sidekick-shared 0.26.5 → 0.26.6

package/dist/credentialIO.d.ts

@@ -2,8 +2,10 @@
  * Platform-aware credential I/O for Claude Code.
  *
  * On macOS, Claude Code stores OAuth credentials in the system Keychain
- * (service "Claude Code-credentials"). On Linux/WSL/Windows, credentials
- * live in ~/.claude/.credentials.json.
+ * (service "Claude Code-credentials", suffixed per config directory). On
+ * Linux/WSL/Windows, credentials live in `<home>/.credentials.json`. When the
+ * Keychain is unavailable (locked, SSH) Claude Code falls back to the file on
+ * macOS too, so reads consult the file after a Keychain miss.
  *
  * Both accounts.ts and credentials.ts consume this module so that all
  * credential access is platform-correct in one place.
@@ -12,8 +14,8 @@ export declare const KEYCHAIN_SERVICE = "Claude Code-credentials";
 /**
  * Read the active Claude Code credentials as a parsed object.
  *
- * - macOS: reads from system Keychain via the `security` CLI
- * - Linux / WSL / Windows: reads `~/.claude/.credentials.json`
+ * - macOS: reads from system Keychain via the `security` CLI, then the file
+ * - Linux / WSL / Windows: reads `<home>/.credentials.json`
  *
  * Returns `null` when credentials are absent or unreadable.
  */
@@ -22,8 +24,13 @@ export declare function readActiveCredentials(configDir?: string): unknown;
  * Write credentials to the active Claude Code credential store.
  *
  * - macOS: writes to system Keychain via the `security` CLI
- * - Linux / WSL / Windows: atomic-writes `~/.claude/.credentials.json`
+ * - Linux / WSL / Windows: atomic-writes `<home>/.credentials.json`
  *
  * Throws on failure.
  */
 export declare function writeActiveCredentials(credentials: unknown, configDir?: string): void;
+/**
+ * Remove the credential store of a config directory (an abandoned isolated
+ * login, a removed profile). Best effort: never throws.
+ */
+export declare function deleteStoredCredentials(configDir: string): void;

