sidekick-shared 0.27.5 → 0.27.6

package/dist/keepAlive.d.ts

@@ -39,6 +39,7 @@ export declare function keepAliveCommand(provider: AccountProviderId): {
 };
 /**
  * Serialised, bounded refresh of every inactive account that is `expiring`
- * (or `unknown` for Claude). Never touches the live account.
+ * (or `unknown` for Claude). Never touches the live account or any copy of
+ * its chain.
  */
 export declare function refreshInactiveAccounts(options?: RefreshInactiveAccountsOptions): Promise<RefreshInactiveAccountsResult>;

package/dist/keepAlive.js

@@ -7,33 +7,50 @@ exports.refreshInactiveAccounts = refreshInactiveAccounts;
  * providers' OAuth endpoints itself: it runs the official CLI inside the
  * profile's isolated home and lets the CLI refresh (and rotate) the token
  * where it belongs, then re-reads the store to record the new expiry.
+ *
+ * A refresh rotates the refresh token, so keep-alive only runs where the
+ * profile home holds the one live copy of its chain: never the live account,
+ * never a copy whose refresh token equals live's, never a copy taken from the
+ * live store that no switch has handed back yet, and never a stale copy when
+ * the backup is newer. The check and a lease are taken under the swap lock, so
+ * no switch can install that account while its CLI is refreshing.
  */
+const codexKeepAlive_1 = require("./codexKeepAlive");
+const codexProfiles_1 = require("./codexProfiles");
+const codexPaths_1 = require("./codexPaths");
+const codexCredentialStore_1 = require("./codexCredentialStore");
+const codexAuth_1 = require("./codexAuth");
 const child_process_1 = require("child_process");
 const accountHealth_1 = require("./accountHealth");
 const accountLaunch_1 = require("./accountLaunch");
+const accounts_1 = require("./accounts");
 /** The command each CLI runs to load (and refresh) its stored login. */
 function keepAliveCommand(provider) {
     if (provider === 'codex')
-        return { command: 'codex', args: ['login', 'status'] };
+        return { command: 'codex', args: ['app-server', '-c', 'cli_auth_credentials_store="file"'] };
     const override = process.env.SIDEKICK_CLAUDE_KEEPALIVE_ARGS?.trim();
     return { command: 'claude', args: override ? override.split(/\s+/) : ['auth', 'status'] };
 }
-const defaultRunner = (command, args, env, timeoutMs) => new Promise((resolve) => {
-    try {
-        (0, child_process_1.execFile)(command, args, { encoding: 'utf8', env, timeout: timeoutMs, killSignal: 'SIGKILL', windowsHide: true }, (error, stdout) => {
-            const status = error
-                ? (error.code ?? null)
-                : 0;
-            resolve({
-                status: typeof status === 'number' ? status : null,
-                stdout: String(stdout ?? ''),
+/** How long a keep-alive lease outlives the CLI timeout before it lapses on its own. */
+const LEASE_GRACE_MS = 30_000;
+const defaultRunner = (command, args, env, timeoutMs) => command === 'codex'
+    ? (0, codexKeepAlive_1.runCodexKeepAlive)(command, args, env, timeoutMs)
+    : new Promise((resolve) => {
+        try {
+            (0, child_process_1.execFile)(command, args, { encoding: 'utf8', env, timeout: timeoutMs, killSignal: 'SIGKILL', windowsHide: true }, (error, stdout) => {
+                const status = error
+                    ? (error.code ?? null)
+                    : 0;
+                resolve({
+                    status: typeof status === 'number' ? status : null,
+                    stdout: String(stdout ?? ''),
+                });
             });
-        });
-    }
-    catch {
-        resolve({ status: null, stdout: '' });
-    }
-});
+        }
+        catch {
+            resolve({ status: null, stdout: '' });
+        }
+    });
 function eligible(view, includeFresh) {
     if (view.health.isLive)
         return 'live account; the CLI refreshes it in normal use';
@@ -49,7 +66,8 @@ function eligible(view, includeFresh) {
 }
 /**
  * Serialised, bounded refresh of every inactive account that is `expiring`
- * (or `unknown` for Claude). Never touches the live account.
+ * (or `unknown` for Claude). Never touches the live account or any copy of
+ * its chain.
  */
 async function refreshInactiveAccounts(options = {}) {
     const result = { refreshed: [], skipped: [], failed: [] };
@@ -62,10 +80,15 @@ async function refreshInactiveAccounts(options = {}) {
             result.skipped.push({ id: view.id, providerId: view.providerId, reason });
             continue;
         }
-        const launch = (0, accountLaunch_1.getAccountLaunchEnv)(view.providerId, view.id, { materialize: true });
-        if (launch.error) {
-            result.skipped.push({ id: view.id, providerId: view.providerId, reason: launch.error });
-            continue;
+        const isClaude = view.providerId === 'claude-code';
+        const beginLease = isClaude ? accounts_1.beginClaudeKeepAlive : codexProfiles_1.beginCodexKeepAlive;
+        const finishLease = isClaude ? accounts_1.finishClaudeKeepAlive : codexProfiles_1.finishCodexKeepAlive;
+        if (options.dryRun) {
+            const blocker = (isClaude ? accounts_1.getClaudeKeepAliveBlocker : codexProfiles_1.getCodexKeepAliveBlocker)(view.id);
