sidekick-shared 0.27.4 → 0.27.6

package/dist/codexProfiles.js

@@ -35,6 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CODEX_KEYRING_FIX_HINT = exports.getCodexCredentialStoreMode = exports.getSystemCodexHome = exports.getCodexProfileHome = exports.getCodexProfilesDir = void 0;
 exports.getCodexMonitoringHomes = getCodexMonitoringHomes;
+exports.readStoredCodexAccount = readStoredCodexAccount;
+exports.isLiveCodexProfile = isLiveCodexProfile;
+exports.storeCodexProfileAuthUnlocked = storeCodexProfileAuthUnlocked;
 exports.storeCodexProfileAuth = storeCodexProfileAuth;
 exports.parseCodexLoginStatusOutput = parseCodexLoginStatusOutput;
 exports.getCodexLoginStatus = getCodexLoginStatus;
@@ -50,18 +53,26 @@ exports.resolveActiveCodexAccount = resolveActiveCodexAccount;
 exports.getCodexExecutionEnv = getCodexExecutionEnv;
 exports.prepareCodexAccount = prepareCodexAccount;
 exports.prepareCodexAccountAsync = prepareCodexAccountAsync;
+exports.discardCodexLogin = discardCodexLogin;
 exports.finalizeCodexAccount = finalizeCodexAccount;
 exports.finalizeCodexAccountAsync = finalizeCodexAccountAsync;
 exports.withCodexAuthSwapLock = withCodexAuthSwapLock;
 exports.dedupeCodexProfiles = dedupeCodexProfiles;
+exports.hasPendingCodexRepair = hasPendingCodexRepair;
 exports.syncCodexLiveStateUnlocked = syncCodexLiveStateUnlocked;
 exports.syncCodexLiveState = syncCodexLiveState;
+exports.syncCodexLiveStateAsync = syncCodexLiveStateAsync;
 exports.cleanupAbandonedCodexLogins = cleanupAbandonedCodexLogins;
 exports.switchToCodexAccount = switchToCodexAccount;
 exports.switchToCodexAccountAsync = switchToCodexAccountAsync;
 exports.reconcileCodexAuthState = reconcileCodexAuthState;
 exports.reconcileCodexAuthStateAsync = reconcileCodexAuthStateAsync;
+exports.getCodexKeepAliveBlocker = getCodexKeepAliveBlocker;
+exports.beginCodexKeepAlive = beginCodexKeepAlive;
+exports.finishCodexKeepAlive = finishCodexKeepAlive;
+exports.restoreCodexProfileFromBackup = restoreCodexProfileFromBackup;
 exports.removeCodexAccount = removeCodexAccount;
+exports.cleanupAbandonedCodexLoginsAsync = cleanupAbandonedCodexLoginsAsync;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
@@ -78,6 +89,9 @@ const accountSwitch_1 = require("./accountSwitch");
 const accountSyncTypes_1 = require("./accountSyncTypes");
 const processDetection_1 = require("./processDetection");
 const quotaSnapshots_1 = require("./quotaSnapshots");
+const accountLease_1 = require("./accountLease");
+const liveCredentialGuard_1 = require("./liveCredentialGuard");
+const codexCredentialStore_1 = require("./codexCredentialStore");
 var codexPaths_2 = require("./codexPaths");
 Object.defineProperty(exports, "getCodexProfilesDir", { enumerable: true, get: function () { return codexPaths_2.getCodexProfilesDir; } });
 Object.defineProperty(exports, "getCodexProfileHome", { enumerable: true, get: function () { return codexPaths_2.getCodexProfileHome; } });
@@ -113,22 +127,16 @@ function getCodexMonitoringHomes() {
 }
 function readPendingProfile(profileId) {
     try {
-        return JSON.parse(fs.readFileSync((0, codexPaths_1.getCodexProfileStatePath)(profileId), 'utf8'));
+        return JSON.parse(fs.readFileSync((0, codexPaths_1.getCodexLoginStatePath)(profileId), 'utf8'));
     }
     catch {
         return null;
     }
 }
 function writePendingProfile(profileId, pending) {
-    (0, codexPaths_1.ensureCodexProfileDirs)(profileId);
-    (0, atomic_1.atomicWriteJsonSync)((0, codexPaths_1.getCodexProfileStatePath)(profileId), pending);
-}
-function copyIfExists(source, destination) {
-    if (!fs.existsSync(source))
-        return false;
-    fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
-    fs.copyFileSync(source, destination);
-    return true;
+    const dir = (0, codexPaths_1.getCodexLoginDir)(profileId);
+    fs.mkdirSync(path.join(dir, 'codex-home'), { recursive: true, mode: 0o700 });
+    (0, atomic_1.atomicWriteJsonSync)(path.join(dir, 'profile.json'), pending);
 }
 /**
  * Copy the live `config.toml` into a profile home, forcing file-based
@@ -139,24 +147,143 @@ function copySourceCodexConfig(sourceHome, targetHome) {
     const source = (0, codexPaths_1.readFileOrNull)(path.join(sourceHome, 'config.toml')) ?? '';
     (0, atomic_1.atomicWriteFileSync)(path.join(targetHome, 'config.toml'), (0, codexPaths_1.forceFileCredentialStore)(source));
 }
-function importCurrentCodexAuth(sourceHome, targetHome) {
-    const authCopied = copyIfExists(path.join(sourceHome, 'auth.json'), path.join(targetHome, 'auth.json'));
-    const legacyCredsCopied = copyIfExists(path.join(sourceHome, '.credentials.json'), path.join(targetHome, '.credentials.json'));
-    return authCopied || legacyCredsCopied;
+/** Read the freshest saved login without creating a CLI-usable copy. */
+function readStoredCodexAccount(profileId) {
+    const home = (0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(profileId));
+    const backup = (0, codexCredentialStore_1.readCodexBackup)(profileId);
+    if (home.status === 'ok' && backup.status === 'ok') {
+        return (0, codexCredentialStore_1.codexLoginOnly)((0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, home.snapshot.authRaw) > 0
+            ? backup.snapshot
+            : home.snapshot);
+    }
+    return home.status === 'ok'
+        ? (0, codexCredentialStore_1.codexLoginOnly)(home.snapshot)
+        : backup.status === 'ok'
+            ? backup.snapshot
+            : null;
+}
+function profileMatchesSnapshot(profile, snapshot) {
+    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(snapshot.authRaw);
+    if ((0, codexAuth_1.identitiesMatch)(identity, profileIdentity(profile)))
+        return true;
+    // API keys have no account claims. Match their complete credential bytes, never the active pointer.
+    if (identity?.authMode === 'api-key' ||
+        (!snapshot.authRaw && (0, codexCredentialStore_1.isLegacyCodexLogin)(snapshot.legacyRaw))) {
+        const saved = readStoredCodexAccount(profile.id);
+        return (saved !== null &&
+            (0, codexCredentialStore_1.codexSnapshotFingerprint)((0, codexCredentialStore_1.codexLoginOnly)(snapshot)) === (0, codexCredentialStore_1.codexSnapshotFingerprint)(saved));
+    }
+    return false;
+}
+function isLiveCodexProfile(profile) {
+    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    return live.status === 'ok' && profileMatchesSnapshot(profile, live.snapshot);
+}
+/** Caller holds the swap lock. Live-account credentials only enter private storage. */
+function storeCodexProfileAuthUnlocked(profileId, authRaw, legacyRaw, source) {
+    const candidate = (0, codexCredentialStore_1.codexLoginOnly)({ authRaw, legacyRaw });
+    const profile = listCodexAccounts().find((p) => p.id === profileId);
+    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(authRaw);
+    if (profile &&
+        identity?.authMode === 'chatgpt' &&
+        (identity.email || identity.workspaceId) &&
+        (profile.email || profile.metadata?.workspaceId) &&
+        !(0, codexAuth_1.identitiesMatch)(identity, profileIdentity(profile))) {
+        throw new Error('The Codex credential belongs to a different saved account.');
+    }
+    const old = (0, codexCredentialStore_1.readCodexBackup)(profileId);
+    const chosen = old.status === 'ok' && (0, codexAuth_1.compareCodexAuthFreshness)(old.snapshot.authRaw, authRaw) > 0
+        ? old.snapshot
+        : candidate;
+    (0, codexCredentialStore_1.writeCodexBackup)(profileId, chosen);
+    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    const sameLink = live.status === 'ok' &&
+        (0, codexAuth_1.codexRefreshFingerprint)(chosen.authRaw) !== null &&
+        (0, codexAuth_1.codexRefreshFingerprint)(chosen.authRaw) === (0, codexAuth_1.codexRefreshFingerprint)(live.snapshot.authRaw);
+    const isLive = live.status === 'ok' &&
+        (profile
+            ? profileMatchesSnapshot(profile, live.snapshot)
+            : (0, codexAuth_1.identitiesMatch)((0, codexAuth_1.readAuthIdentityFromRaw)(chosen.authRaw), (0, codexAuth_1.readAuthIdentityFromRaw)(live.snapshot.authRaw)));
+    if (!(0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)()) &&
+        live.status !== 'error' &&
+        live.status !== 'corrupt' &&
+        !isLive &&
+        !sameLink) {
+        (0, codexCredentialStore_1.writeInactiveCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(profileId), chosen);
+    }
+    if (chosen.authRaw)
+        (0, accountHealth_1.writeCodexHealthSidecar)(profileId, chosen.authRaw, source);
 }
-/**
- * The single chokepoint for storing a Codex credential in a profile: the raw
- * `auth.json` bytes (never re-serialized), the legacy `.credentials.json`
- * when present, and the secret-free health sidecar.
- */
 function storeCodexProfileAuth(profileId, authRaw, legacyRaw, source) {
-    const profileHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
-    if (authRaw)
-        (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, 'auth.json'), authRaw);
-    if (legacyRaw)
-        (0, atomic_1.atomicWriteFileSync)(path.join(profileHome, '.credentials.json'), legacyRaw);
-    if (authRaw)
-        (0, accountHealth_1.writeCodexHealthSidecar)(profileId, authRaw, source);
+    withCodexAuthSwapLock(() => storeCodexProfileAuthUnlocked(profileId, authRaw, legacyRaw, source));
+}
+function consumerBlocker(scan) {
+    if (!scan?.ok)
+        return 'Could not verify that Codex consumers are stopped; retry after closing Codex.';
+    if (scan.consumers.length)
+        return 'Close running Codex CLI, app, and IDE sessions before changing credentials. --force cannot bypass this check.';
+    return null;
+}
+/** The sole installer of live Codex credentials, including rollback and repair. */
+function installIntoLiveCodexStore(candidate, accountId, intent, context) {
+    if ((0, accountLease_1.isAccountLeaseHeld)('codex', accountId))
+        return { ok: false, reason: 'Keep-alive holds this account; retry when it finishes.' };
+    const blocker = consumerBlocker(context.scan);
+    if (blocker)
+        return { ok: false, reason: blocker };
+    const mode = (0, codexPaths_1.getCodexCredentialStoreMode)();
+    if (mode !== 'file' && mode !== 'unknown')
+        return { ok: false, reason: exports.CODEX_KEYRING_FIX_HINT };
+    if ((0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)()))
+        return { ok: false, reason: 'Unset CODEX_HOME; it points at a Sidekick-owned home.' };
+    const current = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (context.before.status === 'error' || !(0, codexCredentialStore_1.codexStoreMatches)(current, context.before.snapshot)) {
+        return { ok: false, reason: 'The live Codex credential changed; nothing was overwritten.' };
+    }
+    const raw = current.status === 'ok' ? current.snapshot.authRaw : null;
+    const fp = (0, codexAuth_1.codexRefreshFingerprint)(raw);
+    const candidateIdentity = (0, codexAuth_1.readAuthIdentityFromRaw)(candidate.authRaw);
+    const candidateProfile = listCodexAccounts().find((p) => p.id === accountId);
+    const validIdentity = candidateIdentity?.authMode !== 'chatgpt' ||
+        (candidateProfile !== undefined &&
+            (0, codexAuth_1.identitiesMatch)(candidateIdentity, profileIdentity(candidateProfile)));
+    const decision = (0, liveCredentialGuard_1.decideLiveCredentialWrite)({
+        provider: 'Codex',
+        intent,
+        liveStatus: current.status,
+        candidateValid: validIdentity && ((0, codexCredentialStore_1.isCodexLogin)(candidate.authRaw) || (0, codexCredentialStore_1.isLegacyCodexLogin)(candidate.legacyRaw)),
+        liveHasCredential: current.status === 'ok',
+        liveAccountId: context.liveAccountId,
+        candidateAccountId: accountId,
+        sameLink: fp !== null && fp === (0, codexAuth_1.codexRefreshFingerprint)(candidate.authRaw),
+        strictlyNewer: (0, codexAuth_1.compareCodexAuthFreshness)(candidate.authRaw, raw) > 0,
+        capturedOutgoing: context.capturedOutgoing,
+        matchesWritten: context.written !== undefined && (0, codexCredentialStore_1.codexStoreMatches)(current, context.written),
+        rejectCorrupt: true,
+    });
+    if (!decision.allow)
+        return { ok: false, reason: decision.reason };
+    if (current.status === 'error')
+        return { ok: false, reason: 'The live Codex login could not be read.' };
+    let expected;
+    try {
+        expected = (0, codexCredentialStore_1.codexInstalledSnapshot)(current.snapshot, candidate);
+    }
+    catch {
+        return {
+            ok: false,
+            reason: 'Legacy credentials would replace unrelated MCP data; sign in again.',
+        };
+    }
+    try {
+        (0, codexCredentialStore_1.writeLiveCodexCredentialStoreUnguarded)(expected);
+        if (!(0, codexCredentialStore_1.codexStoreMatches)((0, codexCredentialStore_1.readCodexCredentialStore)(), expected))
+            throw new Error('verification failed');
+        return { ok: true, installed: expected };
+    }
+    catch {
+        return { ok: false, reason: 'The live Codex write did not verify.', attempted: expected };
+    }
 }
 function readMetadataFromAuthJson(codexHome) {
     const identity = (0, codexAuth_1.readAuthIdentityFromRaw)((0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')));
@@ -212,7 +339,7 @@ function getCodexLoginStatus(codexHome) {
             timeout: PROBE_TIMEOUT_MS,
             killSignal: 'SIGKILL',
         });
-        return parseCodexLoginStatusOutput(result.status, String(result.stdout ?? ''));
+        return parseCodexLoginStatusOutput(result.status, `${String(result.stdout ?? '')}\n${String(result.stderr ?? '')}`);
     }
     catch {
         // Ignore missing CLI or spawn errors.
@@ -223,9 +350,11 @@ function getCodexLoginStatusAsync(codexHome) {
     return new Promise((resolve) => {
         try {
             const env = { ...process.env, CODEX_HOME: codexHome };
-            (0, child_process_1.execFile)('codex', ['login', 'status'], { encoding: 'utf8', env, timeout: PROBE_TIMEOUT_MS, killSignal: 'SIGKILL' }, (error, stdout) => {
+            (0, child_process_1.execFile)('codex', ['login', 'status'], { encoding: 'utf8', env, timeout: PROBE_TIMEOUT_MS, killSignal: 'SIGKILL' }, (error, stdout, stderr) => {
                 // A missing CLI, non-zero exit, or timeout all mean "not logged in".
-                resolve(error ? { loggedIn: false } : parseCodexLoginStatusOutput(0, String(stdout ?? '')));
+                resolve(error
+                    ? { loggedIn: false }
+                    : parseCodexLoginStatusOutput(0, `${String(stdout ?? '')}\n${String(stderr ?? '')}`));
             });
         }
         catch {
@@ -258,15 +387,13 @@ async function readCodexAccountMetadataAsync(codexHome) {
         metadataFromLoginStatus(await getCodexLoginStatusAsync(codexHome)));
 }
 function hasCodexCredentialFiles(codexHome) {
-    return (fs.existsSync(path.join(codexHome, 'auth.json')) ||
-        fs.existsSync(path.join(codexHome, '.credentials.json')));
+    return (0, codexCredentialStore_1.readCodexCredentialStore)(codexHome).status === 'ok';
 }
 function isCodexProfileAuthenticated(codexHome) {
-    return hasCodexCredentialFiles(codexHome) || getCodexLoginStatus(codexHome).loggedIn;
+    return hasCodexCredentialFiles(codexHome);
 }
-/** {@link isCodexProfileAuthenticated} without blocking the event loop on the CLI probe. */
 async function isCodexProfileAuthenticatedAsync(codexHome) {
-    return hasCodexCredentialFiles(codexHome) || (await getCodexLoginStatusAsync(codexHome)).loggedIn;
+    return isCodexProfileAuthenticated(codexHome);
 }
 function ensureUniqueCodexLabel(label, excludeId) {
     const normalized = label.trim().toLowerCase();
@@ -350,220 +477,190 @@ function getCodexExecutionEnv(baseEnv = process.env) {
         CODEX_HOME: resolveSidekickCodexHome(),
     };
 }
+// ── Prepare / finalize (add account) ─────────────────────────────────────
 function keyringRefusal(mode) {
     return {
         success: false,
         needsLogin: false,
-        error: `Codex stores credentials in the OS keyring (cli_auth_credentials_store = "${mode}"); sidekick can only switch file-based logins. ${exports.CODEX_KEYRING_FIX_HINT}`,
+        error: `Codex credential storage (${mode}) is not file-based. ${exports.CODEX_KEYRING_FIX_HINT}`,
     };
 }
-function prepareCodexAccountCore(label) {
+function prepareCodexAccountCore(label, importCurrent, scan) {
     const trimmedLabel = label.trim();
-    if (!trimmedLabel) {
-        return { result: { success: false, error: 'Codex accounts require a non-empty label.' } };
-    }
+    if (!trimmedLabel)
+        return { success: false, error: 'Codex accounts require a non-empty label.' };
     const labelError = ensureUniqueCodexLabel(trimmedLabel);
-    if (labelError) {
-        return { result: { success: false, error: labelError } };
-    }
+    if (labelError)
+        return { success: false, error: labelError };
     const sourceHome = (0, codexPaths_1.getSystemCodexHome)();
-    const storeMode = (0, codexPaths_1.getCodexCredentialStoreMode)(sourceHome);
-    const liveAuthPresent = hasCodexCredentialFiles(sourceHome);
-    if (storeMode === 'keyring' || (storeMode === 'auto' && !liveAuthPresent)) {
-        return { result: keyringRefusal(storeMode) };
-    }
-    const profileId = (0, crypto_1.randomUUID)();
-    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
-    (0, codexPaths_1.ensureCodexProfileDirs)(profileId);
-    writePendingProfile(profileId, {
-        label: trimmedLabel,
-        addedAt: new Date().toISOString(),
-    });
-    copySourceCodexConfig(sourceHome, codexHome);
-    const imported = importCurrentCodexAuth(sourceHome, codexHome);
-    if (imported) {
-        // The live login may already be saved under another profile: fold into it
-        // instead of creating a duplicate seat.
-        const identity = (0, codexAuth_1.readAuthIdentityFromRaw)((0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')));
-        const existing = identity
-            ? findProfileForIdentity(identity, { fallbackToActive: false })
-            : null;
-        if (existing) {
-            try {
-                const liveRefresh = (0, codexAuth_1.readLastRefresh)((0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')));
-                const storedRefresh = (0, codexAuth_1.readLastRefresh)((0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getCodexProfileHome)(existing.id), 'auth.json')));
-                const storedIsNewer = storedRefresh !== null && liveRefresh !== null && storedRefresh > liveRefresh;
-                if (!storedIsNewer) {
-                    storeCodexProfileAuth(existing.id, (0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json')), (0, codexPaths_1.readFileOrNull)(path.join(codexHome, '.credentials.json')), 'login');
-                }
-            }
-            catch {
-                /* the existing backup stays as it was */
-            }
-            fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
-            const relabel = existing.metadata?.origin === 'live-sync' && existing.label === existing.email
-                ? {
-                    ...existing,
-                    label: trimmedLabel,
-                    metadata: { ...existing.metadata, origin: 'manual' },
-                }
-                : existing;
-            if (relabel !== existing)
-                (0, accountRegistry_1.upsertSavedAccountProfile)(relabel);
+    const mode = (0, codexPaths_1.getCodexCredentialStoreMode)(sourceHome);
+    if (mode !== 'file' && mode !== 'unknown')
+        return keyringRefusal(mode);
+    if ((0, codexCredentialStore_1.isSidekickCodexHome)(sourceHome))
+        return {
+            success: false,
+            error: 'Unset CODEX_HOME before adding an account; it names a Sidekick-owned home.',
+        };
+    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (importCurrent && live.status === 'ok') {
+        const sync = syncCodexLiveStateUnlocked('live-sync', { scan });
+        const profile = listCodexAccounts().find((p) => profileMatchesSnapshot(p, live.snapshot));
+        if (!profile)
             return {
-                result: {
-                    success: true,
-                    profileId: existing.id,
-                    codexHome: (0, codexPaths_1.getCodexProfileHome)(existing.id),
-                    needsLogin: false,
-                    warning: `This Codex login is already saved as "${relabel.label ?? existing.email ?? existing.id}".`,
-                },
+                success: false,
+                error: sync.warnings[0] ?? 'The live Codex login has no identifiable account.',
             };
-        }
-        return { finalize: { profileId, codexHome } };
+        const manual = profile.metadata?.origin === 'live-sync' || profile.label === profile.email;
+        if (manual)
+            (0, accountRegistry_1.upsertSavedAccountProfile)({
+                ...profile,
+                label: trimmedLabel,
+                metadata: { ...profile.metadata, origin: 'manual' },
+            });
+        return {
+            success: true,
+            profileId: profile.id,
+            codexHome: sourceHome,
+            needsLogin: false,
+            warning: sync.warnings.join(' ') ||
+                (!sync.registered
+                    ? `This Codex login is already saved as ${profile.label ?? profile.id}.`
+                    : undefined),
+        };
+    }
+    if (importCurrent && (live.status === 'corrupt' || live.status === 'error')) {
+        return {
+            success: false,
+            error: 'The live Codex credential could not be read; retry after Codex finishes writing it.',
+        };
+    }
+    const profileId = (0, crypto_1.randomUUID)();
+    try {
+        writePendingProfile(profileId, { label: trimmedLabel, addedAt: new Date().toISOString() });
+        const codexHome = (0, codexPaths_1.getCodexLoginHome)(profileId);
+        copySourceCodexConfig(sourceHome, codexHome);
+        return { success: true, profileId, codexHome, needsLogin: true };
+    }
+    catch {
+        discardCodexLogin(profileId);
+        return { success: false, error: 'Could not prepare the isolated Codex login.' };
     }
-    return { result: { success: true, profileId, codexHome, needsLogin: true } };
 }
-function prepareCodexAccount(label) {
-    const step = prepareCodexAccountCore(label);
-    if ('finalize' in step) {
-        const finalized = finalizeCodexAccount(step.finalize.profileId);
-        return { ...finalized, ...step.finalize, needsLogin: false };
+/** Legacy callers can import current; explicit sign-in passes importCurrent: false. */
+function prepareCodexAccount(label, options = {}) {
+    const scan = options.importCurrent === false ? undefined : (0, processDetection_1.inspectRunningAccountConsumersSync)('codex');
+    try {
+        return withCodexAuthSwapLock(() => prepareCodexAccountCore(label, options.importCurrent ?? true, scan));
+    }
+    catch {
+        return { success: false, error: 'Could not acquire the Codex account-switch lock.' };
+    }
+}
+async function prepareCodexAccountAsync(label, options = {}) {
+    const scan = options.importCurrent === false ? undefined : await (0, processDetection_1.inspectRunningAccountConsumers)('codex');
+    try {
+        return withCodexAuthSwapLock(() => prepareCodexAccountCore(label, options.importCurrent ?? true, scan));
+    }
+    catch {
+        return { success: false, error: 'Could not acquire the Codex account-switch lock.' };
     }
-    return step.result;
 }
-/** {@link prepareCodexAccount} without blocking the event loop on CLI probes. */
-async function prepareCodexAccountAsync(label) {
-    const step = prepareCodexAccountCore(label);
-    if ('finalize' in step) {
-        const finalized = await finalizeCodexAccountAsync(step.finalize.profileId);
-        return { ...finalized, ...step.finalize, needsLogin: false };
+/** Removes only a pending login, never a registered canonical profile. */
+function discardCodexLogin(id) {
+    fs.rmSync((0, codexPaths_1.getCodexLoginDir)(id), { recursive: true, force: true });
+    if (!listCodexAccounts().some((p) => p.id === id) &&
+        fs.existsSync((0, codexPaths_1.getCodexProfileStatePath)(id))) {
+        fs.rmSync((0, codexPaths_1.getCodexProfileDir)(id), { recursive: true, force: true });
     }
-    return step.result;
 }
-function finalizeCodexAccountCore(profileId, opts, probes) {
+function finalizeCodexAccountCore(profileId, opts, scan) {
     const pending = readPendingProfile(profileId);
     if (!pending) {
-        // Already finalized: `prepareCodexAccount` folds a live login that is
-        // already saved into its profile and reports `needsLogin: false`, and the
-        // login flow then finalizes that profile id. Activate it if asked.
-        const saved = listCodexAccounts().find((profile) => profile.id === profileId);
-        if (!saved) {
-            return { result: { success: false, error: `Codex profile ${profileId} was not prepared.` } };
-        }
-        if (opts.activate === false)
-            return { result: { success: true, profileId } };
-        return { swap: saved };
-    }
-    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
-    if (!probes.authenticated) {
-        return { result: { success: false, error: 'Codex profile is not authenticated yet.' } };
-    }
-    // A fresh isolated login for an account that is already saved: fold into the
-    // existing profile rather than registering a second seat.
-    const authRaw = (0, codexPaths_1.readFileOrNull)(path.join(codexHome, 'auth.json'));
-    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(authRaw);
-    const existing = identity ? findProfileForIdentity(identity, { fallbackToActive: false }) : null;
-    if (existing && existing.id !== profileId) {
-        storeCodexProfileAuth(existing.id, authRaw, (0, codexPaths_1.readFileOrNull)(path.join(codexHome, '.credentials.json')), 'login');
-        fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
-        const merged = {
-            ...existing,
-            label: existing.metadata?.origin === 'live-sync' ? pending.label : existing.label,
-            email: probes.metadata.email ?? existing.email,
-            metadata: { ...existing.metadata, ...probes.metadata, origin: 'login' },
+        const saved = listCodexAccounts().find((p) => p.id === profileId);
+        if (!saved)
+            return { success: false, error: `Codex profile ${profileId} was not prepared.` };
+        return opts.activate === false
+            ? { success: true, profileId }
+            : performCodexAuthSwapCore(saved, {}, { scan });
+    }
+    const home = (0, codexPaths_1.getCodexLoginHome)(profileId);
+    const read = (0, codexCredentialStore_1.readCodexCredentialStore)(home);
+    if (read.status !== 'ok')
+        return {
+            success: false,
+            error: 'Codex profile is not authenticated with readable file credentials yet.',
         };
-        (0, accountRegistry_1.upsertSavedAccountProfile)(merged);
-        if (opts.activate === false)
-            return { result: { success: true, profileId: existing.id } };
-        return { swap: merged };
-    }
+    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(read.snapshot.authRaw);
+    const metadata = readCodexAccountMetadataFromFiles(home) ?? {};
+    const existing = identity ? findProfileForIdentity(identity, { fallbackToActive: false }) : null;
+    // Legacy pending homes must not become a saved profile before their credential is moved out.
+    const id = existing?.id ?? (home === (0, codexPaths_1.getCodexProfileHome)(profileId) ? (0, crypto_1.randomUUID)() : profileId);
     const profile = {
-        id: profileId,
+        ...existing,
+        id,
         providerId: 'codex',
-        label: pending.label,
-        email: probes.metadata.email,
-        addedAt: pending.addedAt,
-        metadata: { ...probes.metadata, origin: 'login' },
+        label: existing?.label ?? pending.label,
+        email: metadata.email ?? existing?.email,
+        addedAt: existing?.addedAt ?? pending.addedAt,
+        metadata: { ...existing?.metadata, ...metadata, origin: 'login' },
     };
-    (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
-    if (authRaw)
-        (0, accountHealth_1.writeCodexHealthSidecar)(profileId, authRaw, 'login');
     try {
-        fs.rmSync((0, codexPaths_1.getCodexProfileStatePath)(profileId), { force: true });
+        // Preserve first. No successful sign-in is lost if activation is blocked.
+        const previous = (0, codexCredentialStore_1.readCodexBackup)(id);
+        (0, codexCredentialStore_1.writeCodexBackup)(id, previous.status === 'ok' &&
+            (0, codexAuth_1.compareCodexAuthFreshness)(previous.snapshot.authRaw, read.snapshot.authRaw) > 0
+            ? previous.snapshot
+            : read.snapshot);
+        (0, codexCredentialStore_1.removeCodexProfileCredentials)(home, read.snapshot);
+        (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
+        (0, codexPaths_1.ensureCodexProfileDirs)(id);
+        copySourceCodexConfig(home, (0, codexPaths_1.getCodexProfileHome)(id));
+        storeCodexProfileAuthUnlocked(id, read.snapshot.authRaw, read.snapshot.legacyRaw, 'login');
     }
     catch {
-        /* the pending marker is advisory */
-    }
-    if (opts.activate === false) {
-        return { result: { success: true, profileId } };
-    }
-    if (!hasCodexCredentialFiles(codexHome)) {
-        // Authenticated via the OS keyring — there are no credential files to
-        // swap, so the registry pointer is all we can update.
-        (0, accountRegistry_1.setActiveSavedAccount)('codex', profileId);
         return {
-            result: {
-                success: true,
-                profileId,
-                warning: `Codex stores credentials in the OS keyring; sidekick cannot swap them per account, so \`codex\` keeps using the keyring credentials. ${exports.CODEX_KEYRING_FIX_HINT}`,
-            },
+            success: false,
+            profileId: id,
+            error: 'Could not finish saving the Codex login; any verified private backup was kept.',
         };
     }
-    return { swap: profile };
+    finally {
+        discardCodexLogin(profileId);
+    }
+    if (opts.activate === false)
+        return { success: true, profileId: id };
+    const result = performCodexAuthSwapCore(profile, {}, { scan });
+    return result.success
+        ? { ...result, profileId: id }
+        : {
+            ...result,
+            profileId: id,
+            needsLogin: false,
+            error: `The login was saved, but could not be activated: ${result.error}`,
+        };
 }
 function finalizeCodexAccount(profileId, opts = {}) {
-    if (!readPendingProfile(profileId)) {
-        // Already finalized: the core activates a saved profile without probing.
-        const step = finalizeCodexAccountCore(profileId, opts, { authenticated: false, metadata: {} });
-        return 'swap' in step ? performCodexAuthSwap(step.swap, {}) : step.result;
-    }
-    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
-    const authenticated = isCodexProfileAuthenticated(codexHome);
-    const step = finalizeCodexAccountCore(profileId, opts, {
-        authenticated,
-        metadata: authenticated ? readCodexAccountMetadata(codexHome) : {},
-    });
-    return 'swap' in step ? performCodexAuthSwap(step.swap, {}) : step.result;
+    const scan = (0, processDetection_1.inspectRunningAccountConsumersSync)('codex');
+    try {
+        return withCodexAuthSwapLock(() => finalizeCodexAccountCore(profileId, opts, scan));
+    }
+    catch {
+        return { success: false, error: 'Could not finalize the Codex login.' };
+    }
 }
-/** {@link finalizeCodexAccount} without blocking the event loop on CLI probes. */
 async function finalizeCodexAccountAsync(profileId, opts = {}) {
-    if (!readPendingProfile(profileId)) {
-        // Already finalized: the core activates a saved profile without probing.
-        const step = finalizeCodexAccountCore(profileId, opts, { authenticated: false, metadata: {} });
-        return 'swap' in step ? performCodexAuthSwapAsync(step.swap, {}) : step.result;
-    }
-    const codexHome = (0, codexPaths_1.getCodexProfileHome)(profileId);
-    const authenticated = await isCodexProfileAuthenticatedAsync(codexHome);
-    const step = finalizeCodexAccountCore(profileId, opts, {
-        authenticated,
-        metadata: authenticated ? await readCodexAccountMetadataAsync(codexHome) : {},
-    });
-    return 'swap' in step ? performCodexAuthSwapAsync(step.swap, {}) : step.result;
-}
-// ── Stash / identity matching ────────────────────────────────────────────
-function getCodexStashDir() {
-    return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'stash');
-}
-function stashLiveCodexAuth(liveAuthRaw, liveLegacyRaw) {
+    const scan = await (0, processDetection_1.inspectRunningAccountConsumers)('codex');
     try {
-        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-        let stashPath = null;
-        if (liveAuthRaw) {
-            stashPath = path.join(getCodexStashDir(), `auth-${stamp}.json`);
-            (0, atomic_1.atomicWriteFileSync)(stashPath, liveAuthRaw);
-        }
-        if (liveLegacyRaw) {
-            const legacyStashPath = path.join(getCodexStashDir(), `credentials-${stamp}.json`);
-            (0, atomic_1.atomicWriteFileSync)(legacyStashPath, liveLegacyRaw);
-            stashPath = stashPath ?? legacyStashPath;
-        }
-        return stashPath;
+        return withCodexAuthSwapLock(() => finalizeCodexAccountCore(profileId, opts, scan));
     }
     catch {
-        return null;
+        return { success: false, error: 'Could not finalize the Codex login.' };
     }
 }
+// ── Stash / identity matching ────────────────────────────────────────────
+function getCodexStashDir() {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'stash');
+}
 function findProfileForIdentity(identity, options = {}) {
     const profiles = listCodexAccounts();
     if (identity?.workspaceId) {
@@ -572,7 +669,8 @@ function findProfileForIdentity(identity, options = {}) {
             return byWorkspace;
     }
     if (identity?.email) {
-        const byEmail = profiles.find((profile) => (profile.email ?? profile.metadata?.email) === identity.email);
+        const byEmail = profiles.find((profile) => (profile.email ?? profile.metadata?.email) === identity.email &&
+            (!identity.workspaceId || !profile.metadata?.workspaceId));
         if (byEmail)
             return byEmail;
     }
@@ -597,468 +695,485 @@ function withCodexAuthSwapLock(operation) {
     fs.mkdirSync(lockDir, { recursive: true, mode: 0o700 });
     return (0, atomic_1.withFileLockSync)(path.join(lockDir, 'auth-swap.lock'), operation);
 }
-/**
- * Merge duplicate Codex profiles (same workspace, else same email). The oldest
- * profile keeps its id and label, receives the freshest `auth.json` and the
- * quota snapshot, and the active pointer; losers are stashed, never deleted.
- * Returns the removed ids. Caller holds the swap lock.
- */
-function dedupeCodexProfiles() {
+/** Merge owned profiles only after preserving their newest login in a verified backup. */
+function dedupeCodexProfiles(scan) {
+    if (consumerBlocker(scan))
+        return [];
     const removed = [];
-    const profiles = listCodexAccounts();
     const groups = new Map();
-    for (const profile of profiles) {
+    for (const profile of listCodexAccounts()) {
         const key = profile.metadata?.workspaceId
             ? `ws:${profile.metadata.workspaceId}`
-            : (profile.email ?? profile.metadata?.email)
-                ? `email:${profile.email ?? profile.metadata?.email}`
+            : profile.email
+                ? `email:${profile.email}`
                 : `id:${profile.id}`;
         groups.set(key, [...(groups.get(key) ?? []), profile]);
     }
     for (const group of groups.values()) {
-        if (group.length < 2)
+        if (group.length < 2 || group.some((p) => (0, accountLease_1.isAccountLeaseHeld)('codex', p.id)))
             continue;
         const sorted = [...group].sort((a, b) => Date.parse(a.addedAt) - Date.parse(b.addedAt));
         const keeper = sorted[0];
-        const keeperAuthPath = path.join((0, codexPaths_1.getCodexProfileHome)(keeper.id), 'auth.json');
-        let freshestRaw = (0, codexPaths_1.readFileOrNull)(keeperAuthPath);
-        let freshestAt = (0, codexAuth_1.readLastRefresh)(freshestRaw, keeperAuthPath) ?? -1;
-        const activeId = (0, accountRegistry_1.getActiveSavedAccount)('codex')?.id;
+        let freshest = readStoredCodexAccount(keeper.id);
+        for (const p of sorted.slice(1)) {
+            const candidate = readStoredCodexAccount(p.id);
+            if (candidate &&
+                (!freshest || (0, codexAuth_1.compareCodexAuthFreshness)(candidate.authRaw, freshest.authRaw) > 0))
+                freshest = candidate;
+        }
+        if (!freshest)
+            continue;
+        (0, codexCredentialStore_1.writeCodexBackup)(keeper.id, freshest);
         for (const loser of sorted.slice(1)) {
-            const loserAuthPath = path.join((0, codexPaths_1.getCodexProfileHome)(loser.id), 'auth.json');
-            const loserRaw = (0, codexPaths_1.readFileOrNull)(loserAuthPath);
-            const loserAt = (0, codexAuth_1.readLastRefresh)(loserRaw, loserAuthPath) ?? -1;
-            if (loserRaw && loserAt > freshestAt) {
-                freshestRaw = loserRaw;
-                freshestAt = loserAt;
-            }
-            try {
-                if (!(0, quotaSnapshots_1.readQuotaSnapshot)('codex', keeper.id)) {
-                    const snapshot = (0, quotaSnapshots_1.readQuotaSnapshot)('codex', loser.id);
-                    if (snapshot)
-                        (0, quotaSnapshots_1.writeQuotaSnapshot)('codex', keeper.id, snapshot);
-                }
-            }
-            catch {
-                /* quota re-key is best-effort */
-            }
-            try {
-                const stashDir = path.join(getCodexStashDir(), `dup-${loser.id}-${new Date().toISOString().replace(/[:.]/g, '-')}`);
-                fs.mkdirSync(path.dirname(stashDir), { recursive: true, mode: 0o700 });
-                fs.renameSync((0, codexPaths_1.getCodexProfileDir)(loser.id), stashDir);
-            }
-            catch {
-                fs.rmSync((0, codexPaths_1.getCodexProfileDir)(loser.id), { recursive: true, force: true });
-            }
+            const store = (0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(loser.id));
+            if (store.status === 'error' || store.status === 'corrupt')
+                continue;
+            if (store.status === 'ok')
+                (0, codexCredentialStore_1.removeCodexProfileCredentials)((0, codexPaths_1.getCodexProfileHome)(loser.id), store.snapshot);
+            const snapshot = (0, quotaSnapshots_1.readQuotaSnapshot)('codex', loser.id);
+            if (snapshot && !(0, quotaSnapshots_1.readQuotaSnapshot)('codex', keeper.id))
+                (0, quotaSnapshots_1.writeQuotaSnapshot)('codex', keeper.id, snapshot);
+            const archive = path.join(getCodexStashDir(), `dup-${loser.id}`);
+            fs.mkdirSync(path.dirname(archive), { recursive: true, mode: 0o700 });
+            if (fs.existsSync((0, codexPaths_1.getCodexProfileDir)(loser.id)))
+                fs.renameSync((0, codexPaths_1.getCodexProfileDir)(loser.id), archive);
+            if ((0, accountRegistry_1.getActiveSavedAccount)('codex')?.id === loser.id)
+                (0, accountRegistry_1.setActiveSavedAccount)('codex', keeper.id, { silent: true });
             (0, accountRegistry_1.removeSavedAccountProfile)('codex', loser.id);
+            fs.rmSync((0, codexPaths_1.getCodexBackupPath)(loser.id), { force: true });
+            fs.rmSync((0, codexPaths_1.getCodexBackupPath)(loser.id, true), { force: true });
             removed.push(loser.id);
-            if (activeId === loser.id)
-                (0, accountRegistry_1.setActiveSavedAccount)('codex', keeper.id, { silent: true });
-        }
-        if (freshestRaw && freshestRaw !== (0, codexPaths_1.readFileOrNull)(keeperAuthPath)) {
-            storeCodexProfileAuth(keeper.id, freshestRaw, null, 'migration');
         }
-        const metadata = readCodexAccountMetadataFromFiles((0, codexPaths_1.getCodexProfileHome)(keeper.id)) ?? {};
-        (0, accountRegistry_1.upsertSavedAccountProfile)({
-            ...keeper,
-            email: metadata.email ?? keeper.email,
-            metadata: { ...keeper.metadata, ...metadata },
-        });
+        storeCodexProfileAuthUnlocked(keeper.id, freshest.authRaw, freshest.legacyRaw, 'migration');
     }
     return removed;
 }
-/**
- * Fold the live `auth.json` into the saved profiles: register an unknown login
- * (label = email), refresh the matching profile's backup when the live file is
- * newer, and re-point the active pointer at it. Caller holds the swap lock.
- * Never throws; problems land in `warnings`.
- */
+function codexJournalPath() {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'switch-journal.json');
+}
+function loginHash(snapshot) {
+    return (0, codexCredentialStore_1.codexSnapshotFingerprint)((0, codexCredentialStore_1.codexLoginOnly)(snapshot));
+}
+function clearCodexJournal() {
+    fs.rmSync(codexJournalPath(), { force: true });
+}
+function hasPendingCodexRepair() {
+    if (fs.existsSync(codexJournalPath()))
+        return true;
+    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (live.status === 'error' || live.status === 'corrupt')
+        return true;
+    if (live.status !== 'ok')
+        return false;
+    return listCodexAccounts().some((p) => {
+        if (!profileMatchesSnapshot(p, live.snapshot))
+            return false;
+        const home = (0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(p.id));
+        const backup = (0, codexCredentialStore_1.readCodexBackup)(p.id);
+        return (home.status !== 'absent' ||
+            (backup.status === 'ok' &&
+                (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, live.snapshot.authRaw) > 0));
+    });
+}
+function resolveCodexJournal(report, scan) {
+    if (!fs.existsSync(codexJournalPath()))
+        return;
+    let journal;
+    try {
+        journal = JSON.parse(fs.readFileSync(codexJournalPath(), 'utf8'));
+        if (!journal.to || !journal.fromHash || !journal.toHash)
+            throw new Error();
+    }
+    catch {
+        report.warnings.push('The Codex switch journal is unreadable; run accounts doctor.');
+        return;
+    }
+    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (live.status === 'error' || live.status === 'corrupt') {
+        report.warnings.push('An interrupted Codex switch is pending; the live login could not be read.');
+        return;
+    }
+    const blocker = consumerBlocker(scan);
+    if (blocker) {
+        report.warnings.push(blocker);
+        return;
+    }
+    const hash = loginHash(live.snapshot);
+    const to = listCodexAccounts().find((p) => p.id === journal.to);
+    if (hash === journal.toHash ||
+        (live.status === 'ok' && to && profileMatchesSnapshot(to, live.snapshot))) {
+        if (live.status !== 'ok')
+            return;
+        (0, codexCredentialStore_1.writeCodexBackup)(journal.to, live.snapshot);
+        const target = (0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(journal.to));
+        if (target.status === 'error' || target.status === 'corrupt')
+            throw new Error('The interrupted switch target is unreadable.');
+        if (target.status === 'ok')
+            (0, codexCredentialStore_1.removeCodexProfileCredentials)((0, codexPaths_1.getCodexProfileHome)(journal.to), target.snapshot);
+        if (journal.from) {
+            const backup = (0, codexCredentialStore_1.readCodexBackup)(journal.from);
+            if (backup.status === 'ok' && loginHash(backup.snapshot) === journal.fromHash) {
+                if ((0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(journal.from)).status === 'absent')
+                    (0, codexCredentialStore_1.writeInactiveCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(journal.from), backup.snapshot);
+                (0, accountHealth_1.writeCodexHealthSidecar)(journal.from, backup.snapshot.authRaw, 'switch');
+            }
+        }
+        (0, accountRegistry_1.setActiveSavedAccount)('codex', journal.to, { silent: true });
+        report.journal = 'finished';
+    }
+    else if (hash === journal.fromHash) {
+        const target = (0, codexCredentialStore_1.readCodexBackup)(journal.to);
+        if (target.status === 'ok' && loginHash(target.snapshot) === journal.toHash) {
+            if ((0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(journal.to)).status === 'absent')
+                (0, codexCredentialStore_1.writeInactiveCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(journal.to), target.snapshot);
+        }
+        if (journal.from) {
+            const outgoing = (0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(journal.from));
+            if (outgoing.status === 'ok')
+                (0, codexCredentialStore_1.removeCodexProfileCredentials)((0, codexPaths_1.getCodexProfileHome)(journal.from), outgoing.snapshot);
+        }
+        (0, accountRegistry_1.setActiveSavedAccount)('codex', journal.from, { silent: true });
+        report.journal = 'rolled-back';
+    }
+    else {
+        report.journal = 'cleared';
+        report.warnings.push('The live Codex login matches neither side of the interrupted switch; it was kept. Private backups are available for inspection.');
+    }
+    clearCodexJournal();
+}
+/** No subprocesses inside this function: hosts resolve process scans before taking the lock. */
 function syncCodexLiveStateUnlocked(source = 'live-sync', probes = {}) {
     const report = (0, accountSyncTypes_1.emptyProviderSyncReport)();
     try {
-        const merged = dedupeCodexProfiles();
+        const mode = (0, codexPaths_1.getCodexCredentialStoreMode)();
+        if (mode !== 'file' && mode !== 'unknown') {
+            report.skipped = 'keyring';
+            report.warnings.push(exports.CODEX_KEYRING_FIX_HINT);
+            return report;
+        }
+        if ((0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)())) {
+            report.skipped = 'managed-home';
+            report.warnings.push('Unset CODEX_HOME before syncing; it points at a Sidekick-owned home.');
+            return report;
+        }
+        resolveCodexJournal(report, probes.scan);
+        let live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+        if (live.status === 'error' || live.status === 'corrupt') {
+            report.skipped = 'unreadable';
+            report.warnings.push('The live Codex login could not be read; nothing was replaced.');
+            return report;
+        }
+        if (live.status === 'absent') {
+            report.skipped = 'logged-out';
+            return report;