package/dist/credentialIO.js

@@ -3,8 +3,10 @@
  * Platform-aware credential I/O for Claude Code.
  *
  * On macOS, Claude Code stores OAuth credentials in the system Keychain
- * (service "Claude Code-credentials"). On Linux/WSL/Windows, credentials
- * live in ~/.claude/.credentials.json.
+ * (service "Claude Code-credentials", suffixed per config directory). On
+ * Linux/WSL/Windows, credentials live in `<home>/.credentials.json`. When the
+ * Keychain is unavailable (locked, SSH) Claude Code falls back to the file on
+ * macOS too, so reads consult the file after a Keychain miss.
  *
  * Both accounts.ts and credentials.ts consume this module so that all
  * credential access is platform-correct in one place.
@@ -46,12 +48,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.KEYCHAIN_SERVICE = void 0;
 exports.readActiveCredentials = readActiveCredentials;
 exports.writeActiveCredentials = writeActiveCredentials;
+exports.deleteStoredCredentials = deleteStoredCredentials;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const os = __importStar(require("os"));
 const child_process_1 = require("child_process");
 const claudeProfiles_1 = require("./claudeProfiles");
+const atomic_1 = require("./writers/atomic");
 exports.KEYCHAIN_SERVICE = 'Claude Code-credentials';
+const SECURITY_TIMEOUT_MS = 4000;
 function quoteSecurityInteractiveArg(value) {
     // `security -i` is not a POSIX shell: adjacent quoted segments do NOT
     // concatenate (so the shell-style '\'' splice splits the token), and
@@ -59,39 +63,49 @@ function quoteSecurityInteractiveArg(value) {
     return `'${value.replace(/\\/g, '\\\\').replace(/'/g, `\\'`)}'`;
 }
 function getCredentialsFilePath(configDir) {
-    return path.join(configDir ?? path.join(os.homedir(), '.claude'), '.credentials.json');
+    return path.join(configDir ?? (0, claudeProfiles_1.getLiveClaudeHome)(), '.credentials.json');
+}
+function readCredentialsFile(configDir) {
+    try {
+        return JSON.parse(fs.readFileSync(getCredentialsFilePath(configDir), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function readKeychainItem(service) {
+    try {
+        const raw = (0, child_process_1.execFileSync)('security', ['find-generic-password', '-s', service, '-w'], {
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: SECURITY_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+        });
+        return JSON.parse(raw.trim());
+    }
+    catch {
+        return null;
+    }
 }
 /**
  * Read the active Claude Code credentials as a parsed object.
  *
- * - macOS: reads from system Keychain via the `security` CLI
- * - Linux / WSL / Windows: reads `~/.claude/.credentials.json`
+ * - macOS: reads from system Keychain via the `security` CLI, then the file
+ * - Linux / WSL / Windows: reads `<home>/.credentials.json`
  *
  * Returns `null` when credentials are absent or unreadable.
  */
 function readActiveCredentials(configDir) {
     if (process.platform === 'darwin') {
-        try {
-            const raw = (0, child_process_1.execFileSync)('security', ['find-generic-password', '-s', (0, claudeProfiles_1.claudeKeychainService)(configDir), '-w'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 4000, killSignal: 'SIGKILL' });