+            if (blocker) {
+                result.skipped.push({ id: view.id, providerId: view.providerId, reason: blocker });
+                continue;
+            }
         }
         const { command, args } = keepAliveCommand(view.providerId);
         if (options.dryRun) {
@@ -76,16 +99,71 @@ async function refreshInactiveAccounts(options = {}) {
             });
             continue;
         }
-        const env = { ...process.env, ...launch.env };
-        for (const name of launch.envUnset)
-            delete env[name];
+        {
+            const begin = beginLease(view.id, timeoutMs + LEASE_GRACE_MS);
+            if (!begin.ok) {
+                result.skipped.push({ id: view.id, providerId: view.providerId, reason: begin.reason });
+                continue;
+            }
+        }
+        let released = false;
+        const release = () => {
+            if (!released) {
+                released = true;
+                finishLease(view.id);
+            }
+        };
         try {
-            const run = await runner(command, args, env, timeoutMs);
+            const launch = (0, accountLaunch_1.getAccountLaunchEnv)(view.providerId, view.id, {
+                materialize: true,
+                restoreBackup: false,
+            });
+            if (launch.error) {
+                release();
+                result.skipped.push({ id: view.id, providerId: view.providerId, reason: launch.error });
+                continue;
+            }
+            if (!isClaude &&
+                (0, codexCredentialStore_1.canonicalCodexPath)(launch.home) === (0, codexCredentialStore_1.canonicalCodexPath)((0, codexPaths_1.getSystemCodexHome)())) {
+                result.skipped.push({
+                    id: view.id,
+                    providerId: view.providerId,
+                    reason: 'the account became live before refresh',
+                });
+                continue;
+            }
+            const before = isClaude ? null : (0, codexCredentialStore_1.readCodexCredentialStore)(launch.home);
+            const env = { ...process.env, ...launch.env };
+            for (const name of launch.envUnset)
+                delete env[name];
+            if (!isClaude)
+                for (const name of [
+                    'OPENAI_API_KEY',
+                    'CODEX_API_KEY',
+                    'CODEX_ACCESS_TOKEN',
+                    'OPENAI_FEDERATION_RULE_ID',
+                    'OPENAI_IDENTITY_TOKEN_FILE',
+                    'OPENAI_WORKLOAD_IDENTITY_CONTEXT',
+                ])
+                    delete env[name];
+            let run;
+            try {
+                run = await runner(command, args, env, timeoutMs);
+            }
+            finally {
+                release();
+            }
             const after = (0, accountHealth_1.getAccountHealth)(view.providerId, view.id, {
                 probe: 'store',
                 now: options.now,
             });
-            if (after.state === 'fresh') {
+            const codexAfter = isClaude ? null : (0, codexCredentialStore_1.readCodexCredentialStore)(launch.home);
+            const advanced = isClaude ||
+                (before?.status === 'ok' &&
+                    codexAfter?.status === 'ok' &&
+                    (0, codexAuth_1.identitiesMatch)((0, codexAuth_1.readAuthIdentityFromRaw)(before.snapshot.authRaw), (0, codexAuth_1.readAuthIdentityFromRaw)(codexAfter.snapshot.authRaw)) &&
+                    (0, codexAuth_1.compareCodexAuthFreshness)(codexAfter.snapshot.authRaw, before.snapshot.authRaw) > 0);
+            if (after.state === 'fresh' && advanced && (isClaude || run.status === 0)) {
                 result.refreshed.push({ id: view.id, providerId: view.providerId });
             }
             else {
@@ -93,13 +171,22 @@ async function refreshInactiveAccounts(options = {}) {
                     id: view.id,
                     providerId: view.providerId,
                     error: run.status === 0
-                        ? `${command} ran but the stored credential is still ${after.state}.`
-                        : `${command} exited with status ${run.status ?? 'unknown'}.`,
+                        ? isClaude
+                            ? `${command} ran but the stored credential is still ${after.state}.`
+                            : `${command} ran but no verified credential advance was observed (health: ${after.state}).`
+                        : `${command} exited with status ${run.status ?? 'unknown'}.${isClaude ? '' : ' Codex app-server refresh requires a compatible Codex CLI; update it and retry.'}`,
                 });
             }
         }
         catch (err) {
-            result.failed.push({ id: view.id, providerId: view.providerId, error: String(err) });
+            result.failed.push({
+                id: view.id,
+                providerId: view.providerId,
+                error: isClaude ? String(err) : 'Codex keep-alive could not complete safely.',
+            });
+        }
+        finally {
+            release();
         }
     }
     return result;