+        }
+        const merged = dedupeCodexProfiles(probes.scan);
         if (merged.length)
             report.merged = merged;
-        const systemHome = (0, codexPaths_1.getSystemCodexHome)();
-        const liveAuthPath = path.join(systemHome, 'auth.json');
-        const liveAuthRaw = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
-        const liveLegacyRaw = (0, codexPaths_1.readFileOrNull)(path.join(systemHome, '.credentials.json'));
-        if (!liveAuthRaw && !liveLegacyRaw) {
-            const mode = (0, codexPaths_1.getCodexCredentialStoreMode)(systemHome);
-            if (probes.systemKeyringLoggedIn || mode === 'keyring' || mode === 'auto') {
-                report.skipped = 'keyring';
-                report.warnings.push(`Codex keeps its login in the OS keyring; sidekick cannot switch it. ${exports.CODEX_KEYRING_FIX_HINT}`);
-            }
-            else {
-                report.skipped = 'logged-out';
+        const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(live.snapshot.authRaw);
+        const initialSnapshot = live.snapshot;
+        let profile = listCodexAccounts().find((p) => profileMatchesSnapshot(p, initialSnapshot));
+        if (!profile) {
+            if (!identity?.email &&
+                !identity?.workspaceId &&
+                identity?.authMode !== 'api-key' &&
+                !(0, codexCredentialStore_1.isLegacyCodexLogin)(live.snapshot.legacyRaw)) {
+                report.skipped = 'no-identity';
+                return report;
             }
-            return report;
-        }
-        const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(liveAuthRaw);
-        let profile = findProfileForIdentity(identity, { fallbackToActive: false });
-        if (!profile && identity && (identity.email || identity.workspaceId)) {
-            const profileId = (0, crypto_1.randomUUID)();
             profile = {
-                id: profileId,
+                id: (0, crypto_1.randomUUID)(),
                 providerId: 'codex',
-                label: identity.email ?? identity.workspaceId,
-                email: identity.email,
+                label: identity?.email ?? identity?.workspaceId ?? 'Codex API key',
+                email: identity?.email,
                 addedAt: new Date().toISOString(),
-                metadata: {
-                    email: identity.email,
-                    workspaceId: identity.workspaceId,
-                    planType: identity.planType,
-                    authMode: identity.authMode,
-                    origin: 'live-sync',
-                },
+                metadata: { ...identity, authMode: identity?.authMode ?? 'api-key', origin: 'live-sync' },
             };
-            (0, codexPaths_1.ensureCodexProfileDirs)(profileId);
-            copySourceCodexConfig(systemHome, (0, codexPaths_1.getCodexProfileHome)(profileId));
+            // API-key identities require their verified bytes before registry matching can work.
+            (0, codexCredentialStore_1.writeCodexBackup)(profile.id, live.snapshot);
             (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
-            report.registered = { id: profileId, email: identity.email };
+            report.registered = { id: profile.id, email: profile.email };
         }
-        else if (!profile) {
-            // API-key auth or an unparseable token: fold into the active profile
-            // only when it is itself an api-key login; otherwise stash.
-            const active = getActiveCodexAccount();
-            if (active && active.metadata?.authMode === 'api-key') {
-                profile = active;
+        const home = (0, codexPaths_1.getCodexProfileHome)(profile.id);
+        (0, codexPaths_1.ensureCodexProfileDirs)(profile.id);
+        if (!fs.existsSync(path.join(home, 'config.toml')))
+            copySourceCodexConfig((0, codexPaths_1.getSystemCodexHome)(), home);
+        const duplicate = (0, codexCredentialStore_1.readCodexCredentialStore)(home);
+        const stored = readStoredCodexAccount(profile.id);
+        if (stored && (0, codexAuth_1.compareCodexAuthFreshness)(stored.authRaw, live.snapshot.authRaw) > 0) {
+            const install = installIntoLiveCodexStore(stored, profile.id, 'repair', {
+                before: live,
+                liveAccountId: profile.id,
+                scan: probes.scan,
+            });
+            if (install.ok) {
+                live = { status: 'ok', snapshot: install.installed };
+                report.repaired = profile.id;
             }
             else {
-                report.skipped = 'no-identity';
-                return report;
+                report.warnings.push(`A newer Codex login is saved privately; repair is pending. ${install.reason}`);
             }
         }
-        // Codex rotates the refresh token in place, so for the same identity the
-        // live file is the freshest copy unless the profile was refreshed on its
-        // own (keep-alive, isolated launch) and both files say when.
-        const profileAuthPath = path.join((0, codexPaths_1.getCodexProfileHome)(profile.id), 'auth.json');
-        const storedRaw = (0, codexPaths_1.readFileOrNull)(profileAuthPath);
-        const storedRefresh = (0, codexAuth_1.readLastRefresh)(storedRaw);
-        const liveRefresh = (0, codexAuth_1.readLastRefresh)(liveAuthRaw);
-        const storedIsNewer = storedRefresh !== null && liveRefresh !== null && storedRefresh > liveRefresh;
-        const newer = liveAuthRaw !== storedRaw && !storedIsNewer;
-        if (newer) {
-            try {
-                storeCodexProfileAuth(profile.id, liveAuthRaw, liveLegacyRaw, source);
-                const metadata = readCodexAccountMetadataFromFiles((0, codexPaths_1.getCodexProfileHome)(profile.id)) ?? {};
-                (0, accountRegistry_1.upsertSavedAccountProfile)({
-                    ...profile,
-                    email: metadata.email ?? profile.email,
-                    metadata: { ...profile.metadata, ...metadata },
-                });
-                report.folded = profile.id;
-            }
-            catch (err) {
-                report.warnings.push(`Could not back up the live Codex credentials: ${err}`);
+        const backup = (0, codexCredentialStore_1.readCodexBackup)(profile.id);
+        if (backup.status !== 'ok' ||
+            (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, live.snapshot.authRaw) <= 0) {
+            (0, codexCredentialStore_1.writeCodexBackup)(profile.id, live.snapshot);
+            report.folded = profile.id;
+        }
+        (0, accountHealth_1.writeCodexHealthSidecar)(profile.id, live.snapshot.authRaw, source);
+        if (duplicate.status === 'ok') {
+            const blocker = consumerBlocker(probes.scan);
+            // Preserve a newer copy even when its promotion must wait.
+            if ((0, codexAuth_1.compareCodexAuthFreshness)(duplicate.snapshot.authRaw, live.snapshot.authRaw) > 0)
+                (0, codexCredentialStore_1.writeCodexBackup)(profile.id, duplicate.snapshot);
+            if (blocker || (0, accountLease_1.isAccountLeaseHeld)('codex', profile.id))
+                report.warnings.push(blocker ?? 'The profile is leased; duplicate cleanup is pending.');
+            else {
+                (0, codexCredentialStore_1.removeCodexProfileCredentials)(home, duplicate.snapshot);
+                report.demoted = profile.id;
             }
         }
-        const active = (0, accountRegistry_1.getActiveSavedAccount)('codex');
-        if (!active || active.id !== profile.id) {
+        else if (duplicate.status === 'corrupt' || duplicate.status === 'error') {
+            report.warnings.push('The live account has an unreadable profile credential; run accounts doctor.');
+        }
+        if ((0, accountRegistry_1.getActiveSavedAccount)('codex')?.id !== profile.id) {
             (0, accountRegistry_1.setActiveSavedAccount)('codex', profile.id, { silent: true });
             report.repointed = profile.id;
         }
     }
-    catch (err) {
-        report.warnings.push(`Codex account sync failed: ${err}`);
+    catch {
+        report.warnings.push('Codex account sync could not finish; verified credentials were preserved for the next retry.');
     }
     return report;
 }
-/** {@link syncCodexLiveStateUnlocked} under the swap lock. */
 function syncCodexLiveState(source = 'live-sync') {
+    const scan = (0, processDetection_1.inspectRunningAccountConsumersSync)('codex');
     try {
-        return withCodexAuthSwapLock(() => syncCodexLiveStateUnlocked(source));
+        return withCodexAuthSwapLock(() => syncCodexLiveStateUnlocked(source, { scan }));
     }
-    catch (err) {
-        return { warnings: [`Could not acquire the account-switch lock: ${err}`] };
+    catch {
+        return { warnings: ['Could not acquire the Codex account-switch lock.'] };
     }
 }
-/**
- * Remove isolated login homes that never authenticated once they are older
- * than `olderThanMs`. Returns the removed profile ids.
- */
-function cleanupAbandonedCodexLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Date.now()) {
-    const removed = [];
-    let entries = [];
+async function syncCodexLiveStateAsync(source = 'live-sync') {
+    const scan = await (0, processDetection_1.inspectRunningAccountConsumers)('codex');
     try {
-        entries = fs.readdirSync((0, codexPaths_1.getCodexProfilesDir)());
+        return withCodexAuthSwapLock(() => syncCodexLiveStateUnlocked(source, { scan }));
     }
     catch {
-        return removed;
+        return { warnings: ['Could not acquire the Codex account-switch lock.'] };
     }
-    const registered = new Set(listCodexAccounts().map((p) => p.id));
-    for (const profileId of entries) {
-        if (registered.has(profileId))
-            continue;
-        const pending = readPendingProfile(profileId);
-        if (!pending)
-            continue;
-        if (hasCodexCredentialFiles((0, codexPaths_1.getCodexProfileHome)(profileId)))
-            continue;
-        const addedAt = Date.parse(pending.addedAt);
-        const age = Number.isNaN(addedAt) ? Number.POSITIVE_INFINITY : now - addedAt;
-        if (age < olderThanMs)
-            continue;
-        try {
-            fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
-            removed.push(profileId);
-        }
-        catch {
-            /* best effort */
+}
+/** Only abandoned Sidekick-owned login homes; authenticated copies are preserved privately first. */
+function cleanupAbandonedCodexLogins(olderThanMs = 24 * 60 * 60 * 1000, now = Date.now(), scan) {
+    const removed = [];
+    if (consumerBlocker(scan ?? (0, processDetection_1.inspectRunningAccountConsumersSync)('codex')))
+        return removed;
+    withCodexAuthSwapLock(() => {
+        for (const root of [(0, codexPaths_1.getCodexLoginsDir)(), (0, codexPaths_1.getCodexProfilesDir)()]) {
+            if (!fs.existsSync(root))
+                continue;
+            for (const id of fs.readdirSync(root)) {
+                if (listCodexAccounts().some((p) => p.id === id))
+                    continue;
+                const pending = readPendingProfile(id);
+                if (!pending || now - Date.parse(pending.addedAt) < olderThanMs)
+                    continue;
+                const home = (0, codexPaths_1.getCodexLoginHome)(id);
+                const read = (0, codexCredentialStore_1.readCodexCredentialStore)(home);
+                if (read.status === 'error' || read.status === 'corrupt')
+                    continue;
+                if (read.status === 'ok') {
+                    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(read.snapshot.authRaw);
+                    const owner = identity
+                        ? findProfileForIdentity(identity, { fallbackToActive: false })
+                        : null;
+                    if (!owner)
+                        continue; // An unregistered authenticated login needs a human decision.
+                    const saved = readStoredCodexAccount(owner.id);
+                    (0, codexCredentialStore_1.writeCodexBackup)(owner.id, saved && (0, codexAuth_1.compareCodexAuthFreshness)(saved.authRaw, read.snapshot.authRaw) >= 0
+                        ? saved
+                        : read.snapshot);
+                }
+                discardCodexLogin(id);
+                removed.push(id);
+            }
         }
-    }
+    });
     return removed;
 }
-/**
- * CLI probes are resolved before the auth-swap lock is taken — never spawn a
- * child process while holding it. The keyring probe is skipped (false) when
- * live credential files exist, because the swap only consults it in their
- * absence.
- */
-function resolveCodexSwapProbesSync() {
-    const systemHome = (0, codexPaths_1.getSystemCodexHome)();
-    return {
-        consumers: (0, processDetection_1.detectRunningAccountConsumersSync)('codex'),
-        systemKeyringLoggedIn: hasCodexCredentialFiles(systemHome)
-            ? false
-            : getCodexLoginStatus(systemHome).loggedIn,
-    };
-}
-async function resolveCodexSwapProbesAsync() {
-    const systemHome = (0, codexPaths_1.getSystemCodexHome)();
-    return {
-        consumers: await (0, processDetection_1.detectRunningAccountConsumers)('codex'),
-        systemKeyringLoggedIn: hasCodexCredentialFiles(systemHome)
-            ? false
-            : (await getCodexLoginStatusAsync(systemHome)).loggedIn,
-    };
-}
-function performCodexAuthSwap(target, options) {
-    const probes = resolveCodexSwapProbesSync();
-    try {
-        return withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, options, probes));
-    }
-    catch (err) {
-        // Keep the non-throwing result contract when the lock cannot be acquired.
-        return (0, accountSwitch_1.switchFailure)('codex', target.id, `Could not acquire the account-switch lock: ${err}`);
-    }
-}
-async function performCodexAuthSwapAsync(target, options) {
-    const probes = await resolveCodexSwapProbesAsync();
-    let result;
-    try {
-        // The sync lock is fine here: probes are pre-resolved, so the critical
-        // section is only fast local-filesystem work.
-        result = withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, options, probes));
-    }
-    catch (err) {
-        return (0, accountSwitch_1.switchFailure)('codex', target.id, `Could not acquire the account-switch lock: ${err}`);
-    }
-    if (result.success && options.verifyWithCli && !result.alreadyActive) {
-        const status = await getCodexLoginStatusAsync((0, codexPaths_1.getSystemCodexHome)());
-        result = status.loggedIn
-            ? { ...result, verification: 'cli' }
-            : (0, accountSwitch_1.finishSwitchResult)({
-                ...result,
-                warnings: [
-                    ...result.warnings,
-                    '`codex login status` reports "Not logged in" after the switch; the stored token may have been revoked. Sign in again if codex prompts you.',
-                ],
-            });
-    }
-    return result;
-}
 function performCodexAuthSwapCore(target, options, probes) {
-    const systemHome = (0, codexPaths_1.getSystemCodexHome)();
-    const liveAuthPath = path.join(systemHome, 'auth.json');
-    const liveLegacyPath = path.join(systemHome, '.credentials.json');
-    const targetName = target.label ?? target.email ?? target.id;
-    let previousAccountId = (0, accountRegistry_1.getActiveSavedAccount)('codex')?.id ?? null;
     const base = {
         success: true,
         provider: 'codex',
         accountId: target.id,
-        previousAccountId,
+        previousAccountId: (0, accountRegistry_1.getActiveSavedAccount)('codex')?.id ?? null,
         verified: false,
         verification: 'none',
         warnings: [],
         hints: [],
-        runningConsumers: probes.consumers,
+        runningConsumers: probes.scan.consumers,
         email: target.email ?? target.metadata?.email,
     };
-    const profilesDir = path.resolve((0, codexPaths_1.getCodexProfilesDir)());
-    const resolvedHome = path.resolve(systemHome);
-    if (resolvedHome === profilesDir || resolvedHome.startsWith(profilesDir + path.sep)) {
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            error: `CODEX_HOME points at a sidekick profile home (${systemHome}); unset it before switching accounts.`,
-        });
-    }
-    const liveBefore = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
-    const liveLegacyBefore = (0, codexPaths_1.readFileOrNull)(liveLegacyPath);
-    if (!liveBefore && !liveLegacyBefore && probes.systemKeyringLoggedIn) {
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            error: `Codex stores credentials in the OS keyring; file-based account switching is not supported. ${exports.CODEX_KEYRING_FIX_HINT}`,
-        });
-    }
-    // Phase 1: fold the live (freshest, rotated) credentials back into their
-    // profile, registering the login if sidekick has never seen it.
-    const sync = syncCodexLiveStateUnlocked('switch', {
-        systemKeyringLoggedIn: probes.systemKeyringLoggedIn,
-    });
-    base.warnings.push(...sync.warnings);
-    // Only now is the "previous" account known: the sync may have re-pointed or
-    // registered the login that was really live, and undo must return to it.
-    previousAccountId = (0, accountRegistry_1.getActiveSavedAccount)('codex')?.id ?? null;
-    base.previousAccountId = previousAccountId;
-    if (sync.skipped === 'no-identity' && liveBefore) {
-        const stashPath = stashLiveCodexAuth(liveBefore, liveLegacyBefore);
-        base.warnings.push(stashPath
-            ? `Live Codex credentials did not match any saved account; stashed at ${stashPath}.`
-            : 'Live Codex credentials did not match any saved account and could not be stashed.');
-    }
-    // Re-read after the sync: the target may have received the live file.
-    const liveAuthRaw = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
-    const liveLegacyRaw = (0, codexPaths_1.readFileOrNull)(liveLegacyPath);
-    const profileHome = (0, codexPaths_1.getCodexProfileHome)(target.id);
-    const targetAuthPath = path.join(profileHome, 'auth.json');
-    const targetAuthRaw = (0, codexPaths_1.readFileOrNull)(targetAuthPath);
-    const targetLegacyRaw = (0, codexPaths_1.readFileOrNull)(path.join(profileHome, '.credentials.json'));
-    if (!targetAuthRaw && !targetLegacyRaw) {
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            needsLogin: true,
-            error: `No stored credentials for "${targetName}". Sign in again to this account.`,
-        });
-    }
-    if (targetAuthRaw && !(0, codexAuth_1.parseAuthJson)(targetAuthRaw)) {
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            needsLogin: true,
-            error: `Stored credentials for "${targetName}" are corrupted. Sign in again to this account.`,
-        });
-    }
-    // If the live file already belongs to the target account it is the freshest
-    // copy (rotated refresh token included) — never replace it with a staler
-    // backup, which would permanently invalidate the login.
-    const liveIdentity = (0, codexAuth_1.readAuthIdentityFromRaw)(liveAuthRaw);
-    const liveMatchesTarget = Boolean((0, codexAuth_1.identitiesMatch)(liveIdentity, {
-        ...profileIdentity(target),
-        ...((0, codexAuth_1.readAuthIdentityFromRaw)(targetAuthRaw) ?? {}),
-    }) ||
-        (liveAuthRaw !== null && liveAuthRaw === targetAuthRaw) ||
-        (!liveAuthRaw && !targetAuthRaw && liveLegacyRaw !== null && liveLegacyRaw === targetLegacyRaw));
-    if (liveMatchesTarget) {
-        if (previousAccountId !== target.id)
-            (0, accountRegistry_1.setActiveSavedAccount)('codex', target.id);
+    const fail = (error, extra = {}) => (0, accountSwitch_1.finishSwitchResult)({ ...base, success: false, error, ...extra });
+    const mode = (0, codexPaths_1.getCodexCredentialStoreMode)();
+    if (mode !== 'file' && mode !== 'unknown')
+        return fail(exports.CODEX_KEYRING_FIX_HINT);
+    if ((0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)()))
+        return fail('CODEX_HOME points at a Sidekick-owned home; unset it before switching.');
+    let before = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (before.status === 'error' || before.status === 'corrupt')
+        return fail('The live Codex login could not be read; it was left untouched.');
+    const saved = readStoredCodexAccount(target.id);
+    if (before.status === 'ok' && profileMatchesSnapshot(target, before.snapshot)) {
+        if (saved && (0, codexAuth_1.compareCodexAuthFreshness)(saved.authRaw, before.snapshot.authRaw) > 0) {
+            const result = installIntoLiveCodexStore(saved, target.id, 'relogin', {
+                before,
+                liveAccountId: target.id,
+                scan: probes.scan,
+            });
+            if (!result.ok)
+                return fail(result.reason);
+        }
+        const sync = syncCodexLiveStateUnlocked('switch', probes);
         return (0, accountSwitch_1.finishSwitchResult)({
             ...base,
             alreadyActive: true,
             verified: true,
             verification: 'store',
+            warnings: sync.warnings,
             health: (0, accountHealth_1.getAccountHealth)('codex', target.id),
-            hints: [`${targetName} is already the active Codex account.`],
+            hints: ['That account is already the live Codex login.'],
         });
     }
-    // Preflight: warn about stale backups; refuse ones known to be dead.
