sidekick-shared 0.27.5 → 0.28.0

package/dist/accountHealth.js

@@ -39,6 +39,7 @@ exports.claudeHealthSidecarFromBlob = claudeHealthSidecarFromBlob;
 exports.writeClaudeHealthSidecar = writeClaudeHealthSidecar;
 exports.codexHealthSidecarFromAuth = codexHealthSidecarFromAuth;
 exports.writeCodexHealthSidecar = writeCodexHealthSidecar;
+exports.readEffectiveClaudeCredential = readEffectiveClaudeCredential;
 exports.getAccountHealth = getAccountHealth;
 exports.listAccountsWithHealth = listAccountsWithHealth;
 exports.describeClaudeCredential = describeClaudeCredential;
@@ -55,6 +56,7 @@ const credentialIO_1 = require("./credentialIO");
 const codexAuth_1 = require("./codexAuth");
 const codexPaths_1 = require("./codexPaths");
 const accountRegistry_1 = require("./accountRegistry");
+const codexCredentialStore_1 = require("./codexCredentialStore");
 const atomic_1 = require("./writers/atomic");
 /** Refresh tokens that expire within this window count as `expiring`. */
 const REFRESH_EXPIRY_WARNING_MS = 3 * 24 * 60 * 60 * 1000;
@@ -93,6 +95,7 @@ function claudeHealthSidecarFromBlob(blob, source, now = Date.now()) {
         refreshExpiryEstimated: refresh?.estimated,
         hasRefreshToken: Boolean(credentials.refreshToken),
         authMode: 'oauth',
+        refreshFp: (0, claudeCredentials_1.claudeRefreshFingerprint)(credentials) ?? undefined,
         source,
     };
 }
@@ -114,7 +117,8 @@ function codexHealthSidecarFromAuth(authRaw, source, now = Date.now(), fallbackP
         capturedAt: now,
         accessExpiresAt: (0, codexAuth_1.readAccessTokenExpiry)(authRaw) ?? undefined,
         lastRefreshAt,
-        hasRefreshToken: identity.authMode === 'chatgpt',
+        hasRefreshToken: (0, codexAuth_1.codexRefreshFingerprint)(authRaw) !== null,
+        refreshFp: (0, codexAuth_1.codexRefreshFingerprint)(authRaw) ?? undefined,
         authMode: identity.authMode,
         source,
     };
@@ -185,15 +189,54 @@ function isLiveCodexAccount(profile) {
         workspaceId: profile.metadata?.workspaceId,
     });
 }
-function probeClaudeStore(accountId, now) {
-    const blob = (0, credentialIO_1.readActiveCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(accountId));
-    return blob ? writeClaudeHealthSidecar(accountId, blob, 'switch', now) : null;
+function readClaudeBackupBlob(accountId) {
+    try {
+        return JSON.parse(fs.readFileSync((0, claudeProfiles_1.getClaudeCredentialBackupPath)(accountId), 'utf8'));
+    }
+    catch {
+        return null;
+    }
 }
-function probeCodexStore(accountId, now) {
-    const authPath = path.join((0, codexPaths_1.getCodexProfileHome)(accountId), 'auth.json');
-    const raw = (0, codexPaths_1.readFileOrNull)(authPath);
-    const sidecar = codexHealthSidecarFromAuth(raw, 'switch', now, authPath);
-    if (sidecar)
+/**
+ * The credential a Claude profile would use right now: the live store for the
+ * live account (its profile home is empty by design), otherwise the fresher of
+ * the profile-home store and Sidekick's backup.
+ */
+function readEffectiveClaudeCredential(accountId) {
+    if (isLiveClaudeAccount(accountId))
+        return (0, credentialIO_1.readActiveCredentials)();
+    const store = (0, credentialIO_1.readClaudeCredentialStore)((0, claudeProfiles_1.getClaudeProfileHome)(accountId));
+    const fromStore = store.status === 'ok' ? store.blob : null;
+    const backup = readClaudeBackupBlob(accountId);
+    const storeFreshness = (0, claudeCredentials_1.claudeCredentialFreshness)((0, claudeCredentials_1.parseClaudeCredentialBlob)(fromStore));
+    const backupFreshness = (0, claudeCredentials_1.claudeCredentialFreshness)((0, claudeCredentials_1.parseClaudeCredentialBlob)(backup));
+    if ((0, claudeCredentials_1.parseClaudeCredentialBlob)(backup) && backupFreshness > storeFreshness)
+        return backup;
+    return (0, claudeCredentials_1.parseClaudeCredentialBlob)(fromStore) ? fromStore : null;