package/dist/liveCredentialGuard.d.ts

@@ -0,0 +1,28 @@
+/** Pure policy shared by provider-specific live credential installers. */
+export type LiveCredentialWriteIntent = 'switch' | 'relogin' | 'repair' | 'rollback';
+export type LiveCredentialWriteRefusal = 'live-unreadable' | 'invalid-candidate' | 'same-account' | 'different-account' | 'same-link' | 'not-captured' | 'not-newer' | 'live-changed';
+export type LiveCredentialWriteDecision = {
+    allow: true;
+} | {
+    allow: false;
+    code: LiveCredentialWriteRefusal;
+    reason: string;
+};
+export interface LiveCredentialWriteFacts {
+    provider: string;
+    intent: LiveCredentialWriteIntent;
+    liveStatus: 'ok' | 'absent' | 'corrupt' | 'error';
+    candidateValid: boolean;
+    liveHasCredential: boolean;
+    liveAccountId: string | null;
+    candidateAccountId: string;
+    sameLink: boolean;
+    strictlyNewer: boolean;
+    capturedOutgoing?: boolean;
+    matchesWritten: boolean;
+    /** Compatibility with Claude's established missing/corrupt rollback policy. */
+    allowNonOkRollback?: boolean;
+    rejectCorrupt?: boolean;
+    requireDifferentLinkForAdvance?: boolean;
+}
+export declare function decideLiveCredentialWrite(f: LiveCredentialWriteFacts): LiveCredentialWriteDecision;

package/dist/liveCredentialGuard.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideLiveCredentialWrite = decideLiveCredentialWrite;
+function decideLiveCredentialWrite(f) {
+    const refuse = (code, reason) => ({ allow: false, code, reason });
+    if (f.liveStatus === 'error' || (f.rejectCorrupt && f.liveStatus === 'corrupt')) {
+        return refuse('live-unreadable', `The live ${f.provider} login could not be read, so it was left untouched.`);
+    }
+    if (f.intent === 'rollback') {
+        return f.matchesWritten || (f.allowNonOkRollback && f.liveStatus !== 'ok')
+            ? { allow: true }
+            : refuse('live-changed', `The live ${f.provider} login changed after the switch wrote it; it was kept.`);
+    }
+    if (!f.candidateValid)
+        return refuse('invalid-candidate', `The saved credential is not a ${f.provider} login.`);
+    if (f.intent === 'switch') {
+        if (f.liveAccountId !== null && f.liveAccountId === f.candidateAccountId) {
+            return refuse('same-account', 'That account is already the live login.');
+        }
+        if (f.sameLink)
+            return refuse('same-link', 'The saved login is the same refresh token the live login holds; sign in to that account again.');
+        if (f.liveHasCredential && !f.capturedOutgoing) {
+            return refuse('not-captured', 'The outgoing live login was not saved first, so it was left untouched.');
+        }
+        return { allow: true };
+    }
+    if (f.liveAccountId !== null && f.liveAccountId !== f.candidateAccountId) {
+        return refuse('different-account', `The live ${f.provider} login belongs to another account; switch accounts instead.`);
+    }
+    if (!f.liveHasCredential)
+        return { allow: true };
+    if (!f.strictlyNewer || (f.requireDifferentLinkForAdvance && f.sameLink)) {
+        return refuse('not-newer', `The live ${f.provider} login is already at least as new; it was kept.`);
+    }
+    return { allow: true };
+}

package/dist/processDetection.d.ts

@@ -14,9 +14,6 @@ export interface RunningAccountConsumer {
     /** The user-facing sentence both UIs print for this consumer. */
     reachability: string;
 }
-/** Sync sibling of {@link findRunningProcesses}; blocks up to 4 s. */
-export declare function findRunningProcessesSync(names: string[]): RunningProcess[];
-export declare function findRunningProcesses(names: string[]): Promise<RunningProcess[]>;
 export declare const ACCOUNT_CONSUMER_REACHABILITY: Record<AccountConsumerKind, {
     switched: boolean;
     reachability: string;
@@ -30,3 +27,13 @@ export declare function detectRunningAccountConsumers(provider?: 'claude-code' |
 export declare function detectRunningAccountConsumersSync(provider?: 'claude-code' | 'codex'): RunningAccountConsumer[];
 /** Build a consumer entry for a kind the host detects itself (e.g. its own extension host). */
 export declare function describeAccountConsumer(kind: AccountConsumerKind, pids?: number[]): RunningAccountConsumer;
+/** Compatibility wrappers keep the established best-effort list API. */
+export declare function findRunningProcessesSync(names: string[]): RunningProcess[];
+export declare function findRunningProcesses(names: string[]): Promise<RunningProcess[]>;
+export interface AccountConsumerScan {
+    ok: boolean;
+    consumers: RunningAccountConsumer[];
+}
+/** Safety decisions must distinguish a failed process scan from an empty one. */
+export declare function inspectRunningAccountConsumersSync(provider: 'claude-code' | 'codex'): AccountConsumerScan;
+export declare function inspectRunningAccountConsumers(provider: 'claude-code' | 'codex'): Promise<AccountConsumerScan>;

