sidekick-shared 0.27.4 → 0.27.6

package/dist/accountLaunch.d.ts

@@ -26,5 +26,11 @@ export interface AccountLaunchOptions {
     materialize?: boolean;
     /** Launch even when the stored credential is reported expired. */
     force?: boolean;
+    /**
+     * Claude: when the profile home has no credential but its backup does,
+     * restore it there first (default true). Keep-alive passes false: it never
+     * restores backups.
+     */
+    restoreBackup?: boolean;
 }
 export declare function getAccountLaunchEnv(provider: AccountProviderId, accountId: string, options?: AccountLaunchOptions): AccountLaunchEnv;

package/dist/accountLaunch.js

@@ -44,6 +44,9 @@ const path = __importStar(require("path"));
 const accountRegistry_1 = require("./accountRegistry");
 const accountHealth_1 = require("./accountHealth");
 const claudeProfiles_1 = require("./claudeProfiles");
+const accounts_1 = require("./accounts");
+const codexCredentialStore_1 = require("./codexCredentialStore");
+const codexProfiles_1 = require("./codexProfiles");
 const codexPaths_1 = require("./codexPaths");
 const atomic_1 = require("./writers/atomic");
 function materializeClaudeHome(home) {
@@ -70,10 +73,11 @@ function materializeClaudeHome(home) {
 function materializeCodexHome(home) {
     fs.mkdirSync(home, { recursive: true, mode: 0o700 });
     const configTarget = path.join(home, 'config.toml');
-    if (!fs.existsSync(configTarget)) {
-        const source = (0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getSystemCodexHome)(), 'config.toml')) ?? '';
-        (0, atomic_1.atomicWriteFileSync)(configTarget, (0, codexPaths_1.forceFileCredentialStore)(source));
-    }
+    const current = (0, codexPaths_1.readFileOrNull)(configTarget);
+    const source = current ?? (0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getSystemCodexHome)(), 'config.toml')) ?? '';
+    const fileMode = (0, codexPaths_1.forceFileCredentialStore)(source);
+    if (fileMode !== current)
+        (0, atomic_1.atomicWriteFileSync)(configTarget, fileMode);
 }
 function getAccountLaunchEnv(provider, accountId, options = {}) {
     const profile = (0, accountRegistry_1.listSavedAccountProfiles)(provider).find((p) => p.id === accountId);
@@ -98,6 +102,40 @@ function getAccountLaunchEnv(provider, accountId, options = {}) {
     if (!profile) {
         return { ...base, error: `${provider} account ${accountId} not found.` };
     }
+    if (provider === 'codex' && (0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)())) {
+        return {
+            ...base,
+            error: 'Unset CODEX_HOME before managing accounts; it names a Sidekick-owned home.',
+        };
+    }
+    if (provider === 'codex' && !['file', 'unknown'].includes((0, codexPaths_1.getCodexCredentialStoreMode)())) {
+        return { ...base, error: 'Codex account launches require readable file-mode credentials.' };
+    }
+    if (provider === 'codex' && (0, codexProfiles_1.isLiveCodexProfile)(profile)) {
+        const liveHome = (0, codexPaths_1.getSystemCodexHome)();
+        return {
+            ...base,
+            home: liveHome,
+            env: { CODEX_HOME: liveHome },
+            warnings: ['This account is the live login, so the session uses the normal Codex home.'],
+        };
+    }
+    if (provider === 'claude-code' && health.isLive) {
+        // The live account's only CLI-usable copy is the live store; a session in
+        // its profile home would be a second copy racing it over the refresh
+        // token. Point the session at the live home instead.
+        const liveHome = (0, claudeProfiles_1.getLiveClaudeHome)();
+        const customHome = !(0, claudeProfiles_1.isDefaultClaudeHome)();
+        return {
+            ...base,
+            home: liveHome,
+            env: customHome ? { CLAUDE_CONFIG_DIR: liveHome } : {},
+            envUnset: customHome
+                ? [claudeProfiles_1.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV]
+                : ['CLAUDE_CONFIG_DIR', claudeProfiles_1.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV],
+            warnings: ['This account is the live login, so the session uses the normal Claude home.'],
+        };
+    }
     if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
         return {
             ...base,
@@ -109,6 +147,25 @@ function getAccountLaunchEnv(provider, accountId, options = {}) {
     }
     if (health.state === 'expiring' && health.reason)
         warnings.push(health.reason);
+    if (provider === 'claude-code' && options.restoreBackup !== false) {
+        if ((0, accounts_1.restoreClaudeProfileFromBackup)(accountId) === 'restored') {
+            warnings.push("Restored this account's saved login into its profile home. If a session elsewhere still uses this login, close it first: two copies of one login invalidate each other.");
+        }
+    }
+    if (provider === 'codex') {
+        const restored = (0, codexProfiles_1.restoreCodexProfileFromBackup)(accountId, {
+            restore: options.restoreBackup !== false,
+        });
+        if (restored === 'none')
+            return { ...base, error: 'No safe inactive Codex credential is available; sign in again.' };
+        if (restored === 'live')
+            return { ...base, home: (0, codexPaths_1.getSystemCodexHome)(), env: { CODEX_HOME: (0, codexPaths_1.getSystemCodexHome)() } };
+    }
+    if (provider === 'codex' &&
+        options.materialize === false &&
+        !['file', 'unknown'].includes((0, codexPaths_1.getCodexCredentialStoreMode)(home))) {
+        return { ...base, error: 'The isolated Codex home must use file credential storage.' };
+    }
     if (options.materialize !== false) {
         try {
             if (provider === 'codex')

