sidekick-shared 0.27.5 → 0.27.6

package/dist/credentialIO.d.ts

@@ -7,30 +7,90 @@
  * Keychain is unavailable (locked, SSH) Claude Code falls back to the file on
  * macOS too, so reads consult the file after a Keychain miss.
  *
+ * Keychain writes mirror Claude Code 2.1.x exactly: the payload is hex-encoded
+ * (`-X`) and sent through `security -i` only while the command line fits the
+ * tool's line buffer; longer payloads go through argv. `security -i` silently
+ * truncates longer lines, which once stored half a credential (the `mcpOAuth`
+ * tokens make blobs of 4 KB and more) — a login Claude Code then reports as
+ * "Not logged in". Every write is read back and compared before it counts.
+ *
  * Both accounts.ts and credentials.ts consume this module so that all
  * credential access is platform-correct in one place.
  */
 export declare const KEYCHAIN_SERVICE = "Claude Code-credentials";
+/**
+ * Claude Code's ceiling for a `security -i` command line (the tool reads at
+ * most 4095 bytes per line). Longer commands go through argv instead.
+ */
+export declare const SECURITY_INTERACTIVE_LINE_LIMIT = 4032;
+/**
+ * Written as the item comment (`-j`) on every Keychain item Sidekick creates,
+ * so ownership is provable from the item itself even after its directory and
+ * the ledger that described it are gone.
+ */
+export declare const SIDEKICK_KEYCHAIN_COMMENT_PREFIX = "sidekick-agent-hub:";
+export type ClaudeCredentialStoreSource = 'keychain' | 'file';
+/**
+ * Outcome of reading one credential store. `error` (timeout, locked Keychain)
+ * is never treated like `absent`: guard decisions that may overwrite a store
+ * only proceed on a definite answer.
+ */
+export type ClaudeCredentialStoreRead = {
+    status: 'ok';
+    blob: Record<string, unknown>;
+    source: ClaudeCredentialStoreSource;
+} | {
+    status: 'absent';
+} | {
+    status: 'corrupt';
+    source: ClaudeCredentialStoreSource;
+    length: number;
+} | {
+    status: 'error';
+    reason: string;
+};
+/** A credential write that did not land, or could not be verified. */
+export declare class ClaudeCredentialWriteError extends Error {
+    constructor(message: string);
+}
+/**
+ * Read one Claude credential store with a definite outcome. On macOS the
+ * Keychain item is authoritative; the file is consulted only when the item is
+ * absent (Claude Code's own fallback), unless `keychainOnly` is set.
+ */
+export declare function readClaudeCredentialStore(configDir?: string, options?: {
+    keychainOnly?: boolean;
+}): ClaudeCredentialStoreRead;
 /**
  * Read the active Claude Code credentials as a parsed object.
  *
  * - macOS: reads from system Keychain via the `security` CLI, then the file
  * - Linux / WSL / Windows: reads `<home>/.credentials.json`
  *
- * Returns `null` when credentials are absent or unreadable.
+ * Returns `null` when credentials are absent or unreadable. Callers that must
+ * tell "absent" from "could not read" use {@link readClaudeCredentialStore}.
  */
 export declare function readActiveCredentials(configDir?: string): unknown;
 /**
- * Write credentials to the active Claude Code credential store.
+ * Write credentials to a profile home's Claude Code credential store.
  *
- * - macOS: writes to system Keychain via the `security` CLI
- * - Linux / WSL / Windows: atomic-writes `<home>/.credentials.json`
+ * - macOS: the suffixed Keychain item for `configDir`
+ * - Linux / WSL / Windows: atomic-writes `<configDir>/.credentials.json`
  *
- * Throws on failure.
+ * `configDir` is required: the live store is written only through the guarded
+ * installer in accounts.ts, which refuses downgrades and captures the outgoing
+ * login first. Throws {@link ClaudeCredentialWriteError} when the write did
+ * not land intact.
  */
 export declare function writeActiveCredentials(credentials: unknown, configDir?: string): void;
+/**
+ * Write the live store with no guard. Internal: the only caller is
+ * `installIntoLiveClaudeStore` in accounts.ts (a test enforces this).
+ */
+export declare function writeLiveClaudeCredentialStoreUnguarded(credentials: unknown): void;
 /**
  * Remove the credential store of a config directory (an abandoned isolated
- * login, a removed profile). Best effort: never throws.
+ * login, a removed profile, the profile home of the account that became
+ * live). Never throws; returns true when the store is gone afterwards.
  */
-export declare function deleteStoredCredentials(configDir: string): void;
+export declare function deleteStoredCredentials(configDir: string): boolean;

package/dist/credentialIO.js

@@ -8,6 +8,13 @@
  * Keychain is unavailable (locked, SSH) Claude Code falls back to the file on
  * macOS too, so reads consult the file after a Keychain miss.
  *
+ * Keychain writes mirror Claude Code 2.1.x exactly: the payload is hex-encoded
+ * (`-X`) and sent through `security -i` only while the command line fits the
+ * tool's line buffer; longer payloads go through argv. `security -i` silently
+ * truncates longer lines, which once stored half a credential (the `mcpOAuth`
+ * tokens make blobs of 4 KB and more) — a login Claude Code then reports as
+ * "Not logged in". Every write is read back and compared before it counts.
+ *
  * Both accounts.ts and credentials.ts consume this module so that all
  * credential access is platform-correct in one place.
  */
@@ -45,17 +52,41 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KEYCHAIN_SERVICE = void 0;
+exports.ClaudeCredentialWriteError = exports.SIDEKICK_KEYCHAIN_COMMENT_PREFIX = exports.SECURITY_INTERACTIVE_LINE_LIMIT = exports.KEYCHAIN_SERVICE = void 0;
+exports.readClaudeCredentialStore = readClaudeCredentialStore;
 exports.readActiveCredentials = readActiveCredentials;
 exports.writeActiveCredentials = writeActiveCredentials;
+exports.writeLiveClaudeCredentialStoreUnguarded = writeLiveClaudeCredentialStoreUnguarded;
 exports.deleteStoredCredentials = deleteStoredCredentials;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const claudeProfiles_1 = require("./claudeProfiles");
+const claudeCredentialLedger_1 = require("./claudeCredentialLedger");
 const atomic_1 = require("./writers/atomic");
 exports.KEYCHAIN_SERVICE = 'Claude Code-credentials';
 const SECURITY_TIMEOUT_MS = 4000;
+/** `security` exits with this status when no item matches. */
+const SECURITY_ITEM_NOT_FOUND = 44;
+/**
+ * Claude Code's ceiling for a `security -i` command line (the tool reads at
+ * most 4095 bytes per line). Longer commands go through argv instead.
+ */
+exports.SECURITY_INTERACTIVE_LINE_LIMIT = 4032;
+/**
+ * Written as the item comment (`-j`) on every Keychain item Sidekick creates,
+ * so ownership is provable from the item itself even after its directory and
+ * the ledger that described it are gone.
+ */
+exports.SIDEKICK_KEYCHAIN_COMMENT_PREFIX = 'sidekick-agent-hub:';
+/** A credential write that did not land, or could not be verified. */
+class ClaudeCredentialWriteError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ClaudeCredentialWriteError';
+    }
+}
+exports.ClaudeCredentialWriteError = ClaudeCredentialWriteError;
 function quoteSecurityInteractiveArg(value) {
     // `security -i` is not a POSIX shell: adjacent quoted segments do NOT
     // concatenate (so the shell-style '\'' splice splits the token), and
@@ -65,27 +96,69 @@ function quoteSecurityInteractiveArg(value) {
 function getCredentialsFilePath(configDir) {
     return path.join(configDir ?? (0, claudeProfiles_1.getLiveClaudeHome)(), '.credentials.json');
 }
-function readCredentialsFile(configDir) {
+function parseStoredText(raw, source) {
+    const text = raw.trim();
+    if (!text)
+        return { status: 'corrupt', source, length: 0 };
+    // `security -w` prints hex when the stored bytes are not plain text.
+    const decoded = source === 'keychain' && !text.startsWith('{') && /^(?:[0-9a-f]{2})+$/i.test(text)
+        ? Buffer.from(text, 'hex').toString('utf8')
+        : text;
     try {
-        return JSON.parse(fs.readFileSync(getCredentialsFilePath(configDir), 'utf8'));
+        const parsed = JSON.parse(decoded);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return { status: 'ok', blob: parsed, source };
+        }
     }
     catch {
-        return null;
+        /* fall through */
     }
+    return { status: 'corrupt', source, length: decoded.length };
 }
-function readKeychainItem(service) {
+function readCredentialsFileStore(configDir) {
+    let raw;
     try {
-        const raw = (0, child_process_1.execFileSync)('security', ['find-generic-password', '-s', service, '-w'], {
+        raw = fs.readFileSync(getCredentialsFilePath(configDir), 'utf8');
+    }
+    catch (error) {
+        return error.code === 'ENOENT'
+            ? { status: 'absent' }
+            : { status: 'error', reason: String(error.message ?? error) };
+    }
+    return parseStoredText(raw, 'file');
+}
+function securityErrorStatus(error) {
+    const status = error.status;
+    return typeof status === 'number' ? status : null;
+}
+function readKeychainStore(service) {
+    try {
+        const raw = (0, child_process_1.execFileSync)('security', ['find-generic-password', '-a', (0, claudeProfiles_1.claudeKeychainAccountName)(), '-s', service, '-w'], {
             encoding: 'utf8',
             stdio: ['pipe', 'pipe', 'pipe'],
             timeout: SECURITY_TIMEOUT_MS,
             killSignal: 'SIGKILL',
         });
-        return JSON.parse(raw.trim());
+        return parseStoredText(String(raw), 'keychain');
     }
-    catch {
-        return null;
+    catch (error) {
+        if (securityErrorStatus(error) === SECURITY_ITEM_NOT_FOUND)
+            return { status: 'absent' };
+        return { status: 'error', reason: String(error?.message ?? error) };
+    }
+}
+/**
+ * Read one Claude credential store with a definite outcome. On macOS the
+ * Keychain item is authoritative; the file is consulted only when the item is
+ * absent (Claude Code's own fallback), unless `keychainOnly` is set.
+ */
+function readClaudeCredentialStore(configDir, options = {}) {
+    if (process.platform === 'darwin') {
+        const keychain = readKeychainStore((0, claudeProfiles_1.claudeKeychainService)(configDir));
+        if (keychain.status !== 'absent' || options.keychainOnly)
+            return keychain;
     }
+    return readCredentialsFileStore(configDir);
 }
 /**
  * Read the active Claude Code credentials as a parsed object.
@@ -93,69 +166,160 @@ function readKeychainItem(service) {
  * - macOS: reads from system Keychain via the `security` CLI, then the file
  * - Linux / WSL / Windows: reads `<home>/.credentials.json`
  *
- * Returns `null` when credentials are absent or unreadable.
+ * Returns `null` when credentials are absent or unreadable. Callers that must
+ * tell "absent" from "could not read" use {@link readClaudeCredentialStore}.
  */
 function readActiveCredentials(configDir) {
     if (process.platform === 'darwin') {
-        return readKeychainItem((0, claudeProfiles_1.claudeKeychainService)(configDir)) ?? readCredentialsFile(configDir);
+        const keychain = readKeychainStore((0, claudeProfiles_1.claudeKeychainService)(configDir));
+        if (keychain.status === 'ok')
+            return keychain.blob;
     }
-    return readCredentialsFile(configDir);
+    const file = readCredentialsFileStore(configDir);
+    return file.status === 'ok' ? file.blob : null;
+}
+function runKeychainWrite(service, hex, comment) {
+    const account = (0, claudeProfiles_1.claudeKeychainAccountName)();
+    const args = ['add-generic-password', '-U', '-a', account, '-s', service];
+    const interactive = [
+        'add-generic-password',
+        '-U',
+        '-a',
+        quoteSecurityInteractiveArg(account),
+        '-s',
+        quoteSecurityInteractiveArg(service),
+    ];
+    if (comment) {
+        args.push('-j', comment);
+        interactive.push('-j', quoteSecurityInteractiveArg(comment));
+    }
+    args.push('-X', hex);
+    interactive.push('-X', quoteSecurityInteractiveArg(hex));
+    const line = `${interactive.join(' ')}\n`;
+    if (Buffer.byteLength(line, 'utf8') <= exports.SECURITY_INTERACTIVE_LINE_LIMIT) {
+        (0, child_process_1.execFileSync)('security', ['-i'], {
+            input: line,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: SECURITY_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+        });
+        return;
+    }
+    // The same trade-off Claude Code makes for large payloads: the hex is on the
+    // command line (visible to `ps`) for the duration of this call.
+    (0, child_process_1.execFileSync)('security', args, {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: SECURITY_TIMEOUT_MS,
+        killSignal: 'SIGKILL',
+    });
 }
 /**
- * Write credentials to the active Claude Code credential store.
- *
- * - macOS: writes to system Keychain via the `security` CLI
- * - Linux / WSL / Windows: atomic-writes `<home>/.credentials.json`
- *
- * Throws on failure.
+ * Write a credential blob to a store and verify it by reading it back.
+ * `configDir` undefined targets the live home; only the guarded live installer
+ * in accounts.ts may do that (see {@link writeLiveClaudeCredentialStoreUnguarded}).
  */
-function writeActiveCredentials(credentials, configDir) {
+function writeClaudeCredentialStore(credentials, configDir) {
     const json = JSON.stringify(credentials);
-    JSON.parse(json); // validate round-trip
+    let expected;
+    try {
+        expected = JSON.stringify(JSON.parse(json));
+    }
+    catch {
+        throw new ClaudeCredentialWriteError('Refusing to store a credential that is not JSON.');
+    }
     if (process.platform === 'darwin') {
         const service = (0, claudeProfiles_1.claudeKeychainService)(configDir);
-        const command = [
-            'add-generic-password',
-            '-U',
+        const comment = configDir
+            ? `${exports.SIDEKICK_KEYCHAIN_COMMENT_PREFIX}${path.resolve(configDir)}`
+            : null;
+        try {
+            runKeychainWrite(service, Buffer.from(json, 'utf8').toString('hex'), comment);
+        }
+        catch (error) {
+            throw new ClaudeCredentialWriteError(`Keychain write failed: ${error?.message ?? error}`);
+        }
+        const readBack = readKeychainStore(service);
+        if (readBack.status === 'error') {
+            throw new ClaudeCredentialWriteError('The Keychain write could not be verified (read-back failed); treating it as not written.');
+        }
+        if (readBack.status !== 'ok' || JSON.stringify(readBack.blob) !== expected) {
+            throw new ClaudeCredentialWriteError('The Keychain item did not hold the credential after writing it.');
+        }
+        return;
+    }
+    // Linux / WSL / Windows — file-based (tmp + fsync + rename, retried on Windows)
+    (0, atomic_1.atomicWriteFileSync)(getCredentialsFilePath(configDir), json, 0o600);
+    const readBack = readCredentialsFileStore(configDir);
+    if (readBack.status !== 'ok' || JSON.stringify(readBack.blob) !== expected) {
+        throw new ClaudeCredentialWriteError('The credentials file did not hold the credential after writing it.');
+    }
+}
+/**
+ * Write credentials to a profile home's Claude Code credential store.
+ *
+ * - macOS: the suffixed Keychain item for `configDir`
+ * - Linux / WSL / Windows: atomic-writes `<configDir>/.credentials.json`
+ *
+ * `configDir` is required: the live store is written only through the guarded
+ * installer in accounts.ts, which refuses downgrades and captures the outgoing
+ * login first. Throws {@link ClaudeCredentialWriteError} when the write did
+ * not land intact.
+ */
+function writeActiveCredentials(credentials, configDir) {
+    if (!configDir) {
+        throw new ClaudeCredentialWriteError('writeActiveCredentials() needs a config directory; the live Claude login is only written through a guarded account switch.');
+    }
+    (0, claudeCredentialLedger_1.recordClaudeCredentialHome)(configDir, 'profile');
+    writeClaudeCredentialStore(credentials, configDir);
+}
+/**
+ * Write the live store with no guard. Internal: the only caller is
+ * `installIntoLiveClaudeStore` in accounts.ts (a test enforces this).
+ */
+function writeLiveClaudeCredentialStoreUnguarded(credentials) {
+    writeClaudeCredentialStore(credentials, undefined);
+}
+function deleteKeychainItem(service, withAccount) {
+    try {
+        (0, child_process_1.execFileSync)('security', [
+            'delete-generic-password',
+            ...(withAccount ? ['-a', (0, claudeProfiles_1.claudeKeychainAccountName)()] : []),
             '-s',
-            quoteSecurityInteractiveArg(service),
-            '-a',
-            quoteSecurityInteractiveArg((0, claudeProfiles_1.claudeKeychainAccountName)()),
-            '-w',
-            quoteSecurityInteractiveArg(json),
-        ].join(' ');
-        (0, child_process_1.execFileSync)('security', ['-i'], {
-            input: command + '\n',
-            stdio: ['pipe', 'pipe', 'pipe'],
+            service,
+        ], {
+            stdio: ['ignore', 'ignore', 'ignore'],
             timeout: SECURITY_TIMEOUT_MS,
             killSignal: 'SIGKILL',
         });
-        return;
+        return 'deleted';
+    }
+    catch (error) {
+        return securityErrorStatus(error) === SECURITY_ITEM_NOT_FOUND ? 'absent' : 'error';
     }
-    // Linux / WSL / Windows — file-based (tmp + fsync + rename, retried on Windows)
-    (0, atomic_1.atomicWriteFileSync)(getCredentialsFilePath(configDir), json, 0o600);
 }
 /**
  * Remove the credential store of a config directory (an abandoned isolated
- * login, a removed profile). Best effort: never throws.
+ * login, a removed profile, the profile home of the account that became
+ * live). Never throws; returns true when the store is gone afterwards.
  */
 function deleteStoredCredentials(configDir) {
+    let gone = true;
     if (process.platform === 'darwin') {
-        try {
-            (0, child_process_1.execFileSync)('security', ['delete-generic-password', '-s', (0, claudeProfiles_1.claudeKeychainService)(configDir)], {
-                stdio: ['ignore', 'ignore', 'ignore'],
-                timeout: SECURITY_TIMEOUT_MS,
-                killSignal: 'SIGKILL',
-            });
-        }
-        catch {
-            /* no item, or keychain unavailable */
-        }
+        const service = (0, claudeProfiles_1.claudeKeychainService)(configDir);
+        let outcome = deleteKeychainItem(service, true);
+        // Items written before the account name was pinned may carry another one.
+        if (outcome === 'absent')
+            outcome = deleteKeychainItem(service, false);
+        if (outcome === 'error')
+            gone = false;
     }
     try {
         fs.rmSync(getCredentialsFilePath(configDir), { force: true });
     }
     catch {
-        /* best effort */
+        gone = false;
     }
+    if (gone)
+        (0, claudeCredentialLedger_1.forgetClaudeCredentialHome)(configDir);
+    return gone;
 }

package/dist/ensureDefaultAccounts.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureDefaultAccounts = ensureDefaultAccounts;
 const accounts_1 = require("./accounts");
-const codexProfiles_1 = require("./codexProfiles");
 const accountSync_1 = require("./accountSync");
 function logFailure(options, message, error) {
     try {
@@ -35,13 +34,7 @@ async function ensureDefaultAccounts(options) {
         logFailure(options, 'Claude auth reconciliation failed.', error);
     }
     try {
-        await (0, codexProfiles_1.reconcileCodexAuthStateAsync)();
-    }
-    catch (error) {
-        logFailure(options, 'Codex auth reconciliation failed.', error);
-    }
-    try {
-        (0, accountSync_1.cleanupAbandonedLogins)();
+        await (0, accountSync_1.cleanupAbandonedLoginsAsync)();
     }
     catch (error) {
         logFailure(options, 'Abandoned login cleanup failed.', error);

package/dist/index.d.ts

@@ -165,10 +165,17 @@ export { calculateCompactionLedger, formatCompactionLedger } from './analytics/c
 export type { CompactionLedger } from './analytics/compactionLedger';
 export { generateHtmlReport, parseTranscript, parseTranscriptFromEvents, openInBrowser, } from './report';
 export type { TranscriptContentBlock, TranscriptEntry, HtmlReportOptions } from './report';
-export { readActiveCredentials, writeActiveCredentials, deleteStoredCredentials, } from './credentialIO';
+export { readActiveCredentials, readClaudeCredentialStore, writeActiveCredentials, deleteStoredCredentials, ClaudeCredentialWriteError, SIDEKICK_KEYCHAIN_COMMENT_PREFIX, } from './credentialIO';
+export type { ClaudeCredentialStoreRead, ClaudeCredentialStoreSource } from './credentialIO';
+export { decideLiveClaudeWrite } from './claudeLiveGuard';
+export type { LiveClaudeStoreState, LiveClaudeWriteDecision, LiveClaudeWriteIntent, LiveClaudeWriteRefusal, LiveClaudeWriteRequest, } from './claudeLiveGuard';
+export { readClaudeCredentialLedger, getClaudeCredentialLedgerPath, } from './claudeCredentialLedger';
+export type { ClaudeCredentialLedgerEntry, ClaudeCredentialHomePurpose, } from './claudeCredentialLedger';
+export { inspectClaudeCredentialStores, repairClaudeCredentialStores, parseKeychainDump, } from './claudeCredentialDoctor';
+export type { ClaudeCredentialFinding, ClaudeCredentialFindingKind, ClaudeCredentialInspection, ClaudeCredentialRepairOutcome, ClaudeCredentialRepairResult, InspectClaudeCredentialStoresOptions, KeychainItemSummary, } from './claudeCredentialDoctor';
 export { readClaudeMaxCredentials, readClaudeMaxCredentialsRaw, readClaudeMaxAccessTokenSync, } from './credentials';
 export type { ClaudeMaxCredentials } from './credentials';
-export { parseClaudeCredentialBlob, claudeCredentialFreshness, isNewerClaudeCredential, resolveClaudeRefreshExpiry, CLAUDE_ACCESS_TOKEN_LIFETIME_MS, CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS, } from './claudeCredentials';
+export { parseClaudeCredentialBlob, claudeCredentialFreshness, isNewerClaudeCredential, resolveClaudeRefreshExpiry, claudeRefreshFingerprint, claudeLoginOnly, mergeClaudeLoginIntoLive, CLAUDE_ACCESS_TOKEN_LIFETIME_MS, CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS, } from './claudeCredentials';
 export type { ClaudeOauthCredentials } from './claudeCredentials';
 export { parseAuthJson as parseCodexAuthJson, readAuthIdentityFromRaw as readCodexAuthIdentity, readLastRefresh as readCodexLastRefresh, readAccessTokenExpiry as readCodexAccessTokenExpiry, identitiesMatch as codexIdentitiesMatch, } from './codexAuth';
 export type { CodexAuthIdentity, CodexAuthJsonFile } from './codexAuth';
@@ -176,7 +183,7 @@ export { ensureDefaultAccounts } from './ensureDefaultAccounts';
 export type { EnsureDefaultAccountStatus, EnsureDefaultAccountsOptions, EnsureDefaultAccountsResult, } from './ensureDefaultAccounts';
 export { readAccountRegistry, writeAccountRegistry, readActiveClaudeAccount, addCurrentAccount, switchToAccount, switchToAccountAsync, syncClaudeLiveState, cleanupAbandonedClaudeLogins, resolveActiveClaudeHome, applyActiveClaudeToLiveHome, reconcileClaudeAuthState, removeAccount, listAccounts, getActiveAccount, resolveActiveClaudeAccount, isMultiAccountEnabled, } from './accounts';
 export type { AccountEntry, AccountRegistry, ActiveAccountInfo, AccountManagerResult, } from './accounts';
-export { beginAccountLogin, getAccountLoginStatus, getAccountLoginStatusAsync, finalizeAccountLogin, finalizeAccountLoginAsync, spawnAccountLogin, switchAccount, switchAccountAsync, undoLastSwitch, getLastSwitch, listAllAccounts, resolveClaudeLoginCommand, } from './accountManager';
+export { beginAccountLogin, getAccountLoginStatus, getAccountLoginStatusAsync, finalizeAccountLogin, finalizeAccountLoginAsync, spawnAccountLogin, switchAccount, switchAccountAsync, undoLastSwitch, getLastSwitch, listAllAccounts, resolveClaudeLoginCommand, discardAccountLogin, } from './accountManager';
 export type { AccountLoginCommand, AccountLoginState, AccountLoginStatus, BeginAccountLoginOptions, BeginAccountLoginResult, BeginAccountLoginSuccess, FinalizeAccountLoginOptions, ListAllAccountsResult, SpawnAccountLoginOptions, } from './accountManager';
 export { readLastSwitch, getLastSwitchPath } from './accountSwitch';
 export type { LastSwitchRecord, SwitchAccountOptions, SwitchAccountResult, SwitchVerification, } from './accountSwitch';
@@ -202,7 +209,7 @@ export { getClaudeProfilesDir, getClaudeProfileHome, getLiveClaudeHome, getDefau
 export type { ClaudeProfileIdentity } from './claudeProfiles';
 export { getCodexProfilesDir, getCodexProfileHome, getCodexMonitoringHomes, getSystemCodexHome, listCodexAccounts, getActiveCodexAccount, resolveActiveCodexAccount, resolveSidekickCodexHome, getCodexExecutionEnv, prepareCodexAccount, prepareCodexAccountAsync, finalizeCodexAccount, finalizeCodexAccountAsync, switchToCodexAccount, switchToCodexAccountAsync, removeCodexAccount, syncCodexLiveState, cleanupAbandonedCodexLogins, getCodexCredentialStoreMode, CODEX_KEYRING_FIX_HINT, } from './codexProfiles';
 export type { CodexAccountManagerResult, CodexCredentialStoreMode } from './codexProfiles';
-export { writeLauncher, removeLauncher } from './terminalSync';
+export { writeAccountLauncher, writeLauncher, removeLauncher } from './terminalSync';
 export { DEFAULT_AUTO_SWITCH_CONFIG, decideAutoSwitch, AutoSwitchController } from './autoSwitch';
 export type { AutoSwitchActiveAccount, AutoSwitchCandidate, AutoSwitchConfig, AutoSwitchControllerOptions, AutoSwitchDecision, AutoSwitchTransitionEvent, } from './autoSwitch';
 export { FIVE_HOUR_WINDOW_MS, QUOTA_PROVIDER_IDS, SEVEN_DAY_WINDOW_MS, fetchQuota, projectQuotaWindow, withQuotaProjections, } from './quota';
@@ -275,3 +282,6 @@ export { diagnoseProviderFailure } from './providerFailure';
 export type { ProviderCredentialKind, ProviderAuthenticationEvidence, ProviderFailureInput, ProviderFailureCode, ProviderRecoveryAction, ProviderRetryAfter, ProviderFailureEvidence, ProviderFailureDiagnosis, } from './providerFailure';
 export type { ProviderServiceSeverity, ProviderServiceComponent, ProviderServiceIncident, ProviderServiceStatusFailureReason, ObservedProviderServiceStatus, UnavailableProviderServiceStatus, ProviderServiceStatus, FetchProviderServiceStatusOptions, } from './providerServiceStatusTypes';
 export { fetchProviderServiceStatus } from './providerServiceStatus';
+export { inspectCodexCredentialStores, repairCodexCredentialStores } from './codexCredentialDoctor';
+export type { CodexCredentialFinding, CodexCredentialInspection, CodexCredentialRepairResult, } from './codexCredentialDoctor';
+export { readStoredCodexAccount, syncCodexLiveStateAsync } from './codexProfiles';

package/dist/index.js

@@ -8,12 +8,12 @@ exports.updateJsonStoreAtomic = exports.atomicWriteFileSync = exports.atomicWrit
 exports.classifySessionActivity = exports.subagentTokenTotals = exports.scanSessionSubagents = exports.readMainThreadTokenTotals = exports.combineSessionTokenTotals = exports.collectSessionTokenTotals = exports.addUsageToSubagent = exports.normalizeClaudeUsage = exports.dedupedRawClaudeUsage = exports.SYNTHETIC_MODEL = exports.ClaudeUsageDeduper = exports.readAgentMeta = exports.extractTaskInfo = exports.scanSubagentDir = exports.resolveCodexCallUsage = exports.normalizeCodexToolInput = exports.normalizeCodexToolName = exports.extractPatchFilePaths = exports.CodexRolloutParser = exports.parseDbPartData = exports.parseDbMessageData = exports.convertOpenCodeMessage = exports.detectPlanModeFromText = exports.normalizeToolInput = exports.normalizeToolName = exports.TRUNCATION_PATTERNS = exports.JsonlParser = exports.walkRolloutFilesAsync = exports.walkRolloutFiles = exports.findCodexRolloutFile = exports.CodexProvider = exports.getOpenCodeDataDir = exports.OpenCodeProvider = exports.ClaudeCodeProvider = exports.getAllDetectedProviders = exports.detectProvider = exports._resetProviderDetectionCache = exports.getObservedActivityReason = exports.derivePendingUserRequestV1 = exports.createProviderSessionAdapterV1 = exports.createSessionProviders = exports.SESSION_PROVIDER_IDS = exports.renderHandoffUrlTemplate = exports.addNote = exports.decisionFingerprint = exports.addDecision = exports.completeTask = exports.addTask = exports.withFileLockSync = exports.updateJsonStoreAtomicSync = void 0;
 exports.toFollowEvents = exports.resolveSessionPath = exports.createWatcher = exports.parseChangelog = exports.extractProposedPlanShared = exports.parsePlanMarkdownShared = exports.PlanExtractor = exports.segmentAssistantTurn = exports.reasoningSummary = exports.isAssistantTurnSubagentTool = exports.extractTurnSubagents = exports.assistantTurnEventsFromSessionEvents = exports.readSessionContextSnapshot = exports.createSessionContextProjector = exports.calculateSessionContextPressure = exports.buildSessionContextSnapshot = exports.composeContext = exports.FilterEngine = exports.searchSessions = exports.CodexDatabase = exports.OpenCodeDatabase = exports.discoverDebugLogs = exports.collapseDuplicates = exports.filterByLevel = exports.parseDebugLog = exports.readSessionPreviewAsync = exports.readSessionPreview = exports.listSessionPreviewsAsync = exports.listSessionPreviews = exports.readCodexHistory = exports.parseMcpToolName = exports.scanSubagentTraces = exports.findAllSessionsWithWorktrees = exports.discoverWorktreeSiblings = exports.resolveWorktreeMainRepo = exports.getAllClaudeProjectFolders = exports.decodeEncodedPath = exports.getMostRecentlyActiveSessionDir = exports.findSubdirectorySessionDirs = exports.findSessionFilesWithStats = exports.findSessionsInDirectory = exports.findAllClaudeSessions = exports.findActiveClaudeSession = exports.discoverSessionDirectory = exports.getClaudeSessionDirectory = exports.encodeClaudeWorkspacePath = exports.SESSION_ACTIVITY_STALENESS_MS = exports.SESSION_ACTIVITY_GRACE_PERIOD_MS = exports.refreshSessionActivityState = exports.detectSessionActivity = void 0;
 exports.parseTranscript = exports.generateHtmlReport = exports.formatCompactionLedger = exports.calculateCompactionLedger = exports.describeCostProvenance = exports.classifyCostProvenance = exports.calculateCodeImpact = exports.scoreSessionQuality = exports.calculateQualityTrend = exports.PatternExtractor = exports.HeatmapTracker = exports.FrequencyTracker = exports.readErrorHistory = exports.getTopFailingTools = exports.appendErrorHistory = exports.MAX_ERROR_HISTORY_SESSIONS = exports.ERROR_HISTORY_SCHEMA_VERSION = exports.getSnapshotPath = exports.MAX_SNAPSHOT_FILES = exports.pruneSnapshots = exports.isSnapshotValid = exports.deleteSnapshot = exports.loadSnapshot = exports.saveSnapshot = exports.SessionMonitor = exports.parseTodoDependencies = exports.EventAggregator = exports.getRandomPhrase = exports.PHRASE_CATEGORIES = exports.ALL_PHRASES = exports.HIGHLIGHT_CSS = exports.clearHighlightCache = exports.highlightEvent = exports.formatSessionJson = exports.formatSessionMarkdown = exports.formatSessionText = exports.classifyNoise = exports.shouldMergeWithPrevious = exports.classifyFollowEvent = exports.classifyMessage = exports.getSoftNoiseReason = exports.isHardNoiseFollowEvent = exports.isHardNoise = exports.formatToolSummary = exports.parseLocalDateKey = exports.formatTokenCount = exports.formatLocalDateKey = exports.formatDurationMs = exports.addLocalDays = exports.createJsonlTail = void 0;
-exports.getLastSwitchPath = exports.readLastSwitch = exports.resolveClaudeLoginCommand = exports.listAllAccounts = exports.getLastSwitch = exports.undoLastSwitch = exports.switchAccountAsync = exports.switchAccount = exports.spawnAccountLogin = exports.finalizeAccountLoginAsync = exports.finalizeAccountLogin = exports.getAccountLoginStatusAsync = exports.getAccountLoginStatus = exports.beginAccountLogin = exports.isMultiAccountEnabled = exports.resolveActiveClaudeAccount = exports.getActiveAccount = exports.listAccounts = exports.removeAccount = exports.reconcileClaudeAuthState = exports.applyActiveClaudeToLiveHome = exports.resolveActiveClaudeHome = exports.cleanupAbandonedClaudeLogins = exports.syncClaudeLiveState = exports.switchToAccountAsync = exports.switchToAccount = exports.addCurrentAccount = exports.readActiveClaudeAccount = exports.writeAccountRegistry = exports.readAccountRegistry = exports.ensureDefaultAccounts = exports.codexIdentitiesMatch = exports.readCodexAccessTokenExpiry = exports.readCodexLastRefresh = exports.readCodexAuthIdentity = exports.parseCodexAuthJson = exports.CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS = exports.CLAUDE_ACCESS_TOKEN_LIFETIME_MS = exports.resolveClaudeRefreshExpiry = exports.isNewerClaudeCredential = exports.claudeCredentialFreshness = exports.parseClaudeCredentialBlob = exports.readClaudeMaxAccessTokenSync = exports.readClaudeMaxCredentialsRaw = exports.readClaudeMaxCredentials = exports.deleteStoredCredentials = exports.writeActiveCredentials = exports.readActiveCredentials = exports.openInBrowser = exports.parseTranscriptFromEvents = void 0;
-exports.getCodexExecutionEnv = exports.resolveSidekickCodexHome = exports.resolveActiveCodexAccount = exports.getActiveCodexAccount = exports.listCodexAccounts = exports.getSystemCodexHome = exports.getCodexMonitoringHomes = exports.getCodexProfileHome = exports.getCodexProfilesDir = exports.readLiveClaudeIdentity = exports.readClaudeProfileIdentity = exports.isClaudeProfileAuthenticated = exports.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV = exports.buildClaudeChildEnv = exports.claudeKeychainAccountName = exports.claudeKeychainService = exports.claudeKeychainSuffix = exports.getClaudeConfigPath = exports.getDefaultClaudeHome = exports.getLiveClaudeHome = exports.getClaudeProfileHome = exports.getClaudeProfilesDir = exports.onAccountsChanged = exports.getActiveAccountStatus = exports.ACCOUNT_PROVIDER_IDS = exports.removeSavedAccountProfile = exports.replaceSavedAccountProfiles = exports.setActiveSavedAccount = exports.upsertSavedAccountProfile = exports.getActiveSavedAccount = exports.listSavedAccountProfiles = exports.writeSavedAccountRegistry = exports.readSavedAccountRegistry = exports.getAccountsDir = exports.ACCOUNT_CONSUMER_REACHABILITY = exports.describeAccountConsumer = exports.detectRunningAccountConsumersSync = exports.detectRunningAccountConsumers = exports.findRunningProcessesSync = exports.findRunningProcesses = exports.keepAliveCommand = exports.refreshInactiveAccounts = exports.getAccountLaunchEnv = exports.getHealthSidecarPath = exports.readHealthSidecar = exports.listAccountsWithHealth = exports.getAccountHealth = exports.cleanupAbandonedLogins = exports.syncLiveAccountStateSync = exports.syncLiveAccountState = void 0;
-exports.quotaStateFromZaiQuotaLimitPayload = exports.fetchZaiQuotaFromApi = exports.CodexQuotaWatcher = exports.resolveCodexQuotaFromLocalSources = exports.resolveCodexQuota = exports.readLatestCodexQuotaFromRollouts = exports.quotaFromCodexRateLimits = exports.fetchCodexQuotaFromApi = exports.fetchCodexResetCreditsFromApi = exports.getWorkspaceIdFromPath = exports.pruneQuotaHistory = exports.readQuotaHistoryDailyBuckets = exports.readQuotaHistoryRange = exports.appendQuotaHistorySample = exports.quotaFromStatuslinePayload = exports.parseClaudeStatuslinePayload = exports.evaluateQuotaThresholds = exports.describeQuotaThresholdAlert = exports.DEFAULT_QUOTA_THRESHOLDS = exports.QUOTA_FRESH_MAX_AGE_MS = exports.QUOTA_AGING_MAX_AGE_MS = exports.formatQuotaAge = exports.classifyQuotaFreshness = exports.resolveQuota = exports.writeQuotaSnapshot = exports.readQuotaSnapshot = exports.QuotaPoller = exports.describeQuotaFailure = exports.withQuotaProjections = exports.projectQuotaWindow = exports.fetchQuota = exports.SEVEN_DAY_WINDOW_MS = exports.QUOTA_PROVIDER_IDS = exports.FIVE_HOUR_WINDOW_MS = exports.AutoSwitchController = exports.decideAutoSwitch = exports.DEFAULT_AUTO_SWITCH_CONFIG = exports.removeLauncher = exports.writeLauncher = exports.CODEX_KEYRING_FIX_HINT = exports.getCodexCredentialStoreMode = exports.cleanupAbandonedCodexLogins = exports.syncCodexLiveState = exports.removeCodexAccount = exports.switchToCodexAccountAsync = exports.switchToCodexAccount = exports.finalizeCodexAccountAsync = exports.finalizeCodexAccount = exports.prepareCodexAccountAsync = exports.prepareCodexAccount = void 0;
-exports.extractToolCalls = exports.extractToolCall = exports.extractErrorMessage = exports.categorizeError = exports.gatherAssetsForCwd = exports.codexSessions = exports.readCodexAssets = exports.claudeSessions = exports.readClaudeAssets = exports.extractCommands = exports.extractFilePaths = exports.extractUrls = exports.extractTokenUsage = exports.getObservedContextWindowPath = exports.recordObservedContextWindow = exports.loadObservedContextWindows = exports.LITELLM_CATALOG_URL = exports.normalizeLiteLlmContextWindows = exports.normalizeLiteLlmCatalog = exports.hydratePricingCatalog = exports.RESOLVED_MODEL_CATALOG_SCHEMA_VERSION = exports.resolveModelAlias = exports.registerModelAlias = exports.importResolvedModelCatalog = exports.exportResolvedModelCatalog = exports.MODEL_PROVIDER_IDS = exports.formatCost = exports.sortModelIds = exports.compareModelIds = exports.getModelDisplayInfo = exports.shortModelName = exports.mergeCostSources = exports.calculateCostWithProvenance = exports.calculateCostWithPricing = exports.calculateCost = exports.getModelInfo = exports.resolveModelPricing = exports.getModelPricing = exports.parseModelId = exports.DEFAULT_CONTEXT_WINDOW = exports.resolveModelContextWindow = exports.getModelContextWindowSize = exports.selectStatuslineAccount = exports.formatStatusline = exports.estimateTimeToQuota = exports.BurnRateCalculator = exports.RUNTIME_QUOTA_PROVIDER_IDS = exports.MultiProviderQuotaService = exports.resolveZaiQuota = exports.readZaiCredentials = void 0;
-exports.getSessionDiagnostics = exports.formatHealthReport = exports.toLegacyProviderStatus = exports.fetchOpenAIStatus = exports.fetchProviderStatus = exports.assistantTurnToolRefSchema = exports.assistantTurnToolGroupStepSchema = exports.assistantTurnTimelineItemSchema = exports.assistantTurnSubagentStatusSchema = exports.assistantTurnSubagentSchema = exports.assistantTurnReasoningTimelineItemSchema = exports.assistantTurnProjectionSchema = exports.assistantTurnProcessStepSchema = exports.assistantTurnProcessSchema = exports.assistantTurnNarrationStepSchema = exports.assistantTurnEventTypeSchema = exports.assistantTurnEventSchema = exports.listAllAccountsResultSchema = exports.savedAccountProfileSchema = exports.accountEntrySchema = exports.accountLoginStatusSchema = exports.beginAccountLoginResultSchema = exports.accountManagerResultSchema = exports.accountProviderIdSchema = exports.activeAccountStatusSchema = exports.activeProviderAccountStatusSchema = exports.quotaHistoryDailyBucketSchema = exports.quotaHistorySampleSchema = exports.quotaHistoryRuntimeProviderSchema = exports.providerQuotaMapSchema = exports.zaiProviderQuotaStateSchema = exports.codexProviderQuotaStateSchema = exports.claudeProviderQuotaStateSchema = exports.providerQuotaStateSchema = exports.runtimeQuotaProviderSchema = exports.quotaFailureDescriptorSchema = exports.peakHoursStateSchema = exports.codexResetCreditsSnapshotSchema = exports.codexResetCreditSchema = exports.quotaSourceSchema = exports.quotaProviderIdSchema = exports.quotaFailureKindSchema = exports.quotaStateSchema = exports.quotaWindowSchema = exports.extractSessionEvents = exports.permissionModeSchema = exports.sessionEventSchema = exports.sessionMessageSchema = exports.messageUsageSchema = exports.ToolCallTracker = void 0;
-exports.fetchProviderServiceStatus = exports.diagnoseProviderFailure = exports.mergeFailingToolWindows = exports.failingToolTrend = exports.FAILING_TOOL_TREND_ARROWS = exports.scopePeakHoursToSessionProvider = exports.PEAK_HOURS_DESCRIPTION = exports.PEAK_HOURS_CACHE_MS = exports.isClaudeCodeSessionProvider = exports.getScheduledPeakHoursState = exports.fetchPeakHoursStatus = exports.DEFAULT_PEAK_HOURS_TIMEOUT_MS = exports.createPeakHoursNotApplicableState = exports._resetPeakHoursCache = exports.runDoctor = void 0;
+exports.getAccountLoginStatus = exports.beginAccountLogin = exports.isMultiAccountEnabled = exports.resolveActiveClaudeAccount = exports.getActiveAccount = exports.listAccounts = exports.removeAccount = exports.reconcileClaudeAuthState = exports.applyActiveClaudeToLiveHome = exports.resolveActiveClaudeHome = exports.cleanupAbandonedClaudeLogins = exports.syncClaudeLiveState = exports.switchToAccountAsync = exports.switchToAccount = exports.addCurrentAccount = exports.readActiveClaudeAccount = exports.writeAccountRegistry = exports.readAccountRegistry = exports.ensureDefaultAccounts = exports.codexIdentitiesMatch = exports.readCodexAccessTokenExpiry = exports.readCodexLastRefresh = exports.readCodexAuthIdentity = exports.parseCodexAuthJson = exports.CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS = exports.CLAUDE_ACCESS_TOKEN_LIFETIME_MS = exports.mergeClaudeLoginIntoLive = exports.claudeLoginOnly = exports.claudeRefreshFingerprint = exports.resolveClaudeRefreshExpiry = exports.isNewerClaudeCredential = exports.claudeCredentialFreshness = exports.parseClaudeCredentialBlob = exports.readClaudeMaxAccessTokenSync = exports.readClaudeMaxCredentialsRaw = exports.readClaudeMaxCredentials = exports.parseKeychainDump = exports.repairClaudeCredentialStores = exports.inspectClaudeCredentialStores = exports.getClaudeCredentialLedgerPath = exports.readClaudeCredentialLedger = exports.decideLiveClaudeWrite = exports.SIDEKICK_KEYCHAIN_COMMENT_PREFIX = exports.ClaudeCredentialWriteError = exports.deleteStoredCredentials = exports.writeActiveCredentials = exports.readClaudeCredentialStore = exports.readActiveCredentials = exports.openInBrowser = exports.parseTranscriptFromEvents = void 0;
+exports.buildClaudeChildEnv = exports.claudeKeychainAccountName = exports.claudeKeychainService = exports.claudeKeychainSuffix = exports.getClaudeConfigPath = exports.getDefaultClaudeHome = exports.getLiveClaudeHome = exports.getClaudeProfileHome = exports.getClaudeProfilesDir = exports.onAccountsChanged = exports.getActiveAccountStatus = exports.ACCOUNT_PROVIDER_IDS = exports.removeSavedAccountProfile = exports.replaceSavedAccountProfiles = exports.setActiveSavedAccount = exports.upsertSavedAccountProfile = exports.getActiveSavedAccount = exports.listSavedAccountProfiles = exports.writeSavedAccountRegistry = exports.readSavedAccountRegistry = exports.getAccountsDir = exports.ACCOUNT_CONSUMER_REACHABILITY = exports.describeAccountConsumer = exports.detectRunningAccountConsumersSync = exports.detectRunningAccountConsumers = exports.findRunningProcessesSync = exports.findRunningProcesses = exports.keepAliveCommand = exports.refreshInactiveAccounts = exports.getAccountLaunchEnv = exports.getHealthSidecarPath = exports.readHealthSidecar = exports.listAccountsWithHealth = exports.getAccountHealth = exports.cleanupAbandonedLogins = exports.syncLiveAccountStateSync = exports.syncLiveAccountState = exports.getLastSwitchPath = exports.readLastSwitch = exports.discardAccountLogin = exports.resolveClaudeLoginCommand = exports.listAllAccounts = exports.getLastSwitch = exports.undoLastSwitch = exports.switchAccountAsync = exports.switchAccount = exports.spawnAccountLogin = exports.finalizeAccountLoginAsync = exports.finalizeAccountLogin = exports.getAccountLoginStatusAsync = void 0;
+exports.quotaFromStatuslinePayload = exports.parseClaudeStatuslinePayload = exports.evaluateQuotaThresholds = exports.describeQuotaThresholdAlert = exports.DEFAULT_QUOTA_THRESHOLDS = exports.QUOTA_FRESH_MAX_AGE_MS = exports.QUOTA_AGING_MAX_AGE_MS = exports.formatQuotaAge = exports.classifyQuotaFreshness = exports.resolveQuota = exports.writeQuotaSnapshot = exports.readQuotaSnapshot = exports.QuotaPoller = exports.describeQuotaFailure = exports.withQuotaProjections = exports.projectQuotaWindow = exports.fetchQuota = exports.SEVEN_DAY_WINDOW_MS = exports.QUOTA_PROVIDER_IDS = exports.FIVE_HOUR_WINDOW_MS = exports.AutoSwitchController = exports.decideAutoSwitch = exports.DEFAULT_AUTO_SWITCH_CONFIG = exports.removeLauncher = exports.writeLauncher = exports.writeAccountLauncher = exports.CODEX_KEYRING_FIX_HINT = exports.getCodexCredentialStoreMode = exports.cleanupAbandonedCodexLogins = exports.syncCodexLiveState = exports.removeCodexAccount = exports.switchToCodexAccountAsync = exports.switchToCodexAccount = exports.finalizeCodexAccountAsync = exports.finalizeCodexAccount = exports.prepareCodexAccountAsync = exports.prepareCodexAccount = exports.getCodexExecutionEnv = exports.resolveSidekickCodexHome = exports.resolveActiveCodexAccount = exports.getActiveCodexAccount = exports.listCodexAccounts = exports.getSystemCodexHome = exports.getCodexMonitoringHomes = exports.getCodexProfileHome = exports.getCodexProfilesDir = exports.readLiveClaudeIdentity = exports.readClaudeProfileIdentity = exports.isClaudeProfileAuthenticated = exports.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV = void 0;
+exports.recordObservedContextWindow = exports.loadObservedContextWindows = exports.LITELLM_CATALOG_URL = exports.normalizeLiteLlmContextWindows = exports.normalizeLiteLlmCatalog = exports.hydratePricingCatalog = exports.RESOLVED_MODEL_CATALOG_SCHEMA_VERSION = exports.resolveModelAlias = exports.registerModelAlias = exports.importResolvedModelCatalog = exports.exportResolvedModelCatalog = exports.MODEL_PROVIDER_IDS = exports.formatCost = exports.sortModelIds = exports.compareModelIds = exports.getModelDisplayInfo = exports.shortModelName = exports.mergeCostSources = exports.calculateCostWithProvenance = exports.calculateCostWithPricing = exports.calculateCost = exports.getModelInfo = exports.resolveModelPricing = exports.getModelPricing = exports.parseModelId = exports.DEFAULT_CONTEXT_WINDOW = exports.resolveModelContextWindow = exports.getModelContextWindowSize = exports.selectStatuslineAccount = exports.formatStatusline = exports.estimateTimeToQuota = exports.BurnRateCalculator = exports.RUNTIME_QUOTA_PROVIDER_IDS = exports.MultiProviderQuotaService = exports.resolveZaiQuota = exports.readZaiCredentials = exports.quotaStateFromZaiQuotaLimitPayload = exports.fetchZaiQuotaFromApi = exports.CodexQuotaWatcher = exports.resolveCodexQuotaFromLocalSources = exports.resolveCodexQuota = exports.readLatestCodexQuotaFromRollouts = exports.quotaFromCodexRateLimits = exports.fetchCodexQuotaFromApi = exports.fetchCodexResetCreditsFromApi = exports.getWorkspaceIdFromPath = exports.pruneQuotaHistory = exports.readQuotaHistoryDailyBuckets = exports.readQuotaHistoryRange = exports.appendQuotaHistorySample = void 0;
+exports.assistantTurnNarrationStepSchema = exports.assistantTurnEventTypeSchema = exports.assistantTurnEventSchema = exports.listAllAccountsResultSchema = exports.savedAccountProfileSchema = exports.accountEntrySchema = exports.accountLoginStatusSchema = exports.beginAccountLoginResultSchema = exports.accountManagerResultSchema = exports.accountProviderIdSchema = exports.activeAccountStatusSchema = exports.activeProviderAccountStatusSchema = exports.quotaHistoryDailyBucketSchema = exports.quotaHistorySampleSchema = exports.quotaHistoryRuntimeProviderSchema = exports.providerQuotaMapSchema = exports.zaiProviderQuotaStateSchema = exports.codexProviderQuotaStateSchema = exports.claudeProviderQuotaStateSchema = exports.providerQuotaStateSchema = exports.runtimeQuotaProviderSchema = exports.quotaFailureDescriptorSchema = exports.peakHoursStateSchema = exports.codexResetCreditsSnapshotSchema = exports.codexResetCreditSchema = exports.quotaSourceSchema = exports.quotaProviderIdSchema = exports.quotaFailureKindSchema = exports.quotaStateSchema = exports.quotaWindowSchema = exports.extractSessionEvents = exports.permissionModeSchema = exports.sessionEventSchema = exports.sessionMessageSchema = exports.messageUsageSchema = exports.ToolCallTracker = exports.extractToolCalls = exports.extractToolCall = exports.extractErrorMessage = exports.categorizeError = exports.gatherAssetsForCwd = exports.codexSessions = exports.readCodexAssets = exports.claudeSessions = exports.readClaudeAssets = exports.extractCommands = exports.extractFilePaths = exports.extractUrls = exports.extractTokenUsage = exports.getObservedContextWindowPath = void 0;
+exports.syncCodexLiveStateAsync = exports.readStoredCodexAccount = exports.repairCodexCredentialStores = exports.inspectCodexCredentialStores = exports.fetchProviderServiceStatus = exports.diagnoseProviderFailure = exports.mergeFailingToolWindows = exports.failingToolTrend = exports.FAILING_TOOL_TREND_ARROWS = exports.scopePeakHoursToSessionProvider = exports.PEAK_HOURS_DESCRIPTION = exports.PEAK_HOURS_CACHE_MS = exports.isClaudeCodeSessionProvider = exports.getScheduledPeakHoursState = exports.fetchPeakHoursStatus = exports.DEFAULT_PEAK_HOURS_TIMEOUT_MS = exports.createPeakHoursNotApplicableState = exports._resetPeakHoursCache = exports.runDoctor = exports.getSessionDiagnostics = exports.formatHealthReport = exports.toLegacyProviderStatus = exports.fetchOpenAIStatus = exports.fetchProviderStatus = exports.assistantTurnToolRefSchema = exports.assistantTurnToolGroupStepSchema = exports.assistantTurnTimelineItemSchema = exports.assistantTurnSubagentStatusSchema = exports.assistantTurnSubagentSchema = exports.assistantTurnReasoningTimelineItemSchema = exports.assistantTurnProjectionSchema = exports.assistantTurnProcessStepSchema = exports.assistantTurnProcessSchema = void 0;
 var usageNormalization_1 = require("./usageNormalization");
 Object.defineProperty(exports, "normalizeProviderUsage", { enumerable: true, get: function () { return usageNormalization_1.normalizeProviderUsage; } });
 Object.defineProperty(exports, "extractNormalizedUsage", { enumerable: true, get: function () { return usageNormalization_1.extractNormalizedUsage; } });
@@ -385,8 +385,20 @@ Object.defineProperty(exports, "openInBrowser", { enumerable: true, get: functio
 // Credential I/O (platform-aware: Keychain on macOS, file on Linux/Windows)
 var credentialIO_1 = require("./credentialIO");
 Object.defineProperty(exports, "readActiveCredentials", { enumerable: true, get: function () { return credentialIO_1.readActiveCredentials; } });
+Object.defineProperty(exports, "readClaudeCredentialStore", { enumerable: true, get: function () { return credentialIO_1.readClaudeCredentialStore; } });
 Object.defineProperty(exports, "writeActiveCredentials", { enumerable: true, get: function () { return credentialIO_1.writeActiveCredentials; } });
 Object.defineProperty(exports, "deleteStoredCredentials", { enumerable: true, get: function () { return credentialIO_1.deleteStoredCredentials; } });
+Object.defineProperty(exports, "ClaudeCredentialWriteError", { enumerable: true, get: function () { return credentialIO_1.ClaudeCredentialWriteError; } });
+Object.defineProperty(exports, "SIDEKICK_KEYCHAIN_COMMENT_PREFIX", { enumerable: true, get: function () { return credentialIO_1.SIDEKICK_KEYCHAIN_COMMENT_PREFIX; } });
+var claudeLiveGuard_1 = require("./claudeLiveGuard");
+Object.defineProperty(exports, "decideLiveClaudeWrite", { enumerable: true, get: function () { return claudeLiveGuard_1.decideLiveClaudeWrite; } });
+var claudeCredentialLedger_1 = require("./claudeCredentialLedger");
+Object.defineProperty(exports, "readClaudeCredentialLedger", { enumerable: true, get: function () { return claudeCredentialLedger_1.readClaudeCredentialLedger; } });
+Object.defineProperty(exports, "getClaudeCredentialLedgerPath", { enumerable: true, get: function () { return claudeCredentialLedger_1.getClaudeCredentialLedgerPath; } });
+var claudeCredentialDoctor_1 = require("./claudeCredentialDoctor");
+Object.defineProperty(exports, "inspectClaudeCredentialStores", { enumerable: true, get: function () { return claudeCredentialDoctor_1.inspectClaudeCredentialStores; } });
+Object.defineProperty(exports, "repairClaudeCredentialStores", { enumerable: true, get: function () { return claudeCredentialDoctor_1.repairClaudeCredentialStores; } });
+Object.defineProperty(exports, "parseKeychainDump", { enumerable: true, get: function () { return claudeCredentialDoctor_1.parseKeychainDump; } });
 // Credentials
 var credentials_1 = require("./credentials");
 Object.defineProperty(exports, "readClaudeMaxCredentials", { enumerable: true, get: function () { return credentials_1.readClaudeMaxCredentials; } });
@@ -397,6 +409,9 @@ Object.defineProperty(exports, "parseClaudeCredentialBlob", { enumerable: true,
 Object.defineProperty(exports, "claudeCredentialFreshness", { enumerable: true, get: function () { return claudeCredentials_1.claudeCredentialFreshness; } });
 Object.defineProperty(exports, "isNewerClaudeCredential", { enumerable: true, get: function () { return claudeCredentials_1.isNewerClaudeCredential; } });
 Object.defineProperty(exports, "resolveClaudeRefreshExpiry", { enumerable: true, get: function () { return claudeCredentials_1.resolveClaudeRefreshExpiry; } });
+Object.defineProperty(exports, "claudeRefreshFingerprint", { enumerable: true, get: function () { return claudeCredentials_1.claudeRefreshFingerprint; } });
+Object.defineProperty(exports, "claudeLoginOnly", { enumerable: true, get: function () { return claudeCredentials_1.claudeLoginOnly; } });
+Object.defineProperty(exports, "mergeClaudeLoginIntoLive", { enumerable: true, get: function () { return claudeCredentials_1.mergeClaudeLoginIntoLive; } });
 Object.defineProperty(exports, "CLAUDE_ACCESS_TOKEN_LIFETIME_MS", { enumerable: true, get: function () { return claudeCredentials_1.CLAUDE_ACCESS_TOKEN_LIFETIME_MS; } });
 Object.defineProperty(exports, "CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS", { enumerable: true, get: function () { return claudeCredentials_1.CLAUDE_REFRESH_TOKEN_LIFETIME_ESTIMATE_MS; } });
 var codexAuth_1 = require("./codexAuth");
@@ -438,6 +453,7 @@ Object.defineProperty(exports, "undoLastSwitch", { enumerable: true, get: functi
 Object.defineProperty(exports, "getLastSwitch", { enumerable: true, get: function () { return accountManager_1.getLastSwitch; } });
 Object.defineProperty(exports, "listAllAccounts", { enumerable: true, get: function () { return accountManager_1.listAllAccounts; } });
 Object.defineProperty(exports, "resolveClaudeLoginCommand", { enumerable: true, get: function () { return accountManager_1.resolveClaudeLoginCommand; } });
+Object.defineProperty(exports, "discardAccountLogin", { enumerable: true, get: function () { return accountManager_1.discardAccountLogin; } });
 var accountSwitch_1 = require("./accountSwitch");
 Object.defineProperty(exports, "readLastSwitch", { enumerable: true, get: function () { return accountSwitch_1.readLastSwitch; } });
 Object.defineProperty(exports, "getLastSwitchPath", { enumerable: true, get: function () { return accountSwitch_1.getLastSwitchPath; } });
@@ -514,6 +530,7 @@ Object.defineProperty(exports, "cleanupAbandonedCodexLogins", { enumerable: true
 Object.defineProperty(exports, "getCodexCredentialStoreMode", { enumerable: true, get: function () { return codexProfiles_1.getCodexCredentialStoreMode; } });
 Object.defineProperty(exports, "CODEX_KEYRING_FIX_HINT", { enumerable: true, get: function () { return codexProfiles_1.CODEX_KEYRING_FIX_HINT; } });
 var terminalSync_1 = require("./terminalSync");
+Object.defineProperty(exports, "writeAccountLauncher", { enumerable: true, get: function () { return terminalSync_1.writeAccountLauncher; } });
 Object.defineProperty(exports, "writeLauncher", { enumerable: true, get: function () { return terminalSync_1.writeLauncher; } });
 Object.defineProperty(exports, "removeLauncher", { enumerable: true, get: function () { return terminalSync_1.removeLauncher; } });
 var autoSwitch_1 = require("./autoSwitch");
@@ -725,3 +742,9 @@ var providerFailure_1 = require("./providerFailure");
 Object.defineProperty(exports, "diagnoseProviderFailure", { enumerable: true, get: function () { return providerFailure_1.diagnoseProviderFailure; } });
 var providerServiceStatus_1 = require("./providerServiceStatus");
 Object.defineProperty(exports, "fetchProviderServiceStatus", { enumerable: true, get: function () { return providerServiceStatus_1.fetchProviderServiceStatus; } });
+var codexCredentialDoctor_1 = require("./codexCredentialDoctor");
+Object.defineProperty(exports, "inspectCodexCredentialStores", { enumerable: true, get: function () { return codexCredentialDoctor_1.inspectCodexCredentialStores; } });
+Object.defineProperty(exports, "repairCodexCredentialStores", { enumerable: true, get: function () { return codexCredentialDoctor_1.repairCodexCredentialStores; } });
+var codexProfiles_2 = require("./codexProfiles");
+Object.defineProperty(exports, "readStoredCodexAccount", { enumerable: true, get: function () { return codexProfiles_2.readStoredCodexAccount; } });
+Object.defineProperty(exports, "syncCodexLiveStateAsync", { enumerable: true, get: function () { return codexProfiles_2.syncCodexLiveStateAsync; } });