sidekick-shared 0.27.5 → 0.27.6

package/dist/claudeProfiles.js

@@ -38,8 +38,10 @@ exports.getDefaultClaudeHome = getDefaultClaudeHome;
 exports.isDefaultClaudeHome = isDefaultClaudeHome;
 exports.getLiveClaudeHome = getLiveClaudeHome;
 exports.getClaudeProfilesDir = getClaudeProfilesDir;
+exports.isLiveClaudeHomeSidekickProfile = isLiveClaudeHomeSidekickProfile;
 exports.getClaudeProfileDir = getClaudeProfileDir;
 exports.getClaudeProfileHome = getClaudeProfileHome;
+exports.getClaudeCredentialBackupPath = getClaudeCredentialBackupPath;
 exports.ensureClaudeProfileDirs = ensureClaudeProfileDirs;
 exports.claudeKeychainSuffix = claudeKeychainSuffix;
 exports.claudeKeychainService = claudeKeychainService;
@@ -84,12 +86,32 @@ function getLiveClaudeHome() {
 function getClaudeProfilesDir() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'claude', 'profiles');
 }
+/**
+ * True when the live home is one of sidekick's own profile homes: a shell
+ * that eval'd `sidekick accounts env` or runs inside `sidekick accounts shell`.
+ * That profile's store then reads as the live store, so sync, re-login, and
+ * switching must not treat it as live: they would delete the shell's only
+ * usable copy and re-point the active account at it.
+ */
+function isLiveClaudeHomeSidekickProfile() {
+    const liveHome = path.resolve(getLiveClaudeHome());
+    const profilesDir = path.resolve(getClaudeProfilesDir());
+    return liveHome === profilesDir || liveHome.startsWith(profilesDir + path.sep);
+}
 function getClaudeProfileDir(uuid) {
     return path.join(getClaudeProfilesDir(), uuid);
 }
 function getClaudeProfileHome(uuid) {
     return path.join(getClaudeProfileDir(uuid), 'home');
 }
+/**
+ * Sidekick's private backup of a profile's credential. Claude Code never reads
+ * it, so it is not a CLI-usable copy: this is where the live account's
+ * credential is mirrored while its profile home stays empty.
+ */
+function getClaudeCredentialBackupPath(uuid) {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'credentials', `${uuid}.credentials.json`);
+}
 function ensureClaudeProfileDirs(uuid) {
     fs.mkdirSync(getClaudeProfileHome(uuid), { recursive: true, mode: 0o700 });
 }

package/dist/claudeRefreshLock.d.ts

@@ -0,0 +1,15 @@
+/** Claude Code treats a lock older than this as abandoned (proper-lockfile `stale`). */
+export declare const CLAUDE_REFRESH_LOCK_STALE_MS = 60000;
+/** Claude Code is refreshing a login in one of the homes; retry shortly. */
+export declare class ClaudeRefreshLockBusyError extends Error {
+    constructor(lockPath: string);
+}
+export declare function claudeRefreshLockPaths(home: string): string[];
+/**
+ * Run `operation` holding the refresh locks of every existing home (a home
+ * that does not exist has no CLI using it). Throws
+ * {@link ClaudeRefreshLockBusyError} when a lock stays held past `waitMs`.
+ */
+export declare function withClaudeRefreshLocksSync<T>(homes: string[], operation: () => T, options?: {
+    waitMs?: number;
+}): T;

package/dist/claudeRefreshLock.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClaudeRefreshLockBusyError = exports.CLAUDE_REFRESH_LOCK_STALE_MS = void 0;
+exports.claudeRefreshLockPaths = claudeRefreshLockPaths;
+exports.withClaudeRefreshLocksSync = withClaudeRefreshLocksSync;
+/**
+ * Borrow Claude Code's own token-refresh lock while Sidekick reads and
+ * replaces a home's credential.
+ *
+ * Claude Code 2.1.x serialises refreshes per config directory with a
+ * proper-lockfile directory lock at `<configDir>/.oauth_refresh.lock` (stale
+ * after 60 s) plus a legacy `<realpath(configDir)>.lock`. Under that lock it
+ * re-reads the store before refreshing and adopts a token someone else wrote,
+ * so holding both locks keeps a refresh (which rotates the refresh token) out
+ * of the window between Sidekick's read and its write.
+ *
+ * Best effort by construction: this layers on Claude Code internals. If they
+ * change we lose only the exclusion; the callers' fingerprint re-checks still
+ * catch a store that moved. Held briefly (a few `security` calls), well under
+ * the 60 s stale window, and released on every exit.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Claude Code treats a lock older than this as abandoned (proper-lockfile `stale`). */
+exports.CLAUDE_REFRESH_LOCK_STALE_MS = 60_000;
+const DEFAULT_WAIT_MS = 5_000;
+const POLL_MS = 50;
+const sleepView = new Int32Array(new SharedArrayBuffer(4));
+/** Claude Code is refreshing a login in one of the homes; retry shortly. */
+class ClaudeRefreshLockBusyError extends Error {
+    constructor(lockPath) {
+        super(`Claude Code is refreshing a login (${lockPath} is held); try again in a few seconds.`);
+        this.name = 'ClaudeRefreshLockBusyError';
+    }
+}
+exports.ClaudeRefreshLockBusyError = ClaudeRefreshLockBusyError;
+function claudeRefreshLockPaths(home) {
+    let real = path.resolve(home);
+    try {
+        real = fs.realpathSync(home);
+    }
+    catch {
+        /* keep the resolved path */
+    }
+    return [path.join(home, '.oauth_refresh.lock'), `${real}.lock`];
+}
+function tryAcquire(lockPath, now) {
+    try {
+        fs.mkdirSync(lockPath);
+        return true;
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    try {
+        const stat = fs.statSync(lockPath);
+        if (now - stat.mtimeMs > exports.CLAUDE_REFRESH_LOCK_STALE_MS) {
+            // proper-lockfile's own recovery: an abandoned lock is removed and retaken.
+            fs.rmSync(lockPath, { recursive: true, force: true });
+            fs.mkdirSync(lockPath);
+            return true;
+        }
+    }
+    catch {
+        /* released or retaken between checks; poll again */
+    }
+    return false;
+}
+/**
+ * Run `operation` holding the refresh locks of every existing home (a home
+ * that does not exist has no CLI using it). Throws
+ * {@link ClaudeRefreshLockBusyError} when a lock stays held past `waitMs`.
+ */
+function withClaudeRefreshLocksSync(homes, operation, options = {}) {
+    const waitMs = options.waitMs ?? DEFAULT_WAIT_MS;
+    const lockPaths = [
+        ...new Set(homes
+            .filter((home) => {
+            try {
+                return fs.statSync(home).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        })
+            .flatMap(claudeRefreshLockPaths)),
+    ];
+    const held = [];
+    try {
+        const deadline = Date.now() + waitMs;
+        for (const lockPath of lockPaths) {
+            while (!tryAcquire(lockPath, Date.now())) {
+                if (Date.now() >= deadline)
+                    throw new ClaudeRefreshLockBusyError(lockPath);
+                Atomics.wait(sleepView, 0, 0, POLL_MS);
+            }
+            held.push(lockPath);
+        }
+        return operation();
+    }
+    finally {
+        for (const lockPath of held.reverse()) {
+            try {
+                fs.rmSync(lockPath, { recursive: true, force: true });
+            }
+            catch {
+                /* Claude Code recovers a stale lock after 60 s */
+            }
+        }
+    }
+}

package/dist/codexAuth.d.ts

@@ -30,3 +30,7 @@ export declare function identitiesMatch(a: {
     email?: string;
     workspaceId?: string;
 } | null | undefined): boolean;
+/** Non-secret chain-link identifier; raw token values never belong in diagnostics. */
+export declare function codexRefreshFingerprint(raw: string | null): string | null;
+/** Compare evidence, never filesystem timestamps. Incomparable credentials tie. */
+export declare function compareCodexAuthFreshness(a: string | null, b: string | null): number;

package/dist/codexAuth.js

@@ -40,11 +40,14 @@ exports.readAuthIdentityFromRaw = readAuthIdentityFromRaw;
 exports.readLastRefresh = readLastRefresh;
 exports.readAccessTokenExpiry = readAccessTokenExpiry;
 exports.identitiesMatch = identitiesMatch;
+exports.codexRefreshFingerprint = codexRefreshFingerprint;
+exports.compareCodexAuthFreshness = compareCodexAuthFreshness;
 /**
  * Pure helpers over the Codex CLI `auth.json` payload. No filesystem access
  * beyond an optional mtime fallback, no child processes.
  */
 const fs = __importStar(require("fs"));
+const crypto_1 = require("crypto");
 // Codex refreshes OAuth tokens at most every 8 days; a stored refresh token
 // older than that may already be rejected by the auth server.
 exports.STALE_AUTH_THRESHOLD_MS = 8 * 24 * 60 * 60 * 1000;
@@ -125,3 +128,18 @@ function identitiesMatch(a, b) {
         return a.workspaceId === b.workspaceId;
     return Boolean(a.email && b.email && a.email === b.email);
 }
+/** Non-secret chain-link identifier; raw token values never belong in diagnostics. */
+function codexRefreshFingerprint(raw) {
+    const token = parseAuthJson(raw)?.tokens?.refresh_token;
+    return typeof token === 'string' && token
+        ? (0, crypto_1.createHash)('sha256').update(token).digest('hex').slice(0, 16)
+        : null;
+}
+/** Compare evidence, never filesystem timestamps. Incomparable credentials tie. */
+function compareCodexAuthFreshness(a, b) {
+    const ar = readLastRefresh(a), br = readLastRefresh(b);
+    if (ar !== null && br !== null && ar !== br)
+        return ar > br ? 1 : -1;
+    const ae = readAccessTokenExpiry(a), be = readAccessTokenExpiry(b);
+    return ae !== null && be !== null && ae !== be ? (ae > be ? 1 : -1) : 0;
+}

package/dist/codexCredentialDoctor.d.ts

@@ -0,0 +1,33 @@
+import type { ProviderSyncReport } from './accountSyncTypes';
+export interface CodexCredentialFinding {
+    kind: 'live-duplicate' | 'stale-stash' | 'orphan' | 'corrupt' | 'unreadable' | 'pending-switch';
+    configDir: string;
+    /** Present for old timestamped stash files. */
+    file?: string;
+    ownership: 'profile-home' | 'login-home' | 'stash' | 'live' | 'journal' | 'backup';
+    accountId?: string;
+    email?: string;
+    fingerprint?: string;
+    detail: string;
+    action: string;
+}
+export interface CodexCredentialInspection {
+    findings: CodexCredentialFinding[];
+    homesChecked: number;
+}
+export interface CodexCredentialRepairResult extends CodexCredentialInspection {
+    dryRun: boolean;
+    repaired: Array<{
+        finding: CodexCredentialFinding;
+        ok: boolean;
+        error?: string;
+    }>;
+    sync?: ProviderSyncReport;
+}
+export declare function inspectCodexCredentialStores(options?: {
+    now?: number;
+}): CodexCredentialInspection;
+export declare function repairCodexCredentialStores(options?: {
+    now?: number;
+    dryRun?: boolean;
+}): CodexCredentialRepairResult;

package/dist/codexCredentialDoctor.js

@@ -0,0 +1,302 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectCodexCredentialStores = inspectCodexCredentialStores;
+exports.repairCodexCredentialStores = repairCodexCredentialStores;
+/** Inspection is read-only. Repairs touch only credential paths Sidekick owns. */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const accountRegistry_1 = require("./accountRegistry");
+const codexAuth_1 = require("./codexAuth");
+const codexPaths_1 = require("./codexPaths");
+const codexCredentialStore_1 = require("./codexCredentialStore");
+const accountLease_1 = require("./accountLease");
+const processDetection_1 = require("./processDetection");
+const codexProfiles_1 = require("./codexProfiles");
+function within(child, root) {
+    const resolved = (0, codexCredentialStore_1.canonicalCodexPath)(child), base = (0, codexCredentialStore_1.canonicalCodexPath)(root);
+    return resolved === base || resolved.startsWith(base + path.sep);
+}
+function ownedDirectories(root) {
+    try {
+        return fs
+            .readdirSync(root, { withFileTypes: true })
+            .filter((e) => e.isDirectory() && !e.isSymbolicLink())
+            .map((e) => path.join(root, e.name))
+            .filter((dir) => within(dir, root));
+    }
+    catch {
+        return [];
+    }
+}
+function readFinding(f) {
+    if (!f.file)
+        return (0, codexCredentialStore_1.readCodexCredentialStore)(f.configDir);
+    try {
+        const raw = fs.readFileSync(f.file, 'utf8');
+        const legacy = path.basename(f.file).startsWith('credentials-');
+        const snapshot = { authRaw: legacy ? null : raw, legacyRaw: legacy ? raw : null };
+        return {
+            status: (legacy ? (0, codexCredentialStore_1.isLegacyCodexLogin)(raw) : (0, codexCredentialStore_1.isCodexLogin)(raw)) ? 'ok' : 'corrupt',
+            snapshot,
+        };
+    }
+    catch (error) {
+        return error.code === 'ENOENT'
+            ? { status: 'absent', snapshot: { authRaw: null, legacyRaw: null } }
+            : { status: 'error' };
+    }
+}
+function inspectCodexCredentialStores(options = {}) {
+    const now = options.now ?? Date.now();
+    const findings = [];
+    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+    if (live.status === 'corrupt' || live.status === 'error')
+        findings.push({
+            kind: live.status === 'error' ? 'unreadable' : 'corrupt',
+            configDir: (0, codexPaths_1.getSystemCodexHome)(),
+            ownership: 'live',
+            detail: 'The live Codex login could not be read; it may be mid-write.',
+            action: 'Close Codex and inspect again; live data is never deleted by doctor.',
+        });
+    const profiles = (0, accountRegistry_1.listSavedAccountProfiles)('codex');
+    for (const profile of profiles) {
+        const backup = (0, codexCredentialStore_1.readCodexBackup)(profile.id);
+        if (backup.status === 'error' || backup.status === 'corrupt')
+            findings.push({
+                kind: backup.status === 'error' ? 'unreadable' : 'corrupt',
+                ownership: 'backup',
+                accountId: profile.id,
+                email: profile.email,
+                configDir: path.dirname((0, codexPaths_1.getCodexBackupPath)(profile.id)),
+                file: (0, codexPaths_1.getCodexBackupPath)(profile.id),
+                detail: 'The private Codex backup could not be read safely.',
+                action: 'Inspect the backup or sign in again; unreadable credentials are preserved.',
+            });
+    }
+    const candidates = [];
+    for (const root of [(0, codexPaths_1.getCodexProfilesDir)(), (0, codexPaths_1.getCodexLoginsDir)()]) {
+        for (const dir of ownedDirectories(root)) {
+            const pending = path.join(dir, 'profile.json');
+            if (fs.existsSync(pending)) {
+                try {
+                    const at = Date.parse(JSON.parse(fs.readFileSync(pending, 'utf8')).addedAt);
+                    if (!Number.isFinite(at) || now - at < 24 * 60 * 60 * 1000)
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+            }
+            const home = path.join(dir, 'codex-home');
+            if (within(home, root) &&
+                (0, codexCredentialStore_1.canonicalCodexPath)(home) !== (0, codexCredentialStore_1.canonicalCodexPath)((0, codexPaths_1.getSystemCodexHome)())) {
+                candidates.push({
+                    configDir: home,
+                    ownership: root === (0, codexPaths_1.getCodexProfilesDir)() ? 'profile-home' : 'login-home',
+                });
+            }
+        }
+    }
+    const stash = path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'stash');
+    for (const dir of ownedDirectories(stash)) {
+        const home = path.join(dir, 'codex-home');
+        if (within(home, stash))
+            candidates.push({ configDir: home, ownership: 'stash' });
+    }
+    try {
+        for (const entry of fs.readdirSync(stash, { withFileTypes: true })) {
+            if (entry.isFile() && /^(auth|credentials)-.*\.json$/.test(entry.name))
+                candidates.push({
+                    configDir: stash,
+                    file: path.join(stash, entry.name),
+                    ownership: 'stash',
+                });
+        }
+    }
+    catch {
+        /* no old stash */
+    }
+    for (const candidate of candidates) {
+        const store = readFinding(candidate);
+        if (store.status === 'absent')
+            continue;
+        const identity = store.status === 'ok' ? (0, codexAuth_1.readAuthIdentityFromRaw)(store.snapshot.authRaw) : null;
+        const profile = profiles.find((p) => (0, codexAuth_1.identitiesMatch)(identity, {
+            email: p.email ?? p.metadata?.email,
+            workspaceId: p.metadata?.workspaceId,
+        })) ??
+            profiles.find((p) => (0, codexCredentialStore_1.canonicalCodexPath)((0, codexPaths_1.getCodexProfileHome)(p.id)) === (0, codexCredentialStore_1.canonicalCodexPath)(candidate.configDir));
+        const base = { ...candidate, accountId: profile?.id, email: identity?.email ?? profile?.email };
+        if (store.status === 'error' || store.status === 'corrupt') {
+            findings.push({
+                ...base,
+                kind: store.status === 'error' ? 'unreadable' : 'corrupt',
+                detail: 'This credential store could not be read safely.',
+                action: 'Inspect or sign in again; unreadable credentials are preserved.',
+            });
+            continue;
+        }
+        const fingerprint = (0, codexCredentialStore_1.codexSnapshotFingerprint)(store.snapshot);
+        const liveDuplicate = live.status === 'ok' &&
+            ((0, codexAuth_1.identitiesMatch)(identity, (0, codexAuth_1.readAuthIdentityFromRaw)(live.snapshot.authRaw)) ||
+                fingerprint === (0, codexCredentialStore_1.codexSnapshotFingerprint)(live.snapshot));
+        if (candidate.ownership === 'stash')
+            findings.push({
+                ...base,
+                fingerprint,
+                kind: 'stale-stash',
+                detail: 'An old stash holds another account credential.',
+                action: 'Preserve the freshest known login privately, then remove this credential.',
+            });
+        else if (liveDuplicate)
+            findings.push({
+                ...base,
+                fingerprint,
+                kind: 'live-duplicate',
+                detail: 'This home holds a second usable copy of the live Codex login.',
+                action: 'Repair a newer login first, then remove the duplicate when Codex is stopped.',
+            });
+        else if (!profile || candidate.ownership === 'login-home')
+            findings.push({
+                ...base,
+                fingerprint,
+                kind: 'orphan',
+                detail: 'An abandoned home holds a login outside a saved profile.',
+                action: 'Preserve it under its known account before removing it; unknown identities need manual review.',
+            });
+    }
+    if (fs.existsSync(path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'switch-journal.json')))
+        findings.push({
+            kind: 'pending-switch',
+            ownership: 'journal',
+            configDir: path.join((0, accountRegistry_1.getAccountsDir)(), 'codex'),
+            detail: 'An interrupted account switch needs reconciliation.',
+            action: 'Close Codex and finish recovery from the live fingerprint.',
+        });
+    return { findings, homesChecked: candidates.length + 1 };
+}
+function repairCodexCredentialStores(options = {}) {
+    const inspection = inspectCodexCredentialStores(options);
+    const result = {
+        ...inspection,
+        dryRun: options.dryRun ?? true,
+        repaired: [],
+    };
+    if (result.dryRun)
+        return result;
+    const scan = (0, processDetection_1.inspectRunningAccountConsumersSync)('codex');
+    const mode = (0, codexPaths_1.getCodexCredentialStoreMode)();
+    if (!scan.ok || scan.consumers.length || (mode !== 'file' && mode !== 'unknown')) {
+        result.repaired = inspection.findings.map((finding) => ({
+            finding,
+            ok: false,
+            error: 'Repair requires stopped Codex consumers, a successful process scan, and readable file-mode configuration.',
+        }));
+        return result;
+    }
+    (0, codexProfiles_1.withCodexAuthSwapLock)(() => {
+        result.sync = (0, codexProfiles_1.syncCodexLiveStateUnlocked)('migration', { scan });
+        for (const finding of inspection.findings) {
+            let error;
+            try {
+                if (finding.kind === 'pending-switch') {
+                    if (fs.existsSync(path.join(finding.configDir, 'switch-journal.json')))
+                        throw new Error();
+                }
+                else if (finding.kind === 'live-duplicate' && finding.ownership === 'profile-home') {
+                    if (readFinding(finding).status !== 'absent')
+                        throw new Error();
+                }
+                else if (finding.kind === 'stale-stash' ||
+                    finding.kind === 'orphan' ||
+                    finding.kind === 'live-duplicate') {
+                    if (!within(finding.file ?? finding.configDir, path.join((0, accountRegistry_1.getAccountsDir)(), 'codex')) ||
+                        (0, codexCredentialStore_1.canonicalCodexPath)(finding.configDir) === (0, codexCredentialStore_1.canonicalCodexPath)((0, codexPaths_1.getSystemCodexHome)()))
+                        throw new Error();
+                    const current = readFinding(finding);
+                    if (current.status === 'absent') {
+                        result.repaired.push({ finding, ok: true });
+                        continue;
+                    }
+                    if (current.status !== 'ok' ||
+                        (0, codexCredentialStore_1.codexSnapshotFingerprint)(current.snapshot) !== finding.fingerprint ||
+                        !finding.accountId ||
+                        (0, accountLease_1.isAccountLeaseHeld)('codex', finding.accountId))
+                        throw new Error();
+                    const backup = (0, codexCredentialStore_1.readCodexBackup)(finding.accountId);
+                    if (backup.status === 'ok' &&
+                        (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, current.snapshot.authRaw) === 0 &&
+                        (0, codexCredentialStore_1.codexSnapshotFingerprint)(backup.snapshot) !==
+                            (0, codexCredentialStore_1.codexSnapshotFingerprint)(current.snapshot) &&
+                        (!(0, codexAuth_1.codexRefreshFingerprint)(backup.snapshot.authRaw) ||
+                            (0, codexAuth_1.codexRefreshFingerprint)(backup.snapshot.authRaw) !==
+                                (0, codexAuth_1.codexRefreshFingerprint)(current.snapshot.authRaw))) {
+                        throw new Error(); // Two incomparable chains: deletion would guess which is usable.
+                    }
+                    const chosen = backup.status === 'ok' &&
+                        (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, current.snapshot.authRaw) >= 0
+                        ? backup.snapshot
+                        : current.snapshot;
+                    (0, codexCredentialStore_1.writeCodexBackup)(finding.accountId, chosen);
+                    const live = (0, codexCredentialStore_1.readCodexCredentialStore)();
+                    if (live.status === 'ok' &&
+                        (0, codexAuth_1.identitiesMatch)((0, codexAuth_1.readAuthIdentityFromRaw)(live.snapshot.authRaw), (0, codexAuth_1.readAuthIdentityFromRaw)(chosen.authRaw)) &&
+                        (0, codexAuth_1.compareCodexAuthFreshness)(chosen.authRaw, live.snapshot.authRaw) > 0) {
+                        result.sync = (0, codexProfiles_1.syncCodexLiveStateUnlocked)('migration', { scan });
+                        const repairedLive = (0, codexCredentialStore_1.readCodexCredentialStore)();
+                        if (repairedLive.status !== 'ok' ||
+                            (0, codexAuth_1.compareCodexAuthFreshness)(repairedLive.snapshot.authRaw, chosen.authRaw) < 0)
+                            throw new Error();
+                    }
+                    if (finding.file)
+                        fs.rmSync(finding.file);
+                    else
+                        (0, codexCredentialStore_1.removeCodexProfileCredentials)(finding.configDir, current.snapshot);
+                    if (finding.ownership === 'login-home')
+                        fs.rmSync(path.dirname(finding.configDir), { recursive: true, force: true });
+                }
+                else
+                    throw new Error();
+            }
+            catch {
+                error =
+                    'Preserved for review: unreadable, ambiguous, changed, leased, or not safely repairable yet.';
+            }
+            result.repaired.push({ finding, ok: !error, error });
+        }
+    });
+    return result;
+}

package/dist/codexCredentialStore.d.ts

@@ -0,0 +1,29 @@
+export interface CodexAuthSnapshot {
+    authRaw: string | null;
+    /** Includes unrelated MCP data when reading a home; writers preserve it. */
+    legacyRaw: string | null;
+}
+export type CodexCredentialStoreRead = {
+    status: 'ok' | 'absent' | 'corrupt';
+    snapshot: CodexAuthSnapshot;
+} | {
+    status: 'error';
+};
+export declare function isLegacyCodexLogin(raw: string | null): boolean;
+export declare function isCodexLogin(raw: string | null): boolean;
+export declare function codexLoginOnly(snapshot: CodexAuthSnapshot): CodexAuthSnapshot;
+export declare function readCodexCredentialStore(home?: string): CodexCredentialStoreRead;
+export declare function readCodexBackup(id: string): CodexCredentialStoreRead;
+export declare function codexSnapshotFingerprint(snapshot: CodexAuthSnapshot): string;
+/** The whole snapshot, including absence, must agree before destructive operations. */
+export declare function codexStoreMatches(read: CodexCredentialStoreRead, snapshot: CodexAuthSnapshot): boolean;
+export declare function writeCodexBackup(id: string, snapshot: CodexAuthSnapshot): void;
+/** Resolve existing parents too, so nonexistent children of a symlink cannot bypass ownership. */
+export declare function canonicalCodexPath(value: string): string;
+export declare function isSidekickCodexHome(home: string): boolean;
+/** Install only account data; an unrelated MCP credential file is never copied or deleted. */
+export declare function codexInstalledSnapshot(before: CodexAuthSnapshot, candidate: CodexAuthSnapshot): CodexAuthSnapshot;
+export declare function writeInactiveCodexCredentialStore(home: string, candidate: CodexAuthSnapshot): void;
+/** Internal capability: only the guarded installer in codexProfiles may call this. */
+export declare function writeLiveCodexCredentialStoreUnguarded(snapshot: CodexAuthSnapshot): void;
+export declare function removeCodexProfileCredentials(home: string, expected: CodexAuthSnapshot): void;