package/dist/accountLease.d.ts

@@ -0,0 +1,5 @@
+import type { AccountProviderId } from './accountRegistry';
+export declare function isAccountLeaseHeld(provider: AccountProviderId, accountId: string, now?: number): boolean;
+/** Take the lease; the caller holds the provider's swap lock. False when held elsewhere. */
+export declare function acquireAccountLease(provider: AccountProviderId, accountId: string, durationMs: number, now?: number): boolean;
+export declare function releaseAccountLease(provider: AccountProviderId, accountId: string): void;

package/dist/accountLease.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAccountLeaseHeld = isAccountLeaseHeld;
+exports.acquireAccountLease = acquireAccountLease;
+exports.releaseAccountLease = releaseAccountLease;
+/**
+ * Keep-alive leases: while keep-alive runs a provider CLI inside a profile
+ * home, that home's credential may be mid-refresh. A switch to that account
+ * would copy the pre-refresh token into the live store just as the CLI kills
+ * it, so switches refuse a leased target. Leases are acquired under the
+ * provider's swap lock (the same lock a switch holds), expire on their own,
+ * and are ignored once their process is gone.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const claudeProfiles_1 = require("./claudeProfiles");
+const codexPaths_1 = require("./codexPaths");
+const atomic_1 = require("./writers/atomic");
+function leasePath(provider, accountId) {
+    const dir = provider === 'codex' ? (0, codexPaths_1.getCodexProfileDir)(accountId) : (0, claudeProfiles_1.getClaudeProfileDir)(accountId);
+    return path.join(dir, 'keepalive.lease');
+}
+function processAlive(pid) {
+    if (pid === process.pid)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function isAccountLeaseHeld(provider, accountId, now = Date.now()) {
+    try {
+        const lease = JSON.parse(fs.readFileSync(leasePath(provider, accountId), 'utf8'));
+        return (typeof lease.pid === 'number' &&
+            typeof lease.expiresAt === 'number' &&
+            lease.expiresAt > now &&
+            processAlive(lease.pid));
+    }
+    catch {
+        return false;
+    }
+}
+/** Take the lease; the caller holds the provider's swap lock. False when held elsewhere. */
+function acquireAccountLease(provider, accountId, durationMs, now = Date.now()) {
+    if (isAccountLeaseHeld(provider, accountId, now))
+        return false;
+    const target = leasePath(provider, accountId);
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    (0, atomic_1.atomicWriteJsonSync)(target, {
+        pid: process.pid,
+        expiresAt: now + durationMs,
+    });
+    return true;
+}
+function releaseAccountLease(provider, accountId) {
+    try {
+        fs.rmSync(leasePath(provider, accountId), { force: true });
+    }
+    catch {
+        /* expires on its own */
+    }
+}

package/dist/accountManager.d.ts

@@ -73,6 +73,13 @@ export declare function getAccountLoginStatusAsync(provider: AccountProviderId,
 export declare function finalizeAccountLogin(provider: AccountProviderId, loginId: string, opts?: FinalizeAccountLoginOptions): AccountManagerResult;
 /** {@link finalizeAccountLogin} without blocking the event loop on CLI probes. */
 export declare function finalizeAccountLoginAsync(provider: AccountProviderId, loginId: string, opts?: FinalizeAccountLoginOptions): Promise<AccountManagerResult>;
+/**
+ * Abandon a login started with {@link beginAccountLogin} (cancelled, timed
+ * out, or failed): removes the temporary home and, for Claude, its Keychain
+ * item. Refuses ids that belong to a saved profile. Returns true when
+ * something was discarded.
+ */
+export declare function discardAccountLogin(provider: AccountProviderId, loginId: string): boolean;
 export declare function spawnAccountLogin(provider: AccountProviderId, label: string, opts?: SpawnAccountLoginOptions): Promise<AccountManagerResult>;
 export declare function switchAccount(provider: AccountProviderId, id: string, options?: SwitchAccountOptions): SwitchAccountResult;
 /**

package/dist/accountManager.js

@@ -39,6 +39,7 @@ exports.getAccountLoginStatus = getAccountLoginStatus;
 exports.getAccountLoginStatusAsync = getAccountLoginStatusAsync;
 exports.finalizeAccountLogin = finalizeAccountLogin;
 exports.finalizeAccountLoginAsync = finalizeAccountLoginAsync;
+exports.discardAccountLogin = discardAccountLogin;
 exports.spawnAccountLogin = spawnAccountLogin;
 exports.switchAccount = switchAccount;
 exports.switchAccountAsync = switchAccountAsync;
@@ -54,7 +55,9 @@ const atomic_1 = require("./writers/atomic");
 const accounts_1 = require("./accounts");
 const claudeProfiles_1 = require("./claudeProfiles");
 const credentialIO_1 = require("./credentialIO");
+const claudeCredentialLedger_1 = require("./claudeCredentialLedger");
 const codexProfiles_1 = require("./codexProfiles");
+const codexPaths_1 = require("./codexPaths");
 const accountSwitch_1 = require("./accountSwitch");
 function getPendingClaudeProfilePath(loginId) {
     return path.join((0, claudeProfiles_1.getClaudeProfileDir)(loginId), 'profile.json');
@@ -109,7 +112,16 @@ function copyClaudeProfileToCanonicalHome(sourceHome, accountUuid, credentials,
     fs.mkdirSync(canonicalHome, { recursive: true, mode: 0o700 });
     if (path.resolve(sourceHome) !== path.resolve(canonicalHome)) {
         try {
-            fs.cpSync(sourceHome, canonicalHome, { recursive: true, force: true });
+            // Credentials go only through the chokepoint below: when this account is
+            // the live one its profile home must not receive a CLI-usable copy.
+            fs.cpSync(sourceHome, canonicalHome, {
+                recursive: true,
+                force: true,
+                filter: (src) => {
+                    const base = path.basename(src);
+                    return base !== '.credentials.json' && !base.startsWith('.oauth_refresh.lock');
+                },
+            });
         }
         catch {
             // The credential and identity files are re-written below when possible.
@@ -148,7 +160,7 @@ function beginAccountLogin(provider, label, opts = {}) {
         const effectiveLabel = existing
             ? `${existing.label ?? existing.email ?? 'codex'} (re-login ${(0, crypto_1.randomUUID)().slice(0, 8)})`
             : label.trim() || `Codex ${(0, codexProfiles_1.listCodexAccounts)().length + 1}`;
-        const prepared = (0, codexProfiles_1.prepareCodexAccount)(effectiveLabel);
+        const prepared = (0, codexProfiles_1.prepareCodexAccount)(effectiveLabel, { importCurrent: false });
         if (!prepared.success || !prepared.profileId || !prepared.codexHome) {
             return { success: false, error: prepared.error ?? 'Could not prepare Codex account login.' };
         }
@@ -186,6 +198,9 @@ function beginAccountLogin(provider, label, opts = {}) {
         existingAccountId: existing?.id,
     });
     seedClaudeLoginHome(home);
+    // Claude Code creates this home's Keychain item itself; record the home
+    // first so the item is provably Sidekick's even if everything else fails.
+    (0, claudeCredentialLedger_1.recordClaudeCredentialHome)(home, 'login');
     const loginCommand = resolveClaudeLoginCommand(opts);
     return {
         success: true,
@@ -207,7 +222,7 @@ function getClaudeAccountLoginStatus(loginId) {
 }
 function getAccountLoginStatus(provider, loginId) {
     if (provider === 'codex') {
-        const codexHome = (0, codexProfiles_1.getCodexProfileHome)(loginId);
+        const codexHome = (0, codexPaths_1.getCodexLoginHome)(loginId);
         if (!(0, codexProfiles_1.isCodexProfileAuthenticated)(codexHome)) {
             return { state: 'pending' };
         }
@@ -226,7 +241,7 @@ function getAccountLoginStatus(provider, loginId) {
  */
 async function getAccountLoginStatusAsync(provider, loginId) {
     if (provider === 'codex') {
-        const codexHome = (0, codexProfiles_1.getCodexProfileHome)(loginId);
+        const codexHome = (0, codexPaths_1.getCodexLoginHome)(loginId);
         if (!(await (0, codexProfiles_1.isCodexProfileAuthenticatedAsync)(codexHome))) {
             return { state: 'pending' };
         }
@@ -257,44 +272,55 @@ function finalizeClaudeAccountLogin(loginId, opts = {}) {
     if (!identity) {
         return { success: false, error: 'Claude profile is not authenticated yet.' };
     }
-    const credentials = (0, credentialIO_1.readActiveCredentials)(home);
-    if (!credentials) {
-        return { success: false, error: 'Could not read Claude profile credentials.' };
-    }
-    const oauthAccount = readClaudeOauthAccount(home);
-    if (!oauthAccount) {
-        return { success: false, error: 'Could not read Claude profile config.' };
+    const read = (0, credentialIO_1.readClaudeCredentialStore)(home);
+    if (read.status === 'error') {
+        // Transient (locked Keychain, timeout): keep the login home for a retry.
+        return { success: false, error: 'Could not read the new Claude login yet; try again.' };
     }
-    const pending = readPendingClaudeProfile(loginId);
-    const existing = (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((account) => (account.providerAccountId ?? account.id) === identity.uuid);
-    copyClaudeProfileToCanonicalHome(home, identity.uuid, credentials, oauthAccount);
     const warnings = [];
-    if (pending?.existingAccountId && pending.existingAccountId !== identity.uuid) {
-        warnings.push(`You signed in as ${identity.email}, which is a different account from the one you chose to re-authenticate; it was saved separately.`);
-    }
-    (0, accountRegistry_1.upsertSavedAccountProfile)({
-        id: existing?.id ?? identity.uuid,
-        providerId: 'claude-code',
-        providerAccountId: identity.uuid,
-        email: identity.email,
-        label: existing?.label ?? (pending?.label || identity.email),
-        addedAt: existing?.addedAt ?? pending?.addedAt ?? new Date().toISOString(),
-        metadata: {
-            ...existing?.metadata,
-            email: identity.email,
-            origin: 'login',
-        },
-    });
-    removePendingClaudeProfile(loginId);
-    if (loginId !== identity.uuid) {
-        removePendingClaudeProfile(identity.uuid);
-        // The temporary home's keychain item holds live tokens; nothing references it now.
-        (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
-        try {
-            fs.rmSync((0, claudeProfiles_1.getClaudeProfileDir)(loginId), { recursive: true, force: true });
+    try {
+        if (read.status !== 'ok') {
+            return {
+                success: false,
+                error: 'The sign-in finished without a readable credential; sign in again.',
+            };
         }
-        catch {
-            /* the temporary login home is disposable */
+        const oauthAccount = readClaudeOauthAccount(home);
+        if (!oauthAccount) {
+            return { success: false, error: 'Could not read Claude profile config.' };
+        }
+        const pending = readPendingClaudeProfile(loginId);
+        const existing = (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((account) => (account.providerAccountId ?? account.id) === identity.uuid);
+        // The chokepoint writes the private backup first, so a failure below
+        // still leaves the new login saved.
+        copyClaudeProfileToCanonicalHome(home, identity.uuid, read.blob, oauthAccount);
+        if (pending?.existingAccountId && pending.existingAccountId !== identity.uuid) {
+            warnings.push(`You signed in as ${identity.email}, which is a different account from the one you chose to re-authenticate; it was saved separately.`);
+        }
+        (0, accountRegistry_1.upsertSavedAccountProfile)({
+            id: existing?.id ?? identity.uuid,
+            providerId: 'claude-code',
+            providerAccountId: identity.uuid,
+            email: identity.email,
+            label: existing?.label ?? (pending?.label || identity.email),
+            addedAt: existing?.addedAt ?? pending?.addedAt ?? new Date().toISOString(),
+            metadata: {
+                ...existing?.metadata,
+                email: identity.email,
+                origin: 'login',
+            },
+        });
+    }
+    catch (err) {
+        return { success: false, error: `Could not save the new Claude login: ${err}` };
+    }
+    finally {
+        // Every exit after authentication: the temporary home's Keychain item
+        // holds a live refresh token that nothing will ever reference again.
+        removePendingClaudeProfile(loginId);
+        if (loginId !== identity.uuid) {
+            removePendingClaudeProfile(identity.uuid);
+            discardClaudeLoginHome(loginId);
         }
     }
     if (opts.activate === false) {
@@ -306,6 +332,8 @@ function finalizeClaudeAccountLogin(loginId, opts = {}) {
         const applied = (0, accounts_1.applyClaudeProfileToLiveHome)(identity.uuid);
         if (!applied.success)
             return applied;
+        if (applied.warning)
+            warnings.push(applied.warning);
     }
     const switched = (0, accounts_1.switchToAccount)(identity.uuid);
     return warnings.length
@@ -356,22 +384,82 @@ function latestHomeActivity(home) {
     }
     return latest;
 }
+/** Delete a temporary Claude login home: its Keychain item first, then the directory. */
+function discardClaudeLoginHome(loginId) {
+    const dir = (0, claudeProfiles_1.getClaudeProfileDir)(loginId);
+    if (!path.resolve(dir).startsWith(path.resolve((0, accountRegistry_1.getAccountsDir)()) + path.sep))
+        return;
+    (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        /* the temporary login home is disposable */
+    }
+}
 function discardPendingLogin(provider, loginId) {
     try {
-        const dir = provider === 'codex'
-            ? path.dirname((0, codexProfiles_1.getCodexProfileHome)(loginId))
-            : (0, claudeProfiles_1.getClaudeProfileDir)(loginId);
-        if (!dir.startsWith((0, accountRegistry_1.getAccountsDir)()))
+        if (provider === 'claude-code') {
+            discardClaudeLoginHome(loginId);
             return;
-        if (provider === 'claude-code')
-            (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
-        fs.rmSync(dir, { recursive: true, force: true });
+        }
+        (0, codexProfiles_1.discardCodexLogin)(loginId);
     }
     catch {
         /* best effort */
     }
 }
+/**
+ * Abandon a login started with {@link beginAccountLogin} (cancelled, timed
+ * out, or failed): removes the temporary home and, for Claude, its Keychain
+ * item. Refuses ids that belong to a saved profile. Returns true when
+ * something was discarded.
+ */
+function discardAccountLogin(provider, loginId) {
+    const registered = provider === 'codex'
+        ? (0, codexProfiles_1.listCodexAccounts)().some((account) => account.id === loginId)
+        : (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').some((account) => account.id === loginId || account.providerAccountId === loginId);
+    if (registered)
+        return false;
+    if (provider === 'claude-code' && !readPendingClaudeProfile(loginId)) {
+        // Not a pending login; still drop a stray item for a home we created.
+        (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
+        return false;
+    }
+    discardPendingLogin(provider, loginId);
+    return true;
+}
+class AccountLoginWriterActiveError extends Error {
+}
 async function spawnAccountLogin(provider, label, opts = {}) {
+    let loginId;
+    let result;
+    let writerActive = false;
+    try {
+        result = await runAccountLogin(provider, label, opts, (id) => {
+            loginId = id;
+        });
+        return result;
+    }
+    catch (error) {
+        if (error instanceof AccountLoginWriterActiveError) {
+            writerActive = true;
+            return {
+                success: false,
+                error: 'The Codex login process could not be stopped. Its temporary home was preserved; close that process before retrying.',
+            };
+        }
+        throw error;
+    }
+    finally {
+        // Every exit that did not end in a saved login (spawn error, early exit,
+        // abort, timeout, a throw) removes the temporary home and its Keychain item.
+        if (!writerActive && loginId && (provider === 'codex' || !result?.success)) {
+            discardPendingLogin(provider, loginId);
+        }
+    }
+}
+async function runAccountLogin(provider, label, opts, onBegin) {
     if (opts.signal?.aborted) {
         return { success: false, error: 'Account login aborted.' };
     }
@@ -381,6 +469,7 @@ async function spawnAccountLogin(provider, label, opts = {}) {
     });
     if (!begin.success)
         return { success: false, error: begin.error };
+    onBegin(begin.loginId);
     if (begin.alreadyComplete) {
         return finalizeAccountLoginAsync(provider, begin.loginId, { activate: opts.activate ?? true });
     }
@@ -419,57 +508,105 @@ async function spawnAccountLogin(provider, label, opts = {}) {
         childExited = true;
         childState.spawnError = error;
     });
-    const abort = () => {
-        child.kill();
+    const stopCodexChild = async () => {
+        if (provider !== 'codex' || childExited)
+            return;
+        const waitForExit = (ms) => new Promise((resolve) => {
+            if (childExited) {
+                resolve();
+                return;
+            }
+            const done = () => {
+                clearTimeout(timer);
+                child.off('exit', done);
+                child.off('error', done);
+                resolve();
+            };
+            const timer = setTimeout(done, ms);
+            child.once('exit', done);
+            child.once('error', done);
+        });
+        await waitForExit(100);
+        try {
+            if (!childExited) {
+                child.kill();
+                await waitForExit(1000);
+            }
+            if (!childExited) {
+                child.kill('SIGKILL');
+                await waitForExit(1000);
+            }
+        }
+        catch {
+            throw new AccountLoginWriterActiveError();
+        }
+        if (!childExited)
+            throw new AccountLoginWriterActiveError();
+    };
+    const abort = async () => {
+        if (provider === 'codex')
+            await stopCodexChild();
+        else
+            child.kill();
         discardPendingLogin(provider, begin.loginId);
         emitStatus(opts, { state: 'failed', error: 'Account login aborted.' });
         return { success: false, error: 'Account login aborted.' };
     };
-    while (true) {
-        if (opts.signal?.aborted)
-            return abort();
-        const status = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
-        if (status.state === 'authenticated') {
-            return finalizeAccountLoginAsync(provider, begin.loginId, {
-                activate: opts.activate ?? true,
-            });
-        }
-        if (childExited) {
-            if (childState.spawnError) {
-                const error = `Could not spawn account login: ${childState.spawnError.message}`;
-                discardPendingLogin(provider, begin.loginId);
-                emitStatus(opts, { state: 'failed', error });
-                return { success: false, error };
-            }
-            const finalStatus = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
-            if (finalStatus.state === 'authenticated') {
-                return finalizeAccountLoginAsync(provider, begin.loginId, {
+    try {
+        while (true) {
+            if (opts.signal?.aborted)
+                return await abort();
+            const status = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
+            if (status.state === 'authenticated') {
+                await stopCodexChild();
+                return await finalizeAccountLoginAsync(provider, begin.loginId, {
                     activate: opts.activate ?? true,
                 });
             }
-            discardPendingLogin(provider, begin.loginId);
-            emitStatus(opts, {
-                state: 'failed',
-                error: `Account login exited before authentication completed${childExitCode === null ? '.' : ` (exit ${childExitCode}).`}`,
-            });
-            return { success: false, error: 'Account login did not complete.' };
-        }
-        const now = Date.now();
-        const mtime = latestHomeActivity(begin.configDir);
-        if (mtime > lastSeenMtime) {
-            lastSeenMtime = mtime;
-            lastActivity = now;
-        }
-        const remainingMs = Math.min(inactivityMs - (now - lastActivity), maxMs - (now - startedAt));
-        if (remainingMs <= 0) {
-            child.kill();
-            discardPendingLogin(provider, begin.loginId);
-            emitStatus(opts, { state: 'failed', error: 'Account login timed out.' });
-            return { success: false, error: 'Account login timed out.' };
+            if (childExited) {
+                if (childState.spawnError) {
+                    const error = `Could not spawn account login: ${childState.spawnError.message}`;
+                    discardPendingLogin(provider, begin.loginId);
+                    emitStatus(opts, { state: 'failed', error });
+                    return { success: false, error };
+                }
+                const finalStatus = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
+                if (finalStatus.state === 'authenticated') {
+                    await stopCodexChild();
+                    return await finalizeAccountLoginAsync(provider, begin.loginId, {
+                        activate: opts.activate ?? true,
+                    });
+                }
+                discardPendingLogin(provider, begin.loginId);
+                emitStatus(opts, {
+                    state: 'failed',
+                    error: `Account login exited before authentication completed${childExitCode === null ? '.' : ` (exit ${childExitCode}).`}`,
+                });
+                return { success: false, error: 'Account login did not complete.' };
+            }
+            const now = Date.now();
+            const mtime = latestHomeActivity(begin.configDir);
+            if (mtime > lastSeenMtime) {
+                lastSeenMtime = mtime;
+                lastActivity = now;
+            }
+            const remainingMs = Math.min(inactivityMs - (now - lastActivity), maxMs - (now - startedAt));
+            if (remainingMs <= 0) {
+                if (provider === 'codex')
+                    await stopCodexChild();
+                else
+                    child.kill();
+                discardPendingLogin(provider, begin.loginId);
+                emitStatus(opts, { state: 'failed', error: 'Account login timed out.' });
+                return { success: false, error: 'Account login timed out.' };
+            }
+            const shouldContinue = await waitForNextPoll(Math.min(2_000, remainingMs), opts.signal);
+            if (!shouldContinue)
+                return await abort();
         }
-        const shouldContinue = await waitForNextPoll(Math.min(2_000, remainingMs), opts.signal);
-        if (!shouldContinue)
-            return abort();
+    }
+    finally {
+        await stopCodexChild();
     }
 }
 function switchAccount(provider, id, options = {}) {

package/dist/accountSync.d.ts

@@ -12,11 +12,6 @@ export interface SyncLiveAccountStateOptions {
     keychainFoldIntervalMs?: number;
     now?: number;
 }
-/**
- * Reconcile the live logins with the saved profiles for both providers.
- * Safe to call from watchers: re-entrant calls return an empty report, and
- * `onlyIfChanged` short-circuits when the live files are unchanged.
- */
 export declare function syncLiveAccountStateSync(options?: SyncLiveAccountStateOptions): SyncReport;
 /** Promise-returning twin of {@link syncLiveAccountStateSync} for async hosts. */
 export declare function syncLiveAccountState(options?: SyncLiveAccountStateOptions): Promise<SyncReport>;
@@ -28,3 +23,4 @@ export interface CleanupAbandonedLoginsResult {
 }
 /** Remove isolated login homes that never authenticated (both providers). */
 export declare function cleanupAbandonedLogins(olderThanMs?: number, now?: number): CleanupAbandonedLoginsResult;
+export declare function cleanupAbandonedLoginsAsync(olderThanMs?: number, now?: number): Promise<CleanupAbandonedLoginsResult>;