+    const blocker = consumerBlocker(probes.scan);
+    if (blocker)
+        return fail(blocker);
+    if ((0, accountLease_1.isAccountLeaseHeld)('codex', target.id))
+        return fail('Keep-alive is refreshing this account; retry after it finishes.');
+    const sync = syncCodexLiveStateUnlocked('switch', probes);
+    base.warnings.push(...sync.warnings);
+    if (fs.existsSync(codexJournalPath()))
+        return fail('An interrupted Codex switch still needs recovery; run accounts doctor.');
+    before = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (before.status === 'error' || before.status === 'corrupt')
+        return fail('The live Codex credential could not be read.');
+    const beforeSnapshot = before.snapshot;
+    const outgoing = before.status === 'ok'
+        ? listCodexAccounts().find((p) => profileMatchesSnapshot(p, beforeSnapshot))
+        : null;
+    if (before.status === 'ok' && !outgoing)
+        return fail('The live login has no unambiguous account identity to save it under; sign in with Codex and retry.');
+    base.previousAccountId = outgoing?.id ?? null;
+    if (outgoing?.id === target.id)
+        return fail('The live account changed during the switch; retry.');
+    const targetHome = (0, codexPaths_1.getCodexProfileHome)(target.id);
+    const targetBefore = (0, codexCredentialStore_1.readCodexCredentialStore)(targetHome);
+    if (targetBefore.status === 'error' || targetBefore.status === 'corrupt')
+        return fail('The target profile is unreadable; the switch was deferred.');
+    const candidate = readStoredCodexAccount(target.id);
+    if (!candidate)
+        return fail('No readable stored credentials for this account; sign in again.', {
+            needsLogin: true,
+        });
+    const candidateIdentity = (0, codexAuth_1.readAuthIdentityFromRaw)(candidate.authRaw);
+    if (candidateIdentity?.authMode === 'chatgpt' &&
+        !(0, codexAuth_1.identitiesMatch)(candidateIdentity, profileIdentity(target))) {
+        return fail('The saved Codex credential does not belong to the selected account.');
+    }
+    const liveFp = (0, codexAuth_1.codexRefreshFingerprint)(beforeSnapshot.authRaw);
+    if (liveFp && liveFp === (0, codexAuth_1.codexRefreshFingerprint)(candidate.authRaw))
+        return fail('The target is another copy of the live refresh token; sign in again.');
     const health = (0, accountHealth_1.getAccountHealth)('codex', target.id, { probe: 'store' });
     base.health = health;
-    if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
+    if ((health.state === 'expired' || health.state === 'missing') && !options.force)
+        return fail('Stored credentials have expired or are missing; sign in again.', {
             needsLogin: true,
-            error: `Stored credentials for "${targetName}" have expired; sign in again.`,
+        });
+    const refreshed = (0, codexAuth_1.readLastRefresh)(candidate.authRaw);
+    if (refreshed !== null && Date.now() - refreshed > codexAuth_1.STALE_AUTH_THRESHOLD_MS)
+        base.warnings.push('The stored Codex login has not been refreshed in over 8 days.');
+    // Capture and verify both sides before removing either usable copy. Mandatory even with force.
+    try {
+        if (outgoing)
+            (0, codexCredentialStore_1.writeCodexBackup)(outgoing.id, beforeSnapshot);
+        (0, codexCredentialStore_1.writeCodexBackup)(target.id, candidate);
+        (0, atomic_1.atomicWriteJsonSync)(codexJournalPath(), {
+            from: outgoing?.id ?? null,
+            to: target.id,
+            fromHash: loginHash(beforeSnapshot),
+            toHash: loginHash(candidate),
+            at: new Date().toISOString(),
         });
     }
-    const targetLastRefresh = (0, codexAuth_1.readLastRefresh)(targetAuthRaw, targetAuthPath);
-    if (targetLastRefresh !== null && Date.now() - targetLastRefresh > codexAuth_1.STALE_AUTH_THRESHOLD_MS) {
-        base.warnings.push(`Stored credentials for "${targetName}" have not been refreshed in over 8 days; codex may ask you to log in again.`);
+    catch {
+        return fail('The outgoing login or switch journal could not be saved and verified; live was left untouched.');
+    }
+    if (!(0, codexCredentialStore_1.codexStoreMatches)((0, codexCredentialStore_1.readCodexCredentialStore)(), beforeSnapshot))
+        return fail('The live login changed after capture; the switch was deferred.');
+    const profileStore = (0, codexCredentialStore_1.readCodexCredentialStore)(targetHome);
+    if (!(0, codexCredentialStore_1.codexStoreMatches)(profileStore, targetBefore.snapshot))
+        return fail('The target credential changed after selection; the switch was deferred.');
+    if (profileStore.status === 'error' || profileStore.status === 'corrupt')
+        return fail('The target profile is unreadable; the switch was deferred.');
+    try {
+        if (profileStore.status === 'ok')
+            (0, codexCredentialStore_1.removeCodexProfileCredentials)(targetHome, profileStore.snapshot);
     }
-    const restoreLiveFiles = () => {
-        try {
-            if (liveAuthRaw)
-                (0, atomic_1.atomicWriteFileSync)(liveAuthPath, liveAuthRaw);
-            else
-                fs.rmSync(liveAuthPath, { force: true });
-            if (liveLegacyRaw)
-                (0, atomic_1.atomicWriteFileSync)(liveLegacyPath, liveLegacyRaw);
-            else
-                fs.rmSync(liveLegacyPath, { force: true });
-        }
-        catch {
-            /* rollback is best-effort */
+    catch {
+        return fail('The target copy could not be removed safely; the switch was deferred.');
+    }
+    const install = installIntoLiveCodexStore(candidate, target.id, 'switch', {
+        before,
+        liveAccountId: outgoing?.id ?? null,
+        capturedOutgoing: Boolean(outgoing),
+        scan: probes.scan,
+    });
+    const recover = (written) => {
+        if (written) {
+            installIntoLiveCodexStore(beforeSnapshot, outgoing?.id ?? target.id, 'rollback', {
+                before: (0, codexCredentialStore_1.readCodexCredentialStore)(),
+                liveAccountId: target.id,
+                written,
+                scan: probes.scan,
+            });
         }
+        // Journal reconciliation never overwrites live and never restores a copy of its identity.
+        resolveCodexJournal((0, accountSyncTypes_1.emptyProviderSyncReport)(), probes.scan);
+    };
+    if (!install.ok) {
         try {
-            (0, accountRegistry_1.setActiveSavedAccount)('codex', previousAccountId, { silent: true });
+            recover(install.attempted);
         }
         catch {
-            /* rollback is best-effort */
+            /* journal and private backups survive */
         }
-    };
-    // Install.
+        return fail(`${install.reason} Verified private backups were kept; run accounts doctor if recovery is pending.`, { verification: 'failed' });
+    }
     try {
-        if (targetAuthRaw) {
-            (0, atomic_1.atomicWriteFileSync)(liveAuthPath, targetAuthRaw);
-            if (targetLegacyRaw)
-                (0, atomic_1.atomicWriteFileSync)(liveLegacyPath, targetLegacyRaw);
-            else if (liveLegacyRaw)
-                fs.rmSync(liveLegacyPath, { force: true });
+        (0, accountRegistry_1.setActiveSavedAccount)('codex', target.id);
+    }
+    catch {
+        try {
+            recover(install.installed);
         }
-        else {
-            (0, atomic_1.atomicWriteFileSync)(liveLegacyPath, targetLegacyRaw);
-            if (liveAuthRaw)
-                fs.rmSync(liveAuthPath, { force: true });
+        catch {
+            /* journal survives */
         }
+        return fail('The account registry could not be updated; recovery retained the verified backups.');
     }
-    catch (err) {
-        restoreLiveFiles();
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            error: `Failed to write Codex credentials: ${err}`,
-        });
-    }
-    // Verify by re-reading the live file.
-    const installed = (0, codexPaths_1.readFileOrNull)(targetAuthRaw ? liveAuthPath : liveLegacyPath);
-    const expected = targetAuthRaw ?? targetLegacyRaw;
-    const installedIdentity = targetAuthRaw ? (0, codexAuth_1.readAuthIdentityFromRaw)(installed) : null;
-    const verified = installed === expected &&
-        (!targetAuthRaw ||
-            (0, codexAuth_1.identitiesMatch)(installedIdentity, {
-                ...profileIdentity(target),
-                ...((0, codexAuth_1.readAuthIdentityFromRaw)(targetAuthRaw) ?? {}),
-            }) ||
-            installedIdentity?.authMode === 'api-key');
-    if (!verified) {
-        restoreLiveFiles();
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            verification: 'failed',
-            error: `The live Codex credential file did not reflect the switch to "${targetName}"; the previous login was restored.`,
-        });
-    }
-    // Pointer last.
     try {
-        (0, accountRegistry_1.setActiveSavedAccount)('codex', target.id);
+        if (outgoing)
+            storeCodexProfileAuthUnlocked(outgoing.id, beforeSnapshot.authRaw, beforeSnapshot.legacyRaw, 'switch');
+        (0, accountHealth_1.writeCodexHealthSidecar)(target.id, candidate.authRaw, 'switch');
+        clearCodexJournal();
     }
-    catch (err) {
-        restoreLiveFiles();
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            error: `Failed to update account registry: ${err}`,
-        });
+    catch {
+        base.warnings.push('The live switch succeeded; profile cleanup is pending and will retry on sync.');
     }
     let undoToken;
     try {
-        undoToken = (0, accountSwitch_1.writeLastSwitch)('codex', previousAccountId, target.id).token;
+        undoToken = (0, accountSwitch_1.writeLastSwitch)('codex', outgoing?.id ?? null, target.id).token;
     }
     catch {
         base.warnings.push('The switch succeeded but could not be recorded for undo.');
@@ -1068,123 +1183,174 @@ function performCodexAuthSwapCore(target, options, probes) {
         verified: true,
         verification: 'store',
         undoToken,
-        hints: [`New codex sessions use ${target.email ?? targetName}.`],
+        hints: [`New Codex sessions use ${target.label ?? target.email ?? target.id}.`],
     });
 }
 function switchToCodexAccount(profileId, options = {}) {
-    const target = listCodexAccounts().find((account) => account.id === profileId);
-    if (!target) {
+    const target = listCodexAccounts().find((p) => p.id === profileId);
+    if (!target)
         return (0, accountSwitch_1.switchFailure)('codex', profileId, `Codex account ${profileId} not found.`);
+    const scan = (0, processDetection_1.inspectRunningAccountConsumersSync)('codex');
+    try {
+        return withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, options, { scan }));
+    }
+    catch {
+        return (0, accountSwitch_1.switchFailure)('codex', profileId, 'The Codex switch could not finish; private backups and any pending journal were kept.');
     }
-    return performCodexAuthSwap(target, options);
 }
-/** {@link switchToCodexAccount} without blocking the event loop on CLI probes. */
 async function switchToCodexAccountAsync(profileId, options = {}) {
-    const target = listCodexAccounts().find((account) => account.id === profileId);
-    if (!target) {
+    const target = listCodexAccounts().find((p) => p.id === profileId);
+    if (!target)
         return (0, accountSwitch_1.switchFailure)('codex', profileId, `Codex account ${profileId} not found.`);
+    const scan = await (0, processDetection_1.inspectRunningAccountConsumers)('codex');
+    let result;
+    try {
+        result = withCodexAuthSwapLock(() => performCodexAuthSwapCore(target, options, { scan }));
     }
-    return performCodexAuthSwapAsync(target, options);
-}
-// ── One-time migration ───────────────────────────────────────────────────
-/**
- * The reconcile flow consults the keyring probe only when the migration has
- * not run yet and the system home has no auth.json; skip the spawn otherwise.
- */
-function needsReconcileKeyringProbe() {
-    const markerPath = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', '.live-auth-migrated-v1');
-    if (fs.existsSync(markerPath))
-        return false;
-    return !fs.existsSync(path.join((0, codexPaths_1.getSystemCodexHome)(), 'auth.json'));
+    catch {
+        return (0, accountSwitch_1.switchFailure)('codex', profileId, 'The Codex switch could not finish; private backups and any pending journal were kept.');
+    }
+    if (result.success && options.verifyWithCli && !result.alreadyActive) {
+        const status = await getCodexLoginStatusAsync((0, codexPaths_1.getSystemCodexHome)());
+        if (status.loggedIn)
+            result.verification = 'cli';
+        else
+            result = (0, accountSwitch_1.finishSwitchResult)({
+                ...result,
+                warnings: [
+                    ...result.warnings,
+                    'Codex could not read the installed login; sign in again if prompted.',
+                ],
+            });
+    }
+    return result;
 }
-// One-time migration for installs created when profile homes doubled as live
-// CODEX_HOMEs: the active profile's auth.json may hold a fresher rotated
-// refresh token than the system home. Best-effort: never throws.