-            return JSON.parse(raw.trim());
-        }
-        catch {
-            return null;
-        }
-    }
-    // Linux / WSL / Windows — file-based
-    try {
-        return JSON.parse(fs.readFileSync(getCredentialsFilePath(configDir), 'utf8'));
-    }
-    catch {
-        return null;
+        return readKeychainItem((0, claudeProfiles_1.claudeKeychainService)(configDir)) ?? readCredentialsFile(configDir);
     }
+    return readCredentialsFile(configDir);
 }
 /**
  * Write credentials to the active Claude Code credential store.
  *
  * - macOS: writes to system Keychain via the `security` CLI
- * - Linux / WSL / Windows: atomic-writes `~/.claude/.credentials.json`
+ * - Linux / WSL / Windows: atomic-writes `<home>/.credentials.json`
  *
  * Throws on failure.
  */
@@ -100,28 +114,48 @@ function writeActiveCredentials(credentials, configDir) {
     JSON.parse(json); // validate round-trip
     if (process.platform === 'darwin') {
         const service = (0, claudeProfiles_1.claudeKeychainService)(configDir);
-        const account = process.env.USER || 'user';
         const command = [
             'add-generic-password',
             '-U',
             '-s',
             quoteSecurityInteractiveArg(service),
             '-a',
-            quoteSecurityInteractiveArg(account),
+            quoteSecurityInteractiveArg((0, claudeProfiles_1.claudeKeychainAccountName)()),
             '-w',
             quoteSecurityInteractiveArg(json),
         ].join(' ');
         (0, child_process_1.execFileSync)('security', ['-i'], {
             input: command + '\n',
             stdio: ['pipe', 'pipe', 'pipe'],
-            timeout: 4000,
+            timeout: SECURITY_TIMEOUT_MS,
             killSignal: 'SIGKILL',
         });
         return;
     }
-    // Linux / WSL / Windows — file-based
-    const credPath = getCredentialsFilePath(configDir);
-    const tmp = credPath + '.tmp';
-    fs.writeFileSync(tmp, json, { encoding: 'utf8', mode: 0o600 });
-    fs.renameSync(tmp, credPath);
+    // Linux / WSL / Windows — file-based (tmp + fsync + rename, retried on Windows)
+    (0, atomic_1.atomicWriteFileSync)(getCredentialsFilePath(configDir), json, 0o600);
+}
+/**
+ * Remove the credential store of a config directory (an abandoned isolated
+ * login, a removed profile). Best effort: never throws.
+ */
+function deleteStoredCredentials(configDir) {
+    if (process.platform === 'darwin') {
+        try {
+            (0, child_process_1.execFileSync)('security', ['delete-generic-password', '-s', (0, claudeProfiles_1.claudeKeychainService)(configDir)], {
+                stdio: ['ignore', 'ignore', 'ignore'],
+                timeout: SECURITY_TIMEOUT_MS,
+                killSignal: 'SIGKILL',
+            });
+        }
+        catch {
+            /* no item, or keychain unavailable */
+        }
+    }
+    try {
+        fs.rmSync(getCredentialsFilePath(configDir), { force: true });
+    }
+    catch {
+        /* best effort */
+    }
 }

package/dist/credentials.d.ts

@@ -7,8 +7,10 @@ export interface ClaudeMaxCredentials {
     accessToken: string;
     refreshToken?: string;
     expiresAt?: number;
+    refreshTokenExpiresAt?: number;
     scopes?: string[];
     subscriptionType?: string;
+    rateLimitTier?: string;
 }
 /**
  * Reads Claude Max OAuth credentials.
@@ -18,6 +20,12 @@ export interface ClaudeMaxCredentials {
  * absent, the token is missing, or the token is expired. Never throws.
  */
 export declare function readClaudeMaxCredentials(): Promise<ClaudeMaxCredentials | null>;
+/**
+ * Like {@link readClaudeMaxCredentials} but returns the stored credential even
+ * when the access token has lapsed: the CLI refreshes it on next use, so an
+ * expired access token is still a valid login (until the refresh token expires).
+ */
+export declare function readClaudeMaxCredentialsRaw(): ClaudeMaxCredentials | null;
 /**
  * Synchronous convenience — returns just the access token or `null`.
  */

package/dist/credentials.js

@@ -6,8 +6,18 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readClaudeMaxCredentials = readClaudeMaxCredentials;
+exports.readClaudeMaxCredentialsRaw = readClaudeMaxCredentialsRaw;
 exports.readClaudeMaxAccessTokenSync = readClaudeMaxAccessTokenSync;
+const claudeCredentials_1 = require("./claudeCredentials");
 const credentialIO_1 = require("./credentialIO");
+function readParsed() {
+    try {
+        return (0, claudeCredentials_1.parseClaudeCredentialBlob)((0, credentialIO_1.readActiveCredentials)());
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Reads Claude Max OAuth credentials.
  *
@@ -16,43 +26,29 @@ const credentialIO_1 = require("./credentialIO");
  * absent, the token is missing, or the token is expired. Never throws.
  */
 async function readClaudeMaxCredentials() {
-    try {
-        const raw = (0, credentialIO_1.readActiveCredentials)();
-        if (!raw)
-            return null;
-        const oauth = raw.claudeAiOauth;
-        if (!oauth?.accessToken)
-            return null;
-        if (oauth.expiresAt && Date.now() > oauth.expiresAt)
-            return null;
-        return {
-            accessToken: oauth.accessToken,
-            refreshToken: oauth.refreshToken,
-            expiresAt: oauth.expiresAt,
-            scopes: oauth.scopes,
-            subscriptionType: oauth.subscriptionType,
-        };
-    }
-    catch {
+    const parsed = readParsed();
+    if (!parsed)
         return null;
-    }
+    if (parsed.expiresAt && Date.now() > parsed.expiresAt)
+        return null;
+    return parsed;
+}
+/**
+ * Like {@link readClaudeMaxCredentials} but returns the stored credential even
+ * when the access token has lapsed: the CLI refreshes it on next use, so an
+ * expired access token is still a valid login (until the refresh token expires).
+ */
+function readClaudeMaxCredentialsRaw() {
+    return readParsed();
 }
 /**
  * Synchronous convenience — returns just the access token or `null`.
  */
 function readClaudeMaxAccessTokenSync() {
-    try {
-        const raw = (0, credentialIO_1.readActiveCredentials)();
-        if (!raw)
-            return null;
-        const oauth = raw.claudeAiOauth;
-        if (!oauth?.accessToken)
-            return null;
-        if (oauth.expiresAt && Date.now() > oauth.expiresAt)
-            return null;
-        return oauth.accessToken;
-    }
-    catch {
+    const parsed = readParsed();
+    if (!parsed)
         return null;
-    }
+    if (parsed.expiresAt && Date.now() > parsed.expiresAt)
+        return null;
+    return parsed.accessToken;
 }

package/dist/ensureDefaultAccounts.d.ts

@@ -1,9 +1,17 @@
+import type { SyncReport } from './accountSyncTypes';
 export type EnsureDefaultAccountStatus = 'registered' | 'skipped' | 'error';
 export interface EnsureDefaultAccountsResult {
     claude: EnsureDefaultAccountStatus;
     codex: EnsureDefaultAccountStatus;
+    /** The full sync report behind the two statuses. */
+    sync?: SyncReport;
 }
 export interface EnsureDefaultAccountsOptions {
     logger?: (message: string, error?: unknown) => void;
 }
+/**
+ * Host startup hook: run the one-time on-disk migrations, drop abandoned
+ * isolated logins, then reconcile the live logins with the saved profiles
+ * (registering any login sidekick has never seen).
+ */
 export declare function ensureDefaultAccounts(options?: EnsureDefaultAccountsOptions): Promise<EnsureDefaultAccountsResult>;

package/dist/ensureDefaultAccounts.js

@@ -1,45 +1,9 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureDefaultAccounts = ensureDefaultAccounts;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
 const accounts_1 = require("./accounts");
-const accountRegistry_1 = require("./accountRegistry");
 const codexProfiles_1 = require("./codexProfiles");
-const credentials_1 = require("./credentials");
+const accountSync_1 = require("./accountSync");
 function logFailure(options, message, error) {
     try {
         options?.logger?.(message, error);
@@ -48,65 +12,61 @@ function logFailure(options, message, error) {
         // Logging must never make account bootstrap fail.
     }
 }
-async function ensureDefaultClaudeAccount(options) {
-    try {
-        if ((0, accountRegistry_1.getActiveSavedAccount)('claude-code'))
-            return 'skipped';
-        const active = (0, accounts_1.readActiveClaudeAccount)();
-        if (!active)
-            return 'skipped';
-        const credentials = await (0, credentials_1.readClaudeMaxCredentials)();
-        if (!credentials)
-            return 'skipped';
-        const result = (0, accounts_1.addCurrentAccount)('Default');
-        if (result.success)
-            return 'registered';
-        logFailure(options, 'Claude default account registration failed.', result.error ?? 'unknown error');
+function statusFromReport(report) {
+    if (report.registered)
+        return 'registered';
+    // A keyring-mode Codex login is a steady state sidekick cannot act on, not a failure.
+    if (report.skipped === 'keyring')
+        return 'skipped';
+    if (report.warnings.length > 0)
         return 'error';
+    return 'skipped';
+}
+/**
+ * Host startup hook: run the one-time on-disk migrations, drop abandoned
+ * isolated logins, then reconcile the live logins with the saved profiles
+ * (registering any login sidekick has never seen).
+ */
+async function ensureDefaultAccounts(options) {
+    try {
+        (0, accounts_1.reconcileClaudeAuthState)();
     }
     catch (error) {
-        logFailure(options, 'Claude default account registration failed.', error);
-        return 'error';
+        logFailure(options, 'Claude auth reconciliation failed.', error);
     }
-}
-function cleanupPendingCodexProfile(profileId) {
-    fs.rmSync(path.join((0, codexProfiles_1.getCodexProfilesDir)(), profileId), { recursive: true, force: true });
-}
-async function ensureDefaultCodexAccount(options) {
     try {
-        if ((0, codexProfiles_1.getActiveCodexAccount)())
-            return 'skipped';
-        const systemAuthPath = path.join((0, codexProfiles_1.getSystemCodexHome)(), 'auth.json');
-        if (!fs.existsSync(systemAuthPath))
-            return 'skipped';
-        const result = await (0, codexProfiles_1.prepareCodexAccountAsync)('Default');
-        if (result.success && !result.needsLogin)
-            return 'registered';
-        if (result.profileId) {
-            cleanupPendingCodexProfile(result.profileId);
-        }
-        logFailure(options, 'Codex default account registration failed.', result.error ?? 'Codex auth could not be finalized.');
-        return 'error';
+        await (0, codexProfiles_1.reconcileCodexAuthStateAsync)();
     }
     catch (error) {
-        logFailure(options, 'Codex default account registration failed.', error);
-        return 'error';
+        logFailure(options, 'Codex auth reconciliation failed.', error);
     }
-}
-async function ensureDefaultAccounts(options) {
-    const claude = await ensureDefaultClaudeAccount(options);
-    const codex = await ensureDefaultCodexAccount(options);
     try {
-        (0, accounts_1.reconcileClaudeAuthState)();
+        (0, accountSync_1.cleanupAbandonedLogins)();
     }
     catch (error) {
-        logFailure(options, 'Claude auth reconciliation failed.', error);
+        logFailure(options, 'Abandoned login cleanup failed.', error);
     }
+    let sync;
     try {
-        await (0, codexProfiles_1.reconcileCodexAuthStateAsync)();
+        sync = await (0, accountSync_1.syncLiveAccountState)({ reason: 'startup' });
     }
     catch (error) {
-        logFailure(options, 'Codex auth reconciliation failed.', error);
+        logFailure(options, 'Account sync failed.', error);
+        return { claude: 'error', codex: 'error' };
     }
-    return { claude, codex };
+    for (const [provider, report] of [
+        ['Claude', sync.claude],
+        ['Codex', sync.codex],
+    ]) {
+        if (report.skipped === 'keyring')
+            continue;
+        for (const warning of report.warnings) {
+            logFailure(options, `${provider} account sync: ${warning}`, undefined);
+        }
+    }
+    return {
+        claude: statusFromReport(sync.claude),
+        codex: statusFromReport(sync.codex),
+        sync,
+    };
 }

package/dist/index.d.ts

@@ -154,27 +154,44 @@ export { calculateCompactionLedger, formatCompactionLedger } from './analytics/c
 export type { CompactionLedger } from './analytics/compactionLedger';
 export { generateHtmlReport, parseTranscript, parseTranscriptFromEvents, openInBrowser, } from './report';
 export type { TranscriptContentBlock, TranscriptEntry, HtmlReportOptions } from './report';
-export { readActiveCredentials, writeActiveCredentials } from './credentialIO';
-export { readClaudeMaxCredentials, readClaudeMaxAccessTokenSync } from './credentials';
+export { readActiveCredentials, writeActiveCredentials, deleteStoredCredentials, } from './credentialIO';
+export { readClaudeMaxCredentials, readClaudeMaxCredentialsRaw, readClaudeMaxAccessTokenSync, } from './credentials';
 export type { ClaudeMaxCredentials } from './credentials';
+export { parseClaudeCredentialBlob, claudeCredentialFreshness, isNewerClaudeCredential, resolveClaudeRefreshExpiry, CLAUDE_ACCESS_TOKEN_LIFETIME_MS, CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS, } from './claudeCredentials';
+export type { ClaudeOauthCredentials } from './claudeCredentials';
+export { parseAuthJson as parseCodexAuthJson, readAuthIdentityFromRaw as readCodexAuthIdentity, readLastRefresh as readCodexLastRefresh, readAccessTokenExpiry as readCodexAccessTokenExpiry, identitiesMatch as codexIdentitiesMatch, } from './codexAuth';
+export type { CodexAuthIdentity, CodexAuthJsonFile } from './codexAuth';
 export { ensureDefaultAccounts } from './ensureDefaultAccounts';
 export type { EnsureDefaultAccountStatus, EnsureDefaultAccountsOptions, EnsureDefaultAccountsResult, } from './ensureDefaultAccounts';
-export { readAccountRegistry, writeAccountRegistry, readActiveClaudeAccount, addCurrentAccount, switchToAccount, resolveActiveClaudeHome, applyActiveClaudeToLiveHome, reconcileClaudeAuthState, removeAccount, listAccounts, getActiveAccount, resolveActiveClaudeAccount, isMultiAccountEnabled, } from './accounts';
+export { readAccountRegistry, writeAccountRegistry, readActiveClaudeAccount, addCurrentAccount, switchToAccount, switchToAccountAsync, syncClaudeLiveState, cleanupAbandonedClaudeLogins, resolveActiveClaudeHome, applyActiveClaudeToLiveHome, reconcileClaudeAuthState, removeAccount, listAccounts, getActiveAccount, resolveActiveClaudeAccount, isMultiAccountEnabled, } from './accounts';
 export type { AccountEntry, AccountRegistry, ActiveAccountInfo, AccountManagerResult, } from './accounts';
-export { beginAccountLogin, getAccountLoginStatus, getAccountLoginStatusAsync, finalizeAccountLogin, finalizeAccountLoginAsync, spawnAccountLogin, switchAccount, switchAccountAsync, listAllAccounts, resolveClaudeLoginCommand, } from './accountManager';
-export type { AccountLoginCommand, AccountLoginState, AccountLoginStatus, BeginAccountLoginResult, FinalizeAccountLoginOptions, ListAllAccountsResult, SpawnAccountLoginOptions, } from './accountManager';
+export { beginAccountLogin, getAccountLoginStatus, getAccountLoginStatusAsync, finalizeAccountLogin, finalizeAccountLoginAsync, spawnAccountLogin, switchAccount, switchAccountAsync, undoLastSwitch, getLastSwitch, listAllAccounts, resolveClaudeLoginCommand, } from './accountManager';
+export type { AccountLoginCommand, AccountLoginState, AccountLoginStatus, BeginAccountLoginOptions, BeginAccountLoginResult, BeginAccountLoginSuccess, FinalizeAccountLoginOptions, ListAllAccountsResult, SpawnAccountLoginOptions, } from './accountManager';
+export { readLastSwitch, getLastSwitchPath } from './accountSwitch';
+export type { LastSwitchRecord, SwitchAccountOptions, SwitchAccountResult, SwitchVerification, } from './accountSwitch';
+export { syncLiveAccountState, syncLiveAccountStateSync, cleanupAbandonedLogins, } from './accountSync';
+export type { SyncLiveAccountStateOptions, CleanupAbandonedLoginsResult } from './accountSync';
+export type { ProviderSyncReport, SyncReason, SyncReport } from './accountSyncTypes';
+export { getAccountHealth, listAccountsWithHealth, readHealthSidecar, getHealthSidecarPath, } from './accountHealth';
+export type { AccountHealth, AccountHealthOptions, AccountHealthSidecar, AccountHealthSource, AccountHealthState, AccountView, } from './accountHealth';
+export { getAccountLaunchEnv } from './accountLaunch';
+export type { AccountLaunchEnv, AccountLaunchOptions } from './accountLaunch';
+export { refreshInactiveAccounts, keepAliveCommand } from './keepAlive';
+export type { KeepAliveRunner, RefreshInactiveAccountsOptions, RefreshInactiveAccountsResult, } from './keepAlive';
+export { findRunningProcesses, findRunningProcessesSync, detectRunningAccountConsumers, detectRunningAccountConsumersSync, describeAccountConsumer, ACCOUNT_CONSUMER_REACHABILITY, } from './processDetection';
+export type { AccountConsumerKind, RunningAccountConsumer, RunningProcess, } from './processDetection';
 export { getAccountsDir, readSavedAccountRegistry, writeSavedAccountRegistry, listSavedAccountProfiles, getActiveSavedAccount, upsertSavedAccountProfile, setActiveSavedAccount, replaceSavedAccountProfiles, removeSavedAccountProfile, } from './accountRegistry';
-export type { AccountProviderId, AccountIdentityMetadata, ResolvedActiveAccount, SavedAccountProfile, SavedAccountRegistry, } from './accountRegistry';
+export type { AccountProviderId, AccountIdentityMetadata, AccountProfileOrigin, ResolvedActiveAccount, SavedAccountProfile, SavedAccountRegistry, } from './accountRegistry';
 export { ACCOUNT_PROVIDER_IDS } from './accountRegistry';
 export { getActiveAccountStatus } from './accountStatus';
 export type { ActiveAccountStatus, ActiveAccountStatusOptions, ActiveProviderAccountStatus, } from './accountStatus';
 export { onAccountsChanged } from './accountChanges';
 export type { AccountsChangedEvent, OnAccountsChangedOptions } from './accountChanges';
-export { getClaudeProfilesDir, getClaudeProfileHome, claudeKeychainSuffix, claudeKeychainService, isClaudeProfileAuthenticated, readClaudeProfileIdentity, } from './claudeProfiles';
+export { getClaudeProfilesDir, getClaudeProfileHome, getLiveClaudeHome, getDefaultClaudeHome, getClaudeConfigPath, claudeKeychainSuffix, claudeKeychainService, claudeKeychainAccountName, buildClaudeChildEnv, CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV, isClaudeProfileAuthenticated, readClaudeProfileIdentity, readLiveClaudeIdentity, } from './claudeProfiles';
 export type { ClaudeProfileIdentity } from './claudeProfiles';
-export { getCodexProfilesDir, getCodexProfileHome, getCodexMonitoringHomes, getSystemCodexHome, listCodexAccounts, getActiveCodexAccount, resolveActiveCodexAccount, resolveSidekickCodexHome, getCodexExecutionEnv, prepareCodexAccount, prepareCodexAccountAsync, finalizeCodexAccount, finalizeCodexAccountAsync, switchToCodexAccount, switchToCodexAccountAsync, removeCodexAccount, } from './codexProfiles';
-export type { CodexAccountManagerResult } from './codexProfiles';
-export { setTerminalActiveProfile, installShellHook, uninstallShellHook, isShellHookInstalled, writeLauncher, removeLauncher, } from './terminalSync';
+export { getCodexProfilesDir, getCodexProfileHome, getCodexMonitoringHomes, getSystemCodexHome, listCodexAccounts, getActiveCodexAccount, resolveActiveCodexAccount, resolveSidekickCodexHome, getCodexExecutionEnv, prepareCodexAccount, prepareCodexAccountAsync, finalizeCodexAccount, finalizeCodexAccountAsync, switchToCodexAccount, switchToCodexAccountAsync, removeCodexAccount, syncCodexLiveState, cleanupAbandonedCodexLogins, getCodexCredentialStoreMode, CODEX_KEYRING_FIX_HINT, } from './codexProfiles';
+export type { CodexAccountManagerResult, CodexCredentialStoreMode } from './codexProfiles';
+export { writeLauncher, removeLauncher } from './terminalSync';
 export { DEFAULT_AUTO_SWITCH_CONFIG, decideAutoSwitch, AutoSwitchController } from './autoSwitch';
 export type { AutoSwitchActiveAccount, AutoSwitchCandidate, AutoSwitchConfig, AutoSwitchControllerOptions, AutoSwitchDecision, AutoSwitchTransitionEvent, } from './autoSwitch';
 export { FIVE_HOUR_WINDOW_MS, QUOTA_PROVIDER_IDS, SEVEN_DAY_WINDOW_MS, fetchQuota, projectQuotaWindow, withQuotaProjections, } from './quota';