sidekick-shared 0.27.5 → 0.27.6

package/dist/codexCredentialStore.js

@@ -0,0 +1,213 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLegacyCodexLogin = isLegacyCodexLogin;
+exports.isCodexLogin = isCodexLogin;
+exports.codexLoginOnly = codexLoginOnly;
+exports.readCodexCredentialStore = readCodexCredentialStore;
+exports.readCodexBackup = readCodexBackup;
+exports.codexSnapshotFingerprint = codexSnapshotFingerprint;
+exports.codexStoreMatches = codexStoreMatches;
+exports.writeCodexBackup = writeCodexBackup;
+exports.canonicalCodexPath = canonicalCodexPath;
+exports.isSidekickCodexHome = isSidekickCodexHome;
+exports.codexInstalledSnapshot = codexInstalledSnapshot;
+exports.writeInactiveCodexCredentialStore = writeInactiveCodexCredentialStore;
+exports.writeLiveCodexCredentialStoreUnguarded = writeLiveCodexCredentialStoreUnguarded;
+exports.removeCodexProfileCredentials = removeCodexProfileCredentials;
+/** Raw credential I/O. Backups are never Codex homes and never launchable. */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const accountRegistry_1 = require("./accountRegistry");
+const codexPaths_1 = require("./codexPaths");
+const codexAuth_1 = require("./codexAuth");
+const atomic_1 = require("./writers/atomic");
+function isLegacyCodexLogin(raw) {
+    const value = (0, codexAuth_1.parseAuthJson)(raw);
+    return Boolean(value &&
+        ['OPENAI_API_KEY', 'CODEX_API_KEY'].some((key) => typeof value[key] === 'string' && value[key].length > 0));
+}
+function isCodexLogin(raw) {
+    const parsed = (0, codexAuth_1.parseAuthJson)(raw);
+    if (!parsed || Array.isArray(parsed))
+        return false;
+    if (typeof parsed.OPENAI_API_KEY === 'string' && parsed.OPENAI_API_KEY)
+        return true;
+    return Boolean(typeof parsed.tokens?.access_token === 'string' &&
+        parsed.tokens.access_token &&
+        typeof parsed.tokens.refresh_token === 'string' &&
+        parsed.tokens.refresh_token);
+}
+function codexLoginOnly(snapshot) {
+    return {
+        authRaw: snapshot.authRaw,
+        legacyRaw: isLegacyCodexLogin(snapshot.legacyRaw) ? snapshot.legacyRaw : null,
+    };
+}
+function readRaw(file) {
+    try {
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+function readFiles(auth, legacy) {
+    try {
+        const snapshot = { authRaw: readRaw(auth), legacyRaw: readRaw(legacy) };
+        const status = snapshot.authRaw !== null
+            ? isCodexLogin(snapshot.authRaw)
+                ? 'ok'
+                : 'corrupt'
+            : isLegacyCodexLogin(snapshot.legacyRaw)
+                ? 'ok'
+                : 'absent';
+        return { status, snapshot };
+    }
+    catch {
+        return { status: 'error' };
+    }
+}
+function readCodexCredentialStore(home = (0, codexPaths_1.getSystemCodexHome)()) {
+    return readFiles(path.join(home, 'auth.json'), path.join(home, '.credentials.json'));
+}
+function readCodexBackup(id) {
+    return readFiles((0, codexPaths_1.getCodexBackupPath)(id), (0, codexPaths_1.getCodexBackupPath)(id, true));
+}
+function codexSnapshotFingerprint(snapshot) {
+    return (0, crypto_1.createHash)('sha256').update(JSON.stringify(snapshot)).digest('hex');
+}
+/** The whole snapshot, including absence, must agree before destructive operations. */
+function codexStoreMatches(read, snapshot) {
+    return (read.status !== 'error' &&
+        codexSnapshotFingerprint(read.snapshot) === codexSnapshotFingerprint(snapshot));
+}
+function writeCodexBackup(id, snapshot) {
+    const login = codexLoginOnly(snapshot);
+    if (!isCodexLogin(login.authRaw) && !isLegacyCodexLogin(login.legacyRaw)) {
+        throw new Error('Refusing to back up an invalid Codex login.');
+    }
+    for (const [file, raw] of [
+        [(0, codexPaths_1.getCodexBackupPath)(id), login.authRaw],
+        [(0, codexPaths_1.getCodexBackupPath)(id, true), login.legacyRaw],
+    ]) {