+}
+function probeClaudeStore(accountId, now, persist = true) {
+    const blob = readEffectiveClaudeCredential(accountId);
+    if (!blob)
+        return null;
+    // A probe reads; it must not rewrite provenance (keep-alive relies on it).
+    const source = readHealthSidecar('claude-code', accountId)?.source ??
+        (isLiveClaudeAccount(accountId) ? 'live-sync' : 'migration');
+    return persist
+        ? writeClaudeHealthSidecar(accountId, blob, source, now)
+        : claudeHealthSidecarFromBlob(blob, source, now);
+}
+function probeCodexStore(accountId, now, persist = true) {
+    const profile = (0, accountRegistry_1.listSavedAccountProfiles)('codex').find((p) => p.id === accountId);
+    const live = profile !== undefined && isLiveCodexAccount(profile);
+    const home = (0, codexCredentialStore_1.readCodexCredentialStore)(live ? (0, codexPaths_1.getSystemCodexHome)() : (0, codexPaths_1.getCodexProfileHome)(accountId));
+    const backup = live ? null : (0, codexCredentialStore_1.readCodexBackup)(accountId);
+    let raw = home.status === 'ok' ? home.snapshot.authRaw : null;
+    if (backup?.status === 'ok' &&
+        (!raw || (0, codexAuth_1.compareCodexAuthFreshness)(backup.snapshot.authRaw, raw) > 0))
+        raw = backup.snapshot.authRaw;
+    const source = readHealthSidecar('codex', accountId)?.source ?? (live ? 'live-sync' : 'migration');
+    const sidecar = codexHealthSidecarFromAuth(raw, source, now);
+    if (sidecar && persist)
         writeSidecar('codex', accountId, sidecar);
     return sidecar;
 }
@@ -201,12 +244,14 @@ function hasStoredClaudeCredential(accountId) {
     const home = (0, claudeProfiles_1.getClaudeProfileHome)(accountId);
     return (fs.existsSync(path.join(home, '.credentials.json')) ||
         fs.existsSync(path.join((0, claudeProfiles_1.getClaudeProfileDir)(accountId), 'health.json')) ||
-        fs.existsSync(path.join((0, accountRegistry_1.getAccountsDir)(), 'credentials', `${accountId}.credentials.json`)) ||
+        fs.existsSync((0, claudeProfiles_1.getClaudeCredentialBackupPath)(accountId)) ||
         (process.platform === 'darwin' && fs.existsSync(path.join(home, '.claude.json'))));
 }
 function hasStoredCodexCredential(accountId) {
     const home = (0, codexPaths_1.getCodexProfileHome)(accountId);
-    return (fs.existsSync(path.join(home, 'auth.json')) ||
+    return (fs.existsSync((0, codexPaths_1.getCodexBackupPath)(accountId)) ||
+        fs.existsSync((0, codexPaths_1.getCodexBackupPath)(accountId, true)) ||
+        fs.existsSync(path.join(home, 'auth.json')) ||
         fs.existsSync(path.join(home, '.credentials.json')));
 }
 /**
@@ -224,17 +269,19 @@ function getAccountHealth(provider, accountId, options = {}) {
     let sidecar = null;
     if (probe === 'store') {
         sidecar =
-            provider === 'codex' ? probeCodexStore(accountId, now) : probeClaudeStore(accountId, now);
+            provider === 'codex'
+                ? probeCodexStore(accountId, now, options.persist)
+                : probeClaudeStore(accountId, now, options.persist);
     }
     sidecar ??= readHealthSidecar(provider, accountId);
     if (!sidecar && provider === 'codex') {
         // Codex sidecars are cheap to derive from the plaintext file.
-        sidecar = probeCodexStore(accountId, now);
+        sidecar = probeCodexStore(accountId, now, options.persist);
     }
     if (!sidecar && probe === 'auto' && hasStoredClaudeCredential(accountId)) {
         // First look at a profile that predates the health model: read its store
         // once and record the sidecar so later reads are cache hits.
-        sidecar = probeClaudeStore(accountId, now);
+        sidecar = probeClaudeStore(accountId, now, options.persist);
     }
     const base = { providerId: provider, accountId, checkedAt: now, isLive };
     if (!sidecar) {