package/dist/processDetection.js

@@ -34,11 +34,13 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ACCOUNT_CONSUMER_REACHABILITY = void 0;
-exports.findRunningProcessesSync = findRunningProcessesSync;
-exports.findRunningProcesses = findRunningProcesses;
 exports.detectRunningAccountConsumers = detectRunningAccountConsumers;
 exports.detectRunningAccountConsumersSync = detectRunningAccountConsumersSync;
 exports.describeAccountConsumer = describeAccountConsumer;
+exports.findRunningProcessesSync = findRunningProcessesSync;
+exports.findRunningProcesses = findRunningProcesses;
+exports.inspectRunningAccountConsumersSync = inspectRunningAccountConsumersSync;
+exports.inspectRunningAccountConsumers = inspectRunningAccountConsumers;
 /**
  * Cross-platform detection of running CLI/app processes that hold provider
  * credentials in memory. Bounded, never throws, never spawns a shell.
@@ -47,6 +49,7 @@ const child_process_1 = require("child_process");
 const path = __importStar(require("path"));
 const PROBE_TIMEOUT_MS = 4000;
 const CLAUDE_NPM_ENTRY = /claude-code[\\/]cli\.js/;
+const CODEX_NPM_ENTRY = /(?:@openai[\\/]codex|codex[\\/]bin)[\\/].*codex\.js/;
 function parseUnixTable(stdout) {
     const rows = [];
     for (const line of stdout.split('\n')) {
@@ -87,6 +90,15 @@ function matchRows(rows, names) {
             CLAUDE_NPM_ENTRY.test(row.args)) {
             name = 'claude';
         }
+        if (!name &&
+            wanted.has('codex') &&
+            /^node(\.exe)?$/i.test(base) &&
+            CODEX_NPM_ENTRY.test(row.args))
+            name = 'codex';
+        if (!name &&
+            wanted.has('Codex') &&
+            /(?:^|[\\/])Codex\.app[\\/]/.test(row.command + ' ' + row.args))
+            name = 'Codex';
         if (name)
             found.push({ pid: row.pid, name, command: row.command });
     }
@@ -101,9 +113,9 @@ function parseOutput(stdout) {
     return process.platform === 'win32' ? parseWindowsCsv(stdout) : parseUnixTable(stdout);
 }
 /** Sync sibling of {@link findRunningProcesses}; blocks up to 4 s. */
-function findRunningProcessesSync(names) {
+function inspectProcessesSync(names) {
     if (names.length === 0)
-        return [];
+        return { ok: true, processes: [] };
     try {
         const { command, args } = probeCommand();
         const result = (0, child_process_1.spawnSync)(command, args, {
@@ -114,16 +126,16 @@ function findRunningProcessesSync(names) {
             windowsHide: true,
         });
         if (result.error || result.status !== 0)
-            return [];
-        return matchRows(parseOutput(String(result.stdout ?? '')), names);
+            return { ok: false, processes: [] };
+        return { ok: true, processes: matchRows(parseOutput(String(result.stdout ?? '')), names) };
     }
     catch {
-        return [];
+        return { ok: false, processes: [] };
     }
 }
-function findRunningProcesses(names) {
+function inspectProcesses(names) {
     if (names.length === 0)
-        return Promise.resolve([]);
+        return Promise.resolve({ ok: true, processes: [] });
     return new Promise((resolve) => {
         try {
             const { command, args } = probeCommand();
@@ -134,11 +146,14 @@ function findRunningProcesses(names) {
                 windowsHide: true,
                 maxBuffer: 16 * 1024 * 1024,
             }, (error, stdout) => {
-                resolve(error ? [] : matchRows(parseOutput(String(stdout ?? '')), names));
+                resolve({
+                    ok: !error,
+                    processes: error ? [] : matchRows(parseOutput(String(stdout ?? '')), names),
+                });
             });
         }
         catch {
-            resolve([]);
+            resolve({ ok: false, processes: [] });
         }
     });
 }
@@ -208,3 +223,21 @@ function detectRunningAccountConsumersSync(provider) {
 function describeAccountConsumer(kind, pids = []) {
     return toConsumer(kind, pids);
 }
+/** Compatibility wrappers keep the established best-effort list API. */
+function findRunningProcessesSync(names) {
+    return inspectProcessesSync(names).processes;
+}
+async function findRunningProcesses(names) {
+    return (await inspectProcesses(names)).processes;
+}
+/** Safety decisions must distinguish a failed process scan from an empty one. */
+function inspectRunningAccountConsumersSync(provider) {
+    const kinds = kindsForProvider(provider);
+    const result = inspectProcessesSync(kinds.map((kind) => CONSUMER_PROCESS_NAMES[kind]));
+    return { ok: result.ok, consumers: groupConsumers(result.processes, kinds) };
+}
+async function inspectRunningAccountConsumers(provider) {
+    const kinds = kindsForProvider(provider);
+    const result = await inspectProcesses(kinds.map((kind) => CONSUMER_PROCESS_NAMES[kind]));
+    return { ok: result.ok, consumers: groupConsumers(result.processes, kinds) };
+}