+        if (raw !== null)
+            (0, atomic_1.atomicWriteFileSync)(file, raw);
+        else
+            fs.rmSync(file, { force: true });
+    }
+    if (!codexStoreMatches(readCodexBackup(id), login))
+        throw new Error('The private Codex backup did not verify.');
+}
+/** Resolve existing parents too, so nonexistent children of a symlink cannot bypass ownership. */
+function canonicalCodexPath(value) {
+    const resolved = path.resolve(value);
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        const parent = path.dirname(resolved);
+        return parent === resolved
+            ? resolved
+            : path.join(canonicalCodexPath(parent), path.basename(resolved));
+    }
+}
+function isSidekickCodexHome(home) {
+    const root = canonicalCodexPath(path.join((0, accountRegistry_1.getAccountsDir)(), 'codex'));
+    const resolved = canonicalCodexPath(home);
+    return resolved === root || resolved.startsWith(root + path.sep);
+}
+/** Install only account data; an unrelated MCP credential file is never copied or deleted. */
+function codexInstalledSnapshot(before, candidate) {
+    const login = codexLoginOnly(candidate);
+    if (login.legacyRaw && before.legacyRaw && !isLegacyCodexLogin(before.legacyRaw)) {
+        throw new Error('Legacy Codex credentials would replace MCP data; sign in with Codex again.');
+    }
+    return {
+        authRaw: login.authRaw,
+        legacyRaw: before.legacyRaw && !isLegacyCodexLogin(before.legacyRaw)
+            ? before.legacyRaw
+            : login.legacyRaw,
+    };
+}
+function writeFiles(home, snapshot) {
+    for (const [name, raw] of [
+        ['auth.json', snapshot.authRaw],
+        ['.credentials.json', snapshot.legacyRaw],
+    ]) {
+        const file = path.join(home, name);
+        // Do not rewrite even identical MCP data; its own refresh writer owns it.
+        if (readRaw(file) === raw)
+            continue;
+        if (raw === null)
+            fs.rmSync(file, { force: true });
+        else
+            (0, atomic_1.atomicWriteFileSync)(file, raw);
+    }
+}
+function writeInactiveCodexCredentialStore(home, candidate) {
+    if (canonicalCodexPath(home) === canonicalCodexPath((0, codexPaths_1.getSystemCodexHome)())) {
+        throw new Error('A profile credential writer cannot write the live Codex home.');
+    }
+    const before = readCodexCredentialStore(home);
+    if (before.status === 'error')
+        throw new Error('The Codex profile could not be read.');
+    const expected = codexInstalledSnapshot(before.snapshot, candidate);
+    writeFiles(home, expected);
+    if (!codexStoreMatches(readCodexCredentialStore(home), expected))
+        throw new Error('The Codex profile write did not verify.');
+}
+/** Internal capability: only the guarded installer in codexProfiles may call this. */
+function writeLiveCodexCredentialStoreUnguarded(snapshot) {
+    const home = (0, codexPaths_1.getSystemCodexHome)();
+    if (isSidekickCodexHome(home))
+        throw new Error('Unset CODEX_HOME before changing the live login; it names a Sidekick-owned home.');
+    writeFiles(home, snapshot);
+}
+function removeCodexProfileCredentials(home, expected) {
+    if (canonicalCodexPath(home) === canonicalCodexPath((0, codexPaths_1.getSystemCodexHome)()))
+        throw new Error('Refusing to remove live Codex credentials.');
+    if (!codexStoreMatches(readCodexCredentialStore(home), expected))
+        throw new Error('The Codex profile changed; its credential was kept.');
+    if (expected.authRaw !== null)
+        fs.rmSync(path.join(home, 'auth.json'), { force: true });
+    if (isLegacyCodexLogin(expected.legacyRaw))
+        fs.rmSync(path.join(home, '.credentials.json'), { force: true });
+    if (readCodexCredentialStore(home).status !== 'absent')
+        throw new Error('The Codex profile credential could not be removed.');
+}

package/dist/codexKeepAlive.d.ts

@@ -0,0 +1,2 @@
+import type { KeepAliveRunner } from './keepAlive';
+export declare const runCodexKeepAlive: KeepAliveRunner;

package/dist/codexKeepAlive.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCodexKeepAlive = void 0;
+/** A bounded, inference-free official CLI refresh. Never expose child output. */
+const child_process_1 = require("child_process");
+const runCodexKeepAlive = (command, args, env, timeoutMs) => new Promise((resolve) => {
+    let child;
+    try {
+        child = (0, child_process_1.spawn)(command, args, {
+            env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
+            cwd: env.CODEX_HOME,
+        });
+    }
+    catch {
+        resolve({ status: null, stdout: '' });
+        return;
+    }
+    let buffer = '';
+    let bytes = 0;
+    let initialized = false;
+    let result = null;
+    let finishing = false;
+    let settled = false;
+    let killTimer;
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    function finish(status) {
+        if (finishing)
+            return;
+        finishing = true;
+        result = status;
+        child.stdin?.end();
+        // The lease stays held until the child exits, including timeout/error paths.
+        killTimer = setTimeout(() => child.kill('SIGKILL'), Math.min(1000, timeoutMs));
+        if (status !== 0)
+            child.kill('SIGKILL');
+    }
+    function settle() {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        if (killTimer)
+            clearTimeout(killTimer);
+        child.stdin?.destroy();
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        resolve({ status: result, stdout: '' });
+    }
+    const send = (message) => {
+        if (!child.stdin?.writable) {
+            finish(null);
+            return;
+        }
+        child.stdin.write(JSON.stringify(message) + '\n');
+    };
+    child.once('error', settle);
+    child.once('close', settle);
+    child.once('exit', settle);
+    child.stdin?.on('error', () => finish(null));
+    child.stderr?.on('data', () => {
+        /* Drain, never log possibly sensitive diagnostics. */
+    });
+    child.stdout?.setEncoding('utf8');
+    child.stdout?.on('data', (chunk) => {
+        if (finishing)
+            return;
+        bytes += Buffer.byteLength(chunk);
+        if (bytes > 1024 * 1024) {
+            finish(null);
+            return;
+        }
+        buffer += chunk;
+        let newline;
+        while (!finishing && (newline = buffer.indexOf('\n')) >= 0) {
+            const line = buffer.slice(0, newline);
+            buffer = buffer.slice(newline + 1);
+            if (!line.trim())
+                continue;
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                finish(null);
+                return;
+            }
+            if (!message || typeof message !== 'object') {
+                finish(null);
+                return;
+            }
+            if (message.id === 0 && !initialized) {
+                if (message.error || !message.result) {
+                    finish(1);
+                    return;
+                }
+                initialized = true;
+                send({ method: 'initialized', params: {} });
+                send({ method: 'account/read', id: 1, params: { refreshToken: true } });
+            }
+            else if (message.id === 1 && initialized) {
+                finish(!message.error && message.result?.account?.type === 'chatgpt' ? 0 : 1);
+            }
+        }
+    });
+    send({
+        method: 'initialize',
+        id: 0,
+        params: {
+            clientInfo: { name: 'sidekick_agent_hub', title: 'Sidekick Agent Hub', version: '1' },
+            capabilities: null,
+        },
+    });
+});
+exports.runCodexKeepAlive = runCodexKeepAlive;

package/dist/codexPaths.d.ts

@@ -8,10 +8,10 @@ export declare function getCodexProfileHome(profileId: string): string;
 export declare function getCodexProfileStatePath(profileId: string): string;
 export declare function ensureCodexProfileDirs(profileId: string): void;
 export declare function readFileOrNull(filePath: string): string | null;
-export type CodexCredentialStoreMode = 'file' | 'keyring' | 'auto' | 'ephemeral' | 'unknown';
+export type CodexCredentialStoreMode = 'file' | 'keyring' | 'auto' | 'ephemeral' | 'unknown' | 'unreadable';
 /**
  * How the `codex` CLI persists credentials for a home, from its `config.toml`.
- * `unknown` means the key is absent (older CLIs: file; newer CLIs: auto).
+ * `unknown` means the key is absent (Codex defaults to file storage).
  */
 export declare function getCodexCredentialStoreMode(codexHome?: string): CodexCredentialStoreMode;
 /**
@@ -19,3 +19,9 @@ export declare function getCodexCredentialStoreMode(codexHome?: string): CodexCr
  * keyring entry sidekick could never swap. Adds the key when absent.
  */
 export declare function forceFileCredentialStore(configToml: string): string;
+export declare function getCodexBackupPath(id: string, legacy?: boolean): string;
+export declare function getCodexLoginsDir(): string;
+export declare function getCodexLoginDir(id: string): string;
+/** Legacy pending profiles remain readable until finalized or discarded. */
+export declare function getCodexLoginHome(id: string): string;
+export declare function getCodexLoginStatePath(id: string): string;

package/dist/codexPaths.js

@@ -44,6 +44,11 @@ exports.ensureCodexProfileDirs = ensureCodexProfileDirs;
 exports.readFileOrNull = readFileOrNull;
 exports.getCodexCredentialStoreMode = getCodexCredentialStoreMode;
 exports.forceFileCredentialStore = forceFileCredentialStore;
+exports.getCodexBackupPath = getCodexBackupPath;
+exports.getCodexLoginsDir = getCodexLoginsDir;
+exports.getCodexLoginDir = getCodexLoginDir;
+exports.getCodexLoginHome = getCodexLoginHome;
+exports.getCodexLoginStatePath = getCodexLoginStatePath;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -62,7 +67,12 @@ function getSystemCodexHome() {
 function getCodexProfilesDir() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'profiles');
 }
+function assertCodexAccountId(id) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(id))
+        throw new Error('Invalid Codex account id.');
+}
 function getCodexProfileDir(profileId) {
+    assertCodexAccountId(profileId);
     return path.join(getCodexProfilesDir(), profileId);
 }
 function getCodexProfileHome(profileId) {
@@ -82,26 +92,40 @@ function readFileOrNull(filePath) {
         return null;
     }
 }
-const STORE_MODE_PATTERN = /^\s*cli_auth_credentials_store\s*=\s*"([a-z]+)"/m;
+const STORE_MODE_PATTERN = /^[ \t]*cli_auth_credentials_store[ \t]*=[ \t]*["']([a-z]+)["']/m;
 /**
  * How the `codex` CLI persists credentials for a home, from its `config.toml`.
- * `unknown` means the key is absent (older CLIs: file; newer CLIs: auto).
+ * `unknown` means the key is absent (Codex defaults to file storage).
  */
 function getCodexCredentialStoreMode(codexHome = getSystemCodexHome()) {
-    const config = readFileOrNull(path.join(codexHome, 'config.toml'));
-    const match = config?.match(STORE_MODE_PATTERN);
+    let config;
+    try {
+        config = fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8');
+    }
+    catch (error) {
+        return error.code === 'ENOENT' ? 'unknown' : 'unreadable';
+    }
+    const topLevel = config.split(/^[ \t]*\[/m, 1)[0];
+    const match = topLevel.match(STORE_MODE_PATTERN);
+    if (!match && /^[ \t]*cli_auth_credentials_store\s*=/m.test(topLevel))
+        return 'unreadable';
     const value = match?.[1];
     return value === 'file' || value === 'keyring' || value === 'auto' || value === 'ephemeral'
         ? value
-        : 'unknown';
+        : value === undefined
+            ? 'unknown'
+            : 'unreadable';
 }
 /**
  * Rewrite a `config.toml` so an isolated login writes `auth.json` instead of a
  * keyring entry sidekick could never swap. Adds the key when absent.
  */
 function forceFileCredentialStore(configToml) {
-    if (STORE_MODE_PATTERN.test(configToml)) {
-        return configToml.replace(STORE_MODE_PATTERN, 'cli_auth_credentials_store = "file"');
+    const firstHeader = configToml.search(/^[ \t]*\[/m);
+    const header = firstHeader < 0 ? configToml : configToml.slice(0, firstHeader);
+    if (STORE_MODE_PATTERN.test(header)) {
+        return (header.replace(STORE_MODE_PATTERN, 'cli_auth_credentials_store = "file"') +
+            (firstHeader < 0 ? '' : configToml.slice(firstHeader)));
     }
     const line = 'cli_auth_credentials_store = "file"';
     const trimmed = configToml.replace(/\s*$/, '');
@@ -115,3 +139,23 @@ function forceFileCredentialStore(configToml) {
     const head = trimmed.slice(0, firstTable).replace(/\s*$/, '');
     return `${head ? `${head}\n` : ''}${line}\n\n${trimmed.slice(firstTable).replace(/^\s*/, '')}\n`;
 }
+function getCodexBackupPath(id, legacy = false) {
+    assertCodexAccountId(id);
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'backups', `${id}.${legacy ? 'credentials' : 'auth'}.json`);
+}
+function getCodexLoginsDir() {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'codex', 'logins');
+}
+function getCodexLoginDir(id) {
+    assertCodexAccountId(id);
+    return path.join(getCodexLoginsDir(), id);
+}
+/** Legacy pending profiles remain readable until finalized or discarded. */
+function getCodexLoginHome(id) {
+    const dir = getCodexLoginDir(id);
+    return fs.existsSync(dir) ? path.join(dir, 'codex-home') : getCodexProfileHome(id);
+}
+function getCodexLoginStatePath(id) {
+    const dir = getCodexLoginDir(id);
+    return fs.existsSync(dir) ? path.join(dir, 'profile.json') : getCodexProfileStatePath(id);
+}

package/dist/codexProfiles.d.ts

@@ -3,6 +3,8 @@ import type { AccountManagerResult } from './accounts';
 import { type AccountHealthSource } from './accountHealth';
 import { type SwitchAccountOptions, type SwitchAccountResult } from './accountSwitch';
 import { type ProviderSyncReport } from './accountSyncTypes';
+import { type AccountConsumerScan } from './processDetection';
+import { type CodexAuthSnapshot } from './codexCredentialStore';
 export { getCodexProfilesDir, getCodexProfileHome, getSystemCodexHome, getCodexCredentialStoreMode, } from './codexPaths';
 export type { CodexCredentialStoreMode } from './codexPaths';
 export interface CodexAccountManagerResult extends AccountManagerResult {
@@ -12,11 +14,11 @@ export interface CodexAccountManagerResult extends AccountManagerResult {
 }
 export declare const CODEX_KEYRING_FIX_HINT = "Set `cli_auth_credentials_store = \"file\"` in ~/.codex/config.toml and run `codex login` again.";
 export declare function getCodexMonitoringHomes(): string[];
-/**
- * The single chokepoint for storing a Codex credential in a profile: the raw
- * `auth.json` bytes (never re-serialized), the legacy `.credentials.json`
- * when present, and the secret-free health sidecar.
- */
+/** Read the freshest saved login without creating a CLI-usable copy. */
+export declare function readStoredCodexAccount(profileId: string): CodexAuthSnapshot | null;
+export declare function isLiveCodexProfile(profile: SavedAccountProfile): boolean;
+/** Caller holds the swap lock. Live-account credentials only enter private storage. */
+export declare function storeCodexProfileAuthUnlocked(profileId: string, authRaw: string | null, legacyRaw: string | null, source: AccountHealthSource): void;
 export declare function storeCodexProfileAuth(profileId: string, authRaw: string | null, legacyRaw: string | null, source: AccountHealthSource): void;
 interface CodexLoginStatus {
     loggedIn: boolean;
@@ -34,7 +36,6 @@ export declare function readCodexAccountMetadata(codexHome: string): AccountIden
 /** {@link readCodexAccountMetadata} without blocking the event loop on the CLI probe. */
 export declare function readCodexAccountMetadataAsync(codexHome: string): Promise<AccountIdentityMetadata>;
 export declare function isCodexProfileAuthenticated(codexHome: string): boolean;
-/** {@link isCodexProfileAuthenticated} without blocking the event loop on the CLI probe. */
 export declare function isCodexProfileAuthenticatedAsync(codexHome: string): Promise<boolean>;
 export declare function listCodexAccounts(): SavedAccountProfile[];
 export declare function getActiveCodexAccount(): SavedAccountProfile | null;
@@ -56,13 +57,18 @@ export declare function resolveActiveCodexAccount(options?: {
     selfHeal?: boolean;
 }): ResolvedActiveAccount;
 export declare function getCodexExecutionEnv(baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-export declare function prepareCodexAccount(label: string): CodexAccountManagerResult;
-/** {@link prepareCodexAccount} without blocking the event loop on CLI probes. */
-export declare function prepareCodexAccountAsync(label: string): Promise<CodexAccountManagerResult>;
+/** Legacy callers can import current; explicit sign-in passes importCurrent: false. */
+export declare function prepareCodexAccount(label: string, options?: {
+    importCurrent?: boolean;
+}): CodexAccountManagerResult;
+export declare function prepareCodexAccountAsync(label: string, options?: {
+    importCurrent?: boolean;
+}): Promise<CodexAccountManagerResult>;
+/** Removes only a pending login, never a registered canonical profile. */
+export declare function discardCodexLogin(id: string): void;
 export declare function finalizeCodexAccount(profileId: string, opts?: {
     activate?: boolean;
 }): CodexAccountManagerResult;
-/** {@link finalizeCodexAccount} without blocking the event loop on CLI probes. */
 export declare function finalizeCodexAccountAsync(profileId: string, opts?: {
     activate?: boolean;
 }): Promise<CodexAccountManagerResult>;
@@ -75,33 +81,33 @@ export declare function finalizeCodexAccountAsync(profileId: string, opts?: {
  * child process while holding it.
  */
 export declare function withCodexAuthSwapLock<T>(operation: () => T): T;
-/**
- * Merge duplicate Codex profiles (same workspace, else same email). The oldest
- * profile keeps its id and label, receives the freshest `auth.json` and the
- * quota snapshot, and the active pointer; losers are stashed, never deleted.
- * Returns the removed ids. Caller holds the swap lock.
- */
-export declare function dedupeCodexProfiles(): string[];
-/**
- * Fold the live `auth.json` into the saved profiles: register an unknown login
- * (label = email), refresh the matching profile's backup when the live file is
- * newer, and re-point the active pointer at it. Caller holds the swap lock.
- * Never throws; problems land in `warnings`.
- */
+/** Merge owned profiles only after preserving their newest login in a verified backup. */
+export declare function dedupeCodexProfiles(scan?: AccountConsumerScan): string[];
+export declare function hasPendingCodexRepair(): boolean;
+/** No subprocesses inside this function: hosts resolve process scans before taking the lock. */
 export declare function syncCodexLiveStateUnlocked(source?: AccountHealthSource, probes?: {
+    scan?: AccountConsumerScan;
     systemKeyringLoggedIn?: boolean;
 }): ProviderSyncReport;
-/** {@link syncCodexLiveStateUnlocked} under the swap lock. */
 export declare function syncCodexLiveState(source?: AccountHealthSource): ProviderSyncReport;
-/**
- * Remove isolated login homes that never authenticated once they are older
- * than `olderThanMs`. Returns the removed profile ids.
- */
-export declare function cleanupAbandonedCodexLogins(olderThanMs?: number, now?: number): string[];
+export declare function syncCodexLiveStateAsync(source?: AccountHealthSource): Promise<ProviderSyncReport>;
+/** Only abandoned Sidekick-owned login homes; authenticated copies are preserved privately first. */
+export declare function cleanupAbandonedCodexLogins(olderThanMs?: number, now?: number, scan?: AccountConsumerScan): string[];
 export declare function switchToCodexAccount(profileId: string, options?: SwitchAccountOptions): SwitchAccountResult;
-/** {@link switchToCodexAccount} without blocking the event loop on CLI probes. */
 export declare function switchToCodexAccountAsync(profileId: string, options?: SwitchAccountOptions): Promise<SwitchAccountResult>;
+/** Legacy migration entry points now use the same guarded reconciliation as ordinary sync. */
 export declare function reconcileCodexAuthState(): void;
-/** {@link reconcileCodexAuthState} without blocking the event loop on CLI probes. */
 export declare function reconcileCodexAuthStateAsync(): Promise<void>;
+export declare function getCodexKeepAliveBlocker(id: string): string | null;
+export declare function beginCodexKeepAlive(id: string, leaseMs: number): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function finishCodexKeepAlive(id: string): void;
+export declare function restoreCodexProfileFromBackup(id: string, options?: {
+    restore?: boolean;
+}): 'restored' | 'present' | 'live' | 'none';
 export declare function removeCodexAccount(profileId: string): AccountManagerResult;
+export declare function cleanupAbandonedCodexLoginsAsync(olderThanMs?: number, now?: number): Promise<string[]>;