package/dist/accountLaunch.d.ts

@@ -26,5 +26,11 @@ export interface AccountLaunchOptions {
     materialize?: boolean;
     /** Launch even when the stored credential is reported expired. */
     force?: boolean;
+    /**
+     * Claude: when the profile home has no credential but its backup does,
+     * restore it there first (default true). Keep-alive passes false: it never
+     * restores backups.
+     */
+    restoreBackup?: boolean;
 }
 export declare function getAccountLaunchEnv(provider: AccountProviderId, accountId: string, options?: AccountLaunchOptions): AccountLaunchEnv;

package/dist/accountLaunch.js

@@ -44,6 +44,9 @@ const path = __importStar(require("path"));
 const accountRegistry_1 = require("./accountRegistry");
 const accountHealth_1 = require("./accountHealth");
 const claudeProfiles_1 = require("./claudeProfiles");
+const accounts_1 = require("./accounts");
+const codexCredentialStore_1 = require("./codexCredentialStore");
+const codexProfiles_1 = require("./codexProfiles");
 const codexPaths_1 = require("./codexPaths");
 const atomic_1 = require("./writers/atomic");
 function materializeClaudeHome(home) {
@@ -70,10 +73,11 @@ function materializeClaudeHome(home) {
 function materializeCodexHome(home) {
     fs.mkdirSync(home, { recursive: true, mode: 0o700 });
     const configTarget = path.join(home, 'config.toml');
-    if (!fs.existsSync(configTarget)) {
-        const source = (0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getSystemCodexHome)(), 'config.toml')) ?? '';
-        (0, atomic_1.atomicWriteFileSync)(configTarget, (0, codexPaths_1.forceFileCredentialStore)(source));
-    }
+    const current = (0, codexPaths_1.readFileOrNull)(configTarget);
+    const source = current ?? (0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getSystemCodexHome)(), 'config.toml')) ?? '';
+    const fileMode = (0, codexPaths_1.forceFileCredentialStore)(source);
+    if (fileMode !== current)
+        (0, atomic_1.atomicWriteFileSync)(configTarget, fileMode);
 }
 function getAccountLaunchEnv(provider, accountId, options = {}) {
     const profile = (0, accountRegistry_1.listSavedAccountProfiles)(provider).find((p) => p.id === accountId);
@@ -98,6 +102,40 @@ function getAccountLaunchEnv(provider, accountId, options = {}) {
     if (!profile) {
         return { ...base, error: `${provider} account ${accountId} not found.` };
     }
+    if (provider === 'codex' && (0, codexCredentialStore_1.isSidekickCodexHome)((0, codexPaths_1.getSystemCodexHome)())) {
+        return {
+            ...base,
+            error: 'Unset CODEX_HOME before managing accounts; it names a Sidekick-owned home.',
+        };
+    }
+    if (provider === 'codex' && !['file', 'unknown'].includes((0, codexPaths_1.getCodexCredentialStoreMode)())) {
+        return { ...base, error: 'Codex account launches require readable file-mode credentials.' };
+    }
+    if (provider === 'codex' && (0, codexProfiles_1.isLiveCodexProfile)(profile)) {
+        const liveHome = (0, codexPaths_1.getSystemCodexHome)();
+        return {
+            ...base,
+            home: liveHome,
+            env: { CODEX_HOME: liveHome },
+            warnings: ['This account is the live login, so the session uses the normal Codex home.'],
+        };
+    }
+    if (provider === 'claude-code' && health.isLive) {
+        // The live account's only CLI-usable copy is the live store; a session in
+        // its profile home would be a second copy racing it over the refresh
+        // token. Point the session at the live home instead.
+        const liveHome = (0, claudeProfiles_1.getLiveClaudeHome)();
+        const customHome = !(0, claudeProfiles_1.isDefaultClaudeHome)();
+        return {
+            ...base,
+            home: liveHome,
+            env: customHome ? { CLAUDE_CONFIG_DIR: liveHome } : {},
+            envUnset: customHome
+                ? [claudeProfiles_1.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV]
+                : ['CLAUDE_CONFIG_DIR', claudeProfiles_1.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV],
+            warnings: ['This account is the live login, so the session uses the normal Claude home.'],
+        };
+    }
     if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
         return {
             ...base,
@@ -109,6 +147,25 @@ function getAccountLaunchEnv(provider, accountId, options = {}) {
     }
     if (health.state === 'expiring' && health.reason)
         warnings.push(health.reason);
+    if (provider === 'claude-code' && options.restoreBackup !== false) {
+        if ((0, accounts_1.restoreClaudeProfileFromBackup)(accountId) === 'restored') {
+            warnings.push("Restored this account's saved login into its profile home. If a session elsewhere still uses this login, close it first: two copies of one login invalidate each other.");
+        }
+    }
+    if (provider === 'codex') {
+        const restored = (0, codexProfiles_1.restoreCodexProfileFromBackup)(accountId, {
+            restore: options.restoreBackup !== false,
+        });
+        if (restored === 'none')
+            return { ...base, error: 'No safe inactive Codex credential is available; sign in again.' };
+        if (restored === 'live')
+            return { ...base, home: (0, codexPaths_1.getSystemCodexHome)(), env: { CODEX_HOME: (0, codexPaths_1.getSystemCodexHome)() } };
+    }
+    if (provider === 'codex' &&
+        options.materialize === false &&
+        !['file', 'unknown'].includes((0, codexPaths_1.getCodexCredentialStoreMode)(home))) {
+        return { ...base, error: 'The isolated Codex home must use file credential storage.' };
+    }
     if (options.materialize !== false) {
         try {
             if (provider === 'codex')