package/dist/schemas/accountManager.d.ts

@@ -143,6 +143,7 @@ export declare const accountHealthSidecarSchema: z.ZodObject<{
         "api-key": "api-key";
         oauth: "oauth";
     }>>;
+    refreshFp: z.ZodOptional<z.ZodString>;
     source: z.ZodEnum<{
         login: "login";
         "live-sync": "live-sync";
@@ -310,6 +311,13 @@ export declare const providerSyncReportSchema: z.ZodObject<{
     folded: z.ZodOptional<z.ZodString>;
     repointed: z.ZodOptional<z.ZodString>;
     merged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    demoted: z.ZodOptional<z.ZodString>;
+    repaired: z.ZodOptional<z.ZodString>;
+    journal: z.ZodOptional<z.ZodEnum<{
+        finished: "finished";
+        "rolled-back": "rolled-back";
+        cleared: "cleared";
+    }>>;
     skipped: z.ZodOptional<z.ZodString>;
     warnings: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
@@ -322,6 +330,13 @@ export declare const syncReportSchema: z.ZodObject<{
         folded: z.ZodOptional<z.ZodString>;
         repointed: z.ZodOptional<z.ZodString>;
         merged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        demoted: z.ZodOptional<z.ZodString>;
+        repaired: z.ZodOptional<z.ZodString>;
+        journal: z.ZodOptional<z.ZodEnum<{
+            finished: "finished";
+            "rolled-back": "rolled-back";
+            cleared: "cleared";
+        }>>;
         skipped: z.ZodOptional<z.ZodString>;
         warnings: z.ZodArray<z.ZodString>;
     }, z.core.$strip>;
@@ -333,6 +348,13 @@ export declare const syncReportSchema: z.ZodObject<{
         folded: z.ZodOptional<z.ZodString>;
         repointed: z.ZodOptional<z.ZodString>;
         merged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        demoted: z.ZodOptional<z.ZodString>;
+        repaired: z.ZodOptional<z.ZodString>;
+        journal: z.ZodOptional<z.ZodEnum<{
+            finished: "finished";
+            "rolled-back": "rolled-back";
+            cleared: "cleared";
+        }>>;
         skipped: z.ZodOptional<z.ZodString>;
         warnings: z.ZodArray<z.ZodString>;
     }, z.core.$strip>;

package/dist/schemas/accountManager.js

@@ -107,6 +107,7 @@ exports.accountHealthSidecarSchema = zod_1.z.object({
     lastRefreshAt: zod_1.z.number().optional(),
     hasRefreshToken: zod_1.z.boolean().optional(),
     authMode: zod_1.z.enum(['chatgpt', 'api-key', 'oauth']).optional(),
+    refreshFp: zod_1.z.string().optional(),
     source: exports.accountHealthSourceSchema,
 });
 exports.accountHealthSchema = zod_1.z.object({
@@ -178,6 +179,9 @@ exports.providerSyncReportSchema = zod_1.z.object({
     folded: zod_1.z.string().optional(),
     repointed: zod_1.z.string().optional(),
     merged: zod_1.z.array(zod_1.z.string()).optional(),
+    demoted: zod_1.z.string().optional(),
+    repaired: zod_1.z.string().optional(),
+    journal: zod_1.z.enum(['finished', 'rolled-back', 'cleared']).optional(),
     skipped: zod_1.z.string().optional(),
     warnings: zod_1.z.array(zod_1.z.string()),
 });

package/dist/schemas/assistantTurn.d.ts

@@ -7,8 +7,8 @@
 import { z } from 'zod';
 export declare const assistantTurnEventTypeSchema: z.ZodEnum<{
     error: "error";
-    text: "text";
     status: "status";
+    text: "text";
     tool_use: "tool_use";
     tool_result: "tool_result";
     progress: "progress";
@@ -18,8 +18,8 @@ export declare const assistantTurnEventTypeSchema: z.ZodEnum<{
 export declare const assistantTurnEventSchema: z.ZodObject<{
     eventType: z.ZodEnum<{
         error: "error";
-        text: "text";
         status: "status";
+        text: "text";
         tool_use: "tool_use";
         tool_result: "tool_result";
         progress: "progress";

package/dist/terminalSync.d.ts

@@ -1,7 +1,17 @@
 import type { AccountProviderId } from './accountRegistry';
 /**
- * Write a POSIX launcher script that runs the provider CLI against a profile
- * home. Unix only; on Windows use `sidekick accounts env --shell powershell`.
+ * Write a POSIX launcher script that runs the provider CLI as a saved account.
+ * The script defers to `sidekick accounts shell` at run time, which resolves
+ * the right home then: the account's profile home while it is inactive, the
+ * live home while it is the live login (a session pinned to the profile home
+ * would otherwise be a second copy of the live login). Unix only; on Windows
+ * use `sidekick accounts env --shell powershell`.
+ */
+export declare function writeAccountLauncher(name: string, provider: AccountProviderId, accountId: string): void;
+/**
+ * @deprecated Pins a launcher to one profile home; when that account becomes
+ * the live login the launcher runs a second copy of it. Use
+ * {@link writeAccountLauncher}.
  */
 export declare function writeLauncher(name: string, provider: AccountProviderId, profileHome: string): void;
 export declare function removeLauncher(name: string): void;

package/dist/terminalSync.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeAccountLauncher = writeAccountLauncher;
 exports.writeLauncher = writeLauncher;
 exports.removeLauncher = removeLauncher;
 const fs = __importStar(require("fs"));
@@ -79,9 +80,33 @@ function assertNoLauncherCollision(name, targetPath) {
         }
     }
 }
+function shellSingleQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Write a POSIX launcher script that runs the provider CLI as a saved account.
+ * The script defers to `sidekick accounts shell` at run time, which resolves
+ * the right home then: the account's profile home while it is inactive, the
+ * live home while it is the live login (a session pinned to the profile home
+ * would otherwise be a second copy of the live login). Unix only; on Windows
+ * use `sidekick accounts env --shell powershell`.
+ */
+function writeAccountLauncher(name, provider, accountId) {
+    assertValidLauncherName(name);
+    const launcherPath = getLauncherPath(name);
+    assertNoLauncherCollision(name, launcherPath);
+    const script = [
+        '#!/bin/sh',
+        LAUNCHER_MARKER,
+        `exec sidekick accounts shell --provider ${provider} ${shellSingleQuote(accountId)} -- ${providerBinary(provider)} "$@"`,
+        '',
+    ].join('\n');
+    (0, atomic_1.atomicWriteFileSync)(launcherPath, script, 0o755);
+}
 /**
- * Write a POSIX launcher script that runs the provider CLI against a profile
- * home. Unix only; on Windows use `sidekick accounts env --shell powershell`.
+ * @deprecated Pins a launcher to one profile home; when that account becomes
+ * the live login the launcher runs a second copy of it. Use
+ * {@link writeAccountLauncher}.
  */
 function writeLauncher(name, provider, profileHome) {
     assertValidLauncherName(name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sidekick-shared",
-  "version": "0.27.5",
+  "version": "0.27.6",
   "description": "Shared data access layer for Sidekick — readers, types, providers, credentials, quota",
   "keywords": [
     "claude-code",