+/** Legacy migration entry points now use the same guarded reconciliation as ordinary sync. */
 function reconcileCodexAuthState() {
+    syncCodexLiveState('migration');
+}
+async function reconcileCodexAuthStateAsync() {
+    await syncCodexLiveStateAsync('migration');
+}
+function codexKeepAliveBlockerUnlocked(id) {
+    if ((0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)()))
+        return 'unset CODEX_HOME before managing accounts; it names a Sidekick-owned home';
+    const mode = (0, codexPaths_1.getCodexCredentialStoreMode)();
+    if (mode !== 'file' && mode !== 'unknown')
+        return 'live credential storage is not readable file mode';
+    const profile = listCodexAccounts().find((p) => p.id === id);
+    if (!profile)
+        return 'account not found';
+    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (live.status === 'error' || live.status === 'corrupt')
+        return 'the live login could not be read';
+    if (live.status === 'ok' && profileMatchesSnapshot(profile, live.snapshot))
+        return 'live account; the CLI refreshes it in normal use';
+    const store = (0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(id));
+    if (store.status !== 'ok')
+        return 'no readable profile copy to refresh (keep-alive never restores backups)';
+    const fp = (0, codexAuth_1.codexRefreshFingerprint)(store.snapshot.authRaw);
+    if (!fp)
+        return 'no refreshable ChatGPT login';
+    if (live.status === 'ok' && fp === (0, codexAuth_1.codexRefreshFingerprint)(live.snapshot.authRaw))
+        return 'same refresh token as the live login';
+    if ((0, accountHealth_1.readHealthSidecar)('codex', id)?.source === 'live-sync')
+        return 'copied from the live login; waits for a switch away from it';
+    const backup = (0, codexCredentialStore_1.readCodexBackup)(id);
+    if (backup.status === 'error' || backup.status === 'corrupt')
+        return 'its private backup could not be read';
+    if (backup.status === 'ok' &&
+        (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, store.snapshot.authRaw) > 0)
+        return 'its saved backup is newer than the profile copy';
+    return null;
+}
+function getCodexKeepAliveBlocker(id) {
     try {
-        const systemKeyringLoggedIn = needsReconcileKeyringProbe()
-            ? getCodexLoginStatus((0, codexPaths_1.getSystemCodexHome)()).loggedIn
-            : false;
-        withCodexAuthSwapLock(() => reconcileCodexAuthStateCore({ systemKeyringLoggedIn }));
+        return withCodexAuthSwapLock(() => codexKeepAliveBlockerUnlocked(id));
     }
     catch {
-        // Reconciliation must never break startup — including a lock timeout.
+        return 'could not acquire the account-switch lock';
     }
 }
-/** {@link reconcileCodexAuthState} without blocking the event loop on CLI probes. */
-async function reconcileCodexAuthStateAsync() {
+function beginCodexKeepAlive(id, leaseMs) {
     try {
-        const systemKeyringLoggedIn = needsReconcileKeyringProbe()
-            ? (await getCodexLoginStatusAsync((0, codexPaths_1.getSystemCodexHome)())).loggedIn
-            : false;
-        withCodexAuthSwapLock(() => reconcileCodexAuthStateCore({ systemKeyringLoggedIn }));
+        return withCodexAuthSwapLock(() => {
+            const reason = codexKeepAliveBlockerUnlocked(id);
+            if (reason)
+                return { ok: false, reason };
+            return (0, accountLease_1.acquireAccountLease)('codex', id, leaseMs)
+                ? { ok: true }
+                : { ok: false, reason: 'another keep-alive run holds this account' };
+        });
     }
     catch {
-        // Reconciliation must never break startup — including a lock timeout.
+        return { ok: false, reason: 'could not acquire the account-switch lock' };
     }
 }
-function reconcileCodexAuthStateCore(probes) {
+function finishCodexKeepAlive(id) {
     try {
-        const markerPath = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', '.live-auth-migrated-v1');
-        if (fs.existsSync(markerPath))
-            return;
-        const writeMarker = () => (0, atomic_1.atomicWriteFileSync)(markerPath, new Date().toISOString() + '\n');
-        const active = getActiveCodexAccount();
-        if (!active) {
-            writeMarker();
-            return;
-        }
-        const profileHome = (0, codexPaths_1.getCodexProfileHome)(active.id);
-        const profileAuthPath = path.join(profileHome, 'auth.json');
-        const profileAuthRaw = (0, codexPaths_1.readFileOrNull)(profileAuthPath);
-        if (!profileAuthRaw) {
-            writeMarker();
-            return;
-        }
-        const systemHome = (0, codexPaths_1.getSystemCodexHome)();
-        const liveAuthPath = path.join(systemHome, 'auth.json');
-        const liveAuthRaw = (0, codexPaths_1.readFileOrNull)(liveAuthPath);
-        if (!liveAuthRaw) {
-            // No live credentials (account was added via isolated login and never
-            // promoted). Promote the active profile's copy unless codex is logged
-            // in through the OS keyring. The probe was resolved before the swap
-            // lock was taken — never spawn while holding it.
-            if (!probes.systemKeyringLoggedIn) {
-                (0, atomic_1.atomicWriteFileSync)(liveAuthPath, profileAuthRaw);
-            }
-            writeMarker();
-            return;
-        }
-        const liveIdentity = (0, codexAuth_1.readAuthIdentityFromRaw)(liveAuthRaw);
-        const profileIdentityValue = (0, codexAuth_1.readAuthIdentityFromRaw)(profileAuthRaw);
-        const sameIdentity = (0, codexAuth_1.identitiesMatch)(liveIdentity, profileIdentityValue);
-        if (sameIdentity) {
-            const liveRefresh = (0, codexAuth_1.readLastRefresh)(liveAuthRaw, liveAuthPath);
-            const profileRefresh = (0, codexAuth_1.readLastRefresh)(profileAuthRaw, profileAuthPath);
-            if (profileRefresh !== null && (liveRefresh === null || profileRefresh > liveRefresh)) {
-                // The profile copy was the live home under the old model and holds
-                // the valid rotated refresh token — promote it.
-                stashLiveCodexAuth(liveAuthRaw, null);
-                (0, atomic_1.atomicWriteFileSync)(liveAuthPath, profileAuthRaw);
-            }
-            else {
-                storeCodexProfileAuth(active.id, liveAuthRaw, null, 'migration');
-            }
-        }
-        else {
-            // The live credentials belong to a different account; the live state
-            // wins — point the registry at the matching saved profile if there is
-            // one, and refresh its backup.
-            const matching = findProfileForIdentity(liveIdentity);
-            if (matching && matching.id !== active.id) {
-                storeCodexProfileAuth(matching.id, liveAuthRaw, null, 'migration');
-                (0, accountRegistry_1.setActiveSavedAccount)('codex', matching.id);
+        withCodexAuthSwapLock(() => {
+            const profile = listCodexAccounts().find((p) => p.id === id);
+            const store = (0, codexCredentialStore_1.readCodexCredentialStore)((0, codexPaths_1.getCodexProfileHome)(id));
+            if (!profile || isLiveCodexProfile(profile) || store.status !== 'ok')
+                return;
+            if (!(0, codexAuth_1.identitiesMatch)((0, codexAuth_1.readAuthIdentityFromRaw)(store.snapshot.authRaw), profileIdentity(profile)))
+                return;
+            const backup = (0, codexCredentialStore_1.readCodexBackup)(id);
+            if (backup.status === 'ok' &&
+                (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, store.snapshot.authRaw) > 0)
+                return;
+            (0, codexCredentialStore_1.writeCodexBackup)(id, store.snapshot);
+            (0, accountHealth_1.writeCodexHealthSidecar)(id, store.snapshot.authRaw, 'keepalive');
+        });
+    }
+    finally {
+        (0, accountLease_1.releaseAccountLease)('codex', id);
+    }
+}
+function restoreCodexProfileFromBackup(id, options = {}) {
+    try {
+        return withCodexAuthSwapLock(() => {
+            if ((0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)()))
+                return 'none';
+            const profile = listCodexAccounts().find((p) => p.id === id);
+            if (!profile)
+                return 'none';
+            const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+            if (live.status === 'error' || live.status === 'corrupt')
+                return 'none';
+            if (isLiveCodexProfile(profile))
+                return 'live';
+            const home = (0, codexPaths_1.getCodexProfileHome)(id);
+            const store = (0, codexCredentialStore_1.readCodexCredentialStore)(home);
+            if (store.status === 'ok') {
+                const fp = (0, codexAuth_1.codexRefreshFingerprint)(store.snapshot.authRaw);
+                if (fp && live.status === 'ok' && fp === (0, codexAuth_1.codexRefreshFingerprint)(live.snapshot.authRaw))
+                    return 'none';
+                if (!(0, codexAuth_1.identitiesMatch)((0, codexAuth_1.readAuthIdentityFromRaw)(store.snapshot.authRaw), profileIdentity(profile)) &&
+                    (0, codexAuth_1.readAuthIdentityFromRaw)(store.snapshot.authRaw)?.authMode !== 'api-key' &&
+                    !(0, codexCredentialStore_1.isLegacyCodexLogin)(store.snapshot.legacyRaw))
+                    return 'none';
+                const backup = (0, codexCredentialStore_1.readCodexBackup)(id);
+                if (backup.status === 'ok' &&
+                    (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, store.snapshot.authRaw) > 0)
+                    return 'none';
+                return 'present';
             }
-        }
-        writeMarker();
+            if (store.status !== 'absent' || options.restore === false)
+                return 'none';
+            const backup = (0, codexCredentialStore_1.readCodexBackup)(id);
+            if (backup.status !== 'ok')
+                return 'none';
+            const fp = (0, codexAuth_1.codexRefreshFingerprint)(backup.snapshot.authRaw);
+            if (fp && live.status === 'ok' && fp === (0, codexAuth_1.codexRefreshFingerprint)(live.snapshot.authRaw))
+                return 'none';
+            (0, codexCredentialStore_1.writeInactiveCodexCredentialStore)(home, backup.snapshot);
+            return 'restored';
+        });
     }
     catch {
-        // Reconciliation must never break startup.
+        return 'none';
     }
 }
 function removeCodexAccount(profileId) {
@@ -1193,5 +1359,10 @@ function removeCodexAccount(profileId) {
         return { success: false, error: `Codex account ${profileId} not found.` };
     }
     fs.rmSync((0, codexPaths_1.getCodexProfileDir)(profileId), { recursive: true, force: true });
+    fs.rmSync((0, codexPaths_1.getCodexBackupPath)(profileId), { force: true });
+    fs.rmSync((0, codexPaths_1.getCodexBackupPath)(profileId, true), { force: true });
     return { success: true };
 }
+async function cleanupAbandonedCodexLoginsAsync(olderThanMs = 24 * 60 * 60 * 1000, now = Date.now()) {
+    return cleanupAbandonedCodexLogins(olderThanMs, now, await (0, processDetection_1.inspectRunningAccountConsumers)('codex'));
+}