package/dist/accountLease.d.ts

@@ -0,0 +1,5 @@
+import type { AccountProviderId } from './accountRegistry';
+export declare function isAccountLeaseHeld(provider: AccountProviderId, accountId: string, now?: number): boolean;
+/** Take the lease; the caller holds the provider's swap lock. False when held elsewhere. */
+export declare function acquireAccountLease(provider: AccountProviderId, accountId: string, durationMs: number, now?: number): boolean;
+export declare function releaseAccountLease(provider: AccountProviderId, accountId: string): void;

package/dist/accountLease.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAccountLeaseHeld = isAccountLeaseHeld;
+exports.acquireAccountLease = acquireAccountLease;
+exports.releaseAccountLease = releaseAccountLease;
+/**
+ * Keep-alive leases: while keep-alive runs a provider CLI inside a profile
+ * home, that home's credential may be mid-refresh. A switch to that account
+ * would copy the pre-refresh token into the live store just as the CLI kills
+ * it, so switches refuse a leased target. Leases are acquired under the
+ * provider's swap lock (the same lock a switch holds), expire on their own,
+ * and are ignored once their process is gone.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const claudeProfiles_1 = require("./claudeProfiles");
+const codexPaths_1 = require("./codexPaths");
+const atomic_1 = require("./writers/atomic");
+function leasePath(provider, accountId) {
+    const dir = provider === 'codex' ? (0, codexPaths_1.getCodexProfileDir)(accountId) : (0, claudeProfiles_1.getClaudeProfileDir)(accountId);
+    return path.join(dir, 'keepalive.lease');
+}
+function processAlive(pid) {
+    if (pid === process.pid)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function isAccountLeaseHeld(provider, accountId, now = Date.now()) {
+    try {
+        const lease = JSON.parse(fs.readFileSync(leasePath(provider, accountId), 'utf8'));
+        return (typeof lease.pid === 'number' &&
+            typeof lease.expiresAt === 'number' &&
+            lease.expiresAt > now &&
+            processAlive(lease.pid));
+    }
+    catch {
+        return false;
+    }
+}
+/** Take the lease; the caller holds the provider's swap lock. False when held elsewhere. */
+function acquireAccountLease(provider, accountId, durationMs, now = Date.now()) {
+    if (isAccountLeaseHeld(provider, accountