectRunningCodexProcess(),
+        consumers: (0, processDetection_1.detectRunningAccountConsumersSync)('codex'),
         systemKeyringLoggedIn: hasCodexCredentialFiles(systemHome)
             ? false
             : getCodexLoginStatus(systemHome).loggedIn,
     };
 }
 async function resolveCodexSwapProbesAsync() {
-    const systemHome = getSystemCodexHome();
+    const systemHome = (0, codexPaths_1.getSystemCodexHome)();
     return {
-        codexRunning: await detectRunningCodexProcessAsync(),
+        consumers: await (0, processDetection_1.detectRunningAccountConsumers)('codex'),
         systemKeyringLoggedIn: hasCodexCredentialFiles(systemHome)
             ? false
             : (await getCodexLoginStatusAsync(systemHome)).loggedIn,
     };
 }
-function performCodexAuthSwap(target) {
+function performCodexAuthSwap(target, options) {
     const probes = resolveCodexSwapProbesSync();
     try {
-        return withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, probes));
+        return withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, options, probes));
     }
     catch (err) {
         // Keep the non-throwing result contract when the lock cannot be acquired.
-        return { success: false, error: `Could not acquire the account-switch lock: ${err}` };
+        return (0, accountSwitch_1.switchFailure)('codex', target.id, `Could not acquire the account-switch lock: ${err}`);
     }
 }
-async function performCodexAuthSwapAsync(target) {
+async function performCodexAuthSwapAsync(target, options) {
     const probes = await resolveCodexSwapProbesAsync();
+    let result;
     try {
         // The sync lock is fine here: probes are pre-resolved, so the critical
         // section is only fast local-filesystem work.
-        return withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, probes));
+        result = withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, options, probes));
     }
     catch (err) {
-        return { success: false, error: `Could not acquire the account-switch lock: ${err}` };
+        return (0, accountSwitch_1.switchFailure)('codex', target.id, `Could not acquire the account-switch lock: ${err}`);
+    }
+    if (result.success && options.verifyWithCli && !result.alreadyActive) {
+        const status = await getCodexLoginStatusAsync((0, codexPaths_1.getSystemCodexHome)());
+        result = status.loggedIn
+            ? { ...result, verification: 'cli' }
+            : (0, accountSwitch_1.finishSwitchResult)({
+                ...result,
+                warnings: [
+                    ...result.warnings,
+                    '`codex login status` reports "Not logged in" after the switch; the stored token may have been revoked. Sign in again if codex prompts you.',
+                ],
+            });
     }
+    return result;
 }
-function performCodexAuthSwapCore(target, probes) {
-    const systemHome = getSystemCodexHome();
+function performCodexAuthSwapCore(target, options, probes) {
+    const systemHome = (0, codexPaths_1.getSystemCodexHome)();
     const liveAuthPath = path.join(systemHome, 'auth.json');
     const liveLegacyPath = path.join(systemHome, '.credentials.json');
-    const liveAuthRaw = readFileOrNull(liveAuthPath);
-    const liveLegacyRaw = readFileOrNull(liveLegacyPath);
-    if (!liveAuthRaw && !liveLegacyRaw && probes.systemKeyringLoggedIn) {
-        return {
+    const targetName = target.label ?? target.email ?? target.id;
+    let previousAccountId = (0, accountRegistry_1.getActiveSavedAccount)('codex')?.id ?? null;
+    const base = {
+        success: true,
+        provider: 'codex',
+        accountId: target.id,
+        previousAccountId,
+        verified: false,
+        verification: 'none',
+        warnings: [],
+        hints: [],
+        runningConsumers: probes.consumers,
+        email: target.email ?? target.metadata?.email,
+    };
+    const profilesDir = path.resolve((0, codexPaths_1.getCodexProfilesDir)());
+    const resolvedHome = path.resolve(systemHome);
+    if (resolvedHome === profilesDir || resolvedHome.startsWith(profilesDir + path.sep)) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
             success: false,
-            error: 'Codex stores credentials in the OS keyring; file-based account switching is not supported. Set `cli_auth_credentials_store = "file"` in ~/.codex/config.toml and run `codex login` again.',
-        };
+            error: `CODEX_HOME points at a sidekick profile home (${systemHome}); unset it before switching accounts.`,
+        });
     }
-    const profileHome = getCodexProfileHome(target.id);
+    const liveBefore = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
+    const liveLegacyBefore = (0, codexPaths_1.readFileOrNull)(liveLegacyPath);
+    if (!liveBefore && !liveLegacyBefore && probes.systemKeyringLoggedIn) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            error: `Codex stores credentials in the OS keyring; file-based account switching is not supported. ${exports.CODEX_KEYRING_FIX_HINT}`,
+        });
+    }
+    // Phase 1: fold the live (freshest, rotated) credentials back into their
+    // profile, registering the login if sidekick has never seen it.
+    const sync = syncCodexLiveStateUnlocked('switch', {
+        systemKeyringLoggedIn: probes.systemKeyringLoggedIn,
+    });
+    base.warnings.push(...sync.warnings);
+    // Only now is the "previous" account known: the sync may have re-pointed or
+    // registered the login that was really live, and undo must return to it.
+    previousAccountId = (0, accountRegistry_1.getActiveSavedAccount)('codex')?.id ?? null;
+    base.previousAccountId = previousAccountId;
+    if (sync.skipped === 'no-identity' && liveBefore) {
+        const stashPath = stashLiveCodexAuth(liveBefore, liveLegacyBefore);
+        base.warnings.push(stashPath
+            ? `Live Codex credentials did not match any saved account; stashed at ${stashPath}.`
+            : 'Live Codex credentials did not match any saved account and could not be stashed.');
+    }
+    // Re-read after the sync: the target may have received the live file.
+    const liveAuthRaw = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
+    const liveLegacyRaw = (0, codexPaths_1.readFileOrNull)(liveLegacyPath);
+    const profileHome = (0, codexPaths_1.getCodexProfileHome)(target.id);
     const targetAuthPath = path.join(profileHome, 'auth.json');
-    const targetAuthRaw = readFileOrNull(targetAuthPath);
-    const targetLegacyRaw = readFileOrNull(path.join(profileHome, '.credentials.json'));
-    const targetName = target.label ?? target.email ?? target.id;
+    const targetAuthRaw = (0, codexPaths_1.readFileOrNull)(targetAuthPath);
+    const targetLegacyRaw = (0, codexPaths_1.readFileOrNull)(path.join(profileHome, '.credentials.json'));
     if (!targetAuthRaw && !targetLegacyRaw) {
-        return {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
             success: false,
-            error: `No stored credentials for "${targetName}". Remove and re-add this account.`,
-        };
+            needsLogin: true,
+            error: `No stored credentials for "${targetName}". Sign in again to this account.`,
+        });
     }
-    if (targetAuthRaw && !parseAuthJson(targetAuthRaw)) {
-        return {
+    if (targetAuthRaw && !(0, codexAuth_1.parseAuthJson)(targetAuthRaw)) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
             success: false,
-            error: `Stored credentials for "${targetName}" are corrupted. Remove and re-add this account.`,
-        };
-    }
-    const warnings = [];
-    if (probes.codexRunning) {
-        warnings.push('A codex process appears to be running; restart codex sessions so they pick up the switched account.');
+            needsLogin: true,
+            error: `Stored credentials for "${targetName}" are corrupted. Sign in again to this account.`,
+        });
     }
     // If the live file already belongs to the target account it is the freshest
     // copy (rotated refresh token included) — never replace it with a staler
-    // backup, which would permanently invalidate the login. Just refresh the
-    // backup and the registry pointer.
-    const liveIdentity = readAuthIdentityFromRaw(liveAuthRaw);
-    const targetIdentity = readAuthIdentityFromRaw(targetAuthRaw);
-    const targetWorkspaceId = target.metadata?.workspaceId ?? targetIdentity?.workspaceId;
-    const targetEmail = target.email ?? target.metadata?.email ?? targetIdentity?.email;
-    const liveMatchesTarget = Boolean((liveIdentity?.workspaceId &&
-        targetWorkspaceId &&
-        liveIdentity.workspaceId === targetWorkspaceId) ||
-        (liveIdentity?.email && targetEmail && liveIdentity.email === targetEmail) ||
+    // backup, which would permanently invalidate the login.
+    const liveIdentity = (0, codexAuth_1.readAuthIdentityFromRaw)(liveAuthRaw);
+    const liveMatchesTarget = Boolean((0, codexAuth_1.identitiesMatch)(liveIdentity, {
+        ...profileIdentity(target),
+        ...((0, codexAuth_1.readAuthIdentityFromRaw)(targetAuthRaw) ?? {}),
+    }) ||
         (liveAuthRaw !== null && liveAuthRaw === targetAuthRaw) ||
         (!liveAuthRaw && !targetAuthRaw && liveLegacyRaw !== null && liveLegacyRaw === targetLegacyRaw));
     if (liveMatchesTarget) {
-        try {
-            if (liveAuthRaw)
-                (0, atomic_1.atomicWriteFileSync)(targetAuthPath, liveAuthRaw);
-            if (liveLegacyRaw)
-                (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, '.credentials.json'), liveLegacyRaw);
-            // File-based metadata only — see the swap-lock note above.
-            const metadata = readCodexAccountMetadataFromFiles(profileHome) ?? {};
-            (0, accountRegistry_1.upsertSavedAccountProfile)({
-                ...target,
-                email: metadata.email ?? target.email,
-                metadata: { ...target.metadata, ...metadata },
-            });
-        }
-        catch {
-            /* backup refresh is best-effort */
-        }
-        (0, accountRegistry_1.setActiveSavedAccount)('codex', target.id);
-        return { success: true, warning: warnings.length ? warnings.join(' ') : undefined };
+        if (previousAccountId !== target.id)
+            (0, accountRegistry_1.setActiveSavedAccount)('codex', target.id);
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            alreadyActive: true,
+            verified: true,
+            verification: 'store',
+            health: (0, accountHealth_1.getAccountHealth)('codex', target.id),
+            hints: [`${targetName} is already the active Codex account.`],
+        });
+    }
+    // Preflight: warn about stale backups; refuse ones known to be dead.
+    const health = (0, accountHealth_1.getAccountHealth)('codex', target.id, { probe: 'store' });
+    base.health = health;
+    if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            needsLogin: true,
+            error: `Stored credentials for "${targetName}" have expired; sign in again.`,
+        });
     }
-    const targetLastRefresh = readLastRefresh(targetAuthRaw, targetAuthPath);
-    if (targetLastRefresh !== null && Date.now() - targetLastRefresh > STALE_AUTH_THRESHOLD_MS) {
-        warnings.push(`Stored credentials for "${targetName}" have not been refreshed in over 8 days; codex may ask you to log in again.`);
+    const targetLastRefresh = (0, codexAuth_1.readLastRefresh)(targetAuthRaw, targetAuthPath);
+    if (targetLastRefresh !== null && Date.now() - targetLastRefresh > codexAuth_1.STALE_AUTH_THRESHOLD_MS) {
+        base.warnings.push(`Stored credentials for "${targetName}" have not been refreshed in over 8 days; codex may ask you to log in again.`);
     }
-    const syncBack = syncBackLiveCodexAuth(liveAuthRaw, liveLegacyRaw);
-    if (syncBack.warning)
-        warnings.push(syncBack.warning);
     const restoreLiveFiles = () => {
         try {
             if (liveAuthRaw)
@@ -756,7 +994,14 @@ function performCodexAuthSwapCore(target, probes) {
         catch {
             /* rollback is best-effort */
         }
+        try {
+            (0, accountRegistry_1.setActiveSavedAccount)('codex', previousAccountId, { silent: true });
+        }
+        catch {
+            /* rollback is best-effort */
+        }
     };
+    // Install.
     try {
         if (targetAuthRaw) {
             (0, atomic_1.atomicWriteFileSync)(liveAuthPath, targetAuthRaw);
@@ -773,32 +1018,75 @@ function performCodexAuthSwapCore(target, probes) {
     }
     catch (err) {
         restoreLiveFiles();
-        return { success: false, error: `Failed to write Codex credentials: ${err}` };
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            error: `Failed to write Codex credentials: ${err}`,
+        });
+    }
+    // Verify by re-reading the live file.
+    const installed = (0, codexPaths_1.readFileOrNull)(targetAuthRaw ? liveAuthPath : liveLegacyPath);
+    const expected = targetAuthRaw ?? targetLegacyRaw;
+    const installedIdentity = targetAuthRaw ? (0, codexAuth_1.readAuthIdentityFromRaw)(installed) : null;
+    const verified = installed === expected &&
+        (!targetAuthRaw ||
+            (0, codexAuth_1.identitiesMatch)(installedIdentity, {
+                ...profileIdentity(target),
+                ...((0, codexAuth_1.readAuthIdentityFromRaw)(targetAuthRaw) ?? {}),
+            }) ||
+            installedIdentity?.authMode === 'api-key');
+    if (!verified) {
+        restoreLiveFiles();
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            verification: 'failed',
+            error: `The live Codex credential file did not reflect the switch to "${targetName}"; the previous login was restored.`,
+        });
     }
+    // Pointer last.
     try {
         (0, accountRegistry_1.setActiveSavedAccount)('codex', target.id);
     }
     catch (err) {
         restoreLiveFiles();
-        return { success: false, error: `Failed to update account registry: ${err}` };
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            error: `Failed to update account registry: ${err}`,
+        });
     }
-    return { success: true, warning: warnings.length ? warnings.join(' ') : undefined };
+    let undoToken;
+    try {
+        undoToken = (0, accountSwitch_1.writeLastSwitch)('codex', previousAccountId, target.id).token;
+    }
+    catch {
+        base.warnings.push('The switch succeeded but could not be recorded for undo.');
+    }
+    return (0, accountSwitch_1.finishSwitchResult)({
+        ...base,
+        verified: true,
+        verification: 'store',
+        undoToken,
+        hints: [`New codex sessions use ${target.email ?? targetName}.`],
+    });
 }
-function switchToCodexAccount(profileId) {
+function switchToCodexAccount(profileId, options = {}) {
     const target = listCodexAccounts().find((account) => account.id === profileId);
     if (!target) {
-        return { success: false, error: `Codex account ${profileId} not found.` };
+        return (0, accountSwitch_1.switchFailure)('codex', profileId, `Codex account ${profileId} not found.`);
     }
-    return performCodexAuthSwap(target);
+    return performCodexAuthSwap(target, options);
 }
 /** {@link switchToCodexAccount} without blocking the event loop on CLI probes. */
-async function switchToCodexAccountAsync(profileId) {
+async function switchToCodexAccountAsync(profileId, options = {}) {
     const target = listCodexAccounts().find((account) => account.id === profileId);
     if (!target) {
-        return { success: false, error: `Codex account ${profileId} not found.` };
+        return (0, accountSwitch_1.switchFailure)('codex', profileId, `Codex account ${profileId} not found.`);
     }
-    return performCodexAuthSwapAsync(target);
+    return performCodexAuthSwapAsync(target, options);
 }
+// ── One-time migration ───────────────────────────────────────────────────
 /**
  * The reconcile flow consults the keyring probe only when the migration has
  * not run yet and the system home has no auth.json; skip the spawn otherwise.
@@ -807,7 +1095,7 @@ function needsReconcileKeyringProbe() {
     const markerPath = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', '.live-auth-migrated-v1');
     if (fs.existsSync(markerPath))
         return false;
-    return !fs.existsSync(path.join(getSystemCodexHome(), 'auth.json'));
+    return !fs.existsSync(path.join((0, codexPaths_1.getSystemCodexHome)(), 'auth.json'));
 }
 // One-time migration for installs created when profile homes doubled as live
 // CODEX_HOMEs: the active profile's auth.json may hold a fresher rotated
@@ -815,7 +1103,7 @@ function needsReconcileKeyringProbe() {
 function reconcileCodexAuthState() {
     try {
         const systemKeyringLoggedIn = needsReconcileKeyringProbe()
-            ? getCodexLoginStatus(getSystemCodexHome()).loggedIn
+            ? getCodexLoginStatus((0, codexPaths_1.getSystemCodexHome)()).loggedIn
             : false;
         withCodexAuthSwapLock(() => reconcileCodexAuthStateCore({ systemKeyringLoggedIn }));
     }
@@ -827,7 +1115,7 @@ function reconcileCodexAuthState() {
 async function reconcileCodexAuthStateAsync() {
     try {
         const systemKeyringLoggedIn = needsReconcileKeyringProbe()
-            ? (await getCodexLoginStatusAsync(getSystemCodexHome())).loggedIn
+            ? (await getCodexLoginStatusAsync((0, codexPaths_1.getSystemCodexHome)())).loggedIn
             : false;
         withCodexAuthSwapLock(() => reconcileCodexAuthStateCore({ systemKeyringLoggedIn }));
     }
@@ -846,16 +1134,16 @@ function reconcileCodexAuthStateCore(probes) {
             writeMarker();
             return;
         }
-        const profileHome = getCodexProfileHome(active.id);
+        const profileHome = (0, codexPaths_1.getCodexProfileHome)(active.id);
         const profileAuthPath = path.join(profileHome, 'auth.json');
-        const profileAuthRaw = readFileOrNull(profileAuthPath);
+        const profileAuthRaw = (0, codexPaths_1.readFileOrNull)(profileAuthPath);
         if (!profileAuthRaw) {
             writeMarker();
             return;
         }
-        const systemHome = getSystemCodexHome();
+        const systemHome = (0, codexPaths_1.getSystemCodexHome)();
         const liveAuthPath = path.join(systemHome, 'auth.json');
-        const liveAuthRaw = readFileOrNull(liveAuthPath);
+        const liveAuthRaw = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
         if (!liveAuthRaw) {
             // No live credentials (account was added via isolated login and never
             // promoted). Promote the active profile's copy unless codex is logged
@@ -867,15 +1155,12 @@ function reconcileCodexAuthStateCore(probes) {
             writeMarker();
             return;
         }
-        const liveIdentity = readAuthIdentityFromRaw(liveAuthRaw);
-        const profileIdentity = readAuthIdentityFromRaw(profileAuthRaw);
-        const sameIdentity = Boolean((liveIdentity?.workspaceId &&
-            profileIdentity?.workspaceId &&
-            liveIdentity.workspaceId === profileIdentity.workspaceId) ||
-            (liveIdentity?.email && liveIdentity.email === profileIdentity?.email));
+        const liveIdentity = (0, codexAuth_1.readAuthIdentityFromRaw)(liveAuthRaw);
+        const profileIdentityValue = (0, codexAuth_1.readAuthIdentityFromRaw)(profileAuthRaw);
+        const sameIdentity = (0, codexAuth_1.identitiesMatch)(liveIdentity, profileIdentityValue);
         if (sameIdentity) {
-            const liveRefresh = readLastRefresh(liveAuthRaw, liveAuthPath);
-            const profileRefresh = readLastRefresh(profileAuthRaw, profileAuthPath);
+            const liveRefresh = (0, codexAuth_1.readLastRefresh)(liveAuthRaw, liveAuthPath);
+            const profileRefresh = (0, codexAuth_1.readLastRefresh)(profileAuthRaw, profileAuthPath);
             if (profileRefresh !== null && (liveRefresh === null || profileRefresh > liveRefresh)) {
                 // The profile copy was the live home under the old model and holds
                 // the valid rotated refresh token — promote it.
@@ -883,7 +1168,7 @@ function reconcileCodexAuthStateCore(probes) {
                 (0, atomic_1.atomicWriteFileSync)(liveAuthPath, profileAuthRaw);
             }
             else {
-                (0, atomic_1.atomicWriteFileSync)(profileAuthPath, liveAuthRaw);
+                storeCodexProfileAuth(active.id, liveAuthRaw, null, 'migration');
             }
         }
         else {
@@ -892,7 +1177,7 @@ function reconcileCodexAuthStateCore(probes) {
             // one, and refresh its backup.
             const matching = findProfileForIdentity(liveIdentity);
             if (matching && matching.id !== active.id) {
-                (0, atomic_1.atomicWriteFileSync)(path.join(getCodexProfileHome(matching.id), 'auth.json'), liveAuthRaw);
+                storeCodexProfileAuth(matching.id, liveAuthRaw, null, 'migration');
                 (0, accountRegistry_1.setActiveSavedAccount)('codex', matching.id);
             }
         }
@@ -907,6 +1192,6 @@ function removeCodexAccount(profileId) {
     if (!removed) {
         return { success: false, error: `Codex account ${profileId} not found.` };
     }
-    fs.rmSync(getCodexProfileDir(profileId), { recursive: true, force: true });
+    fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
     return { success: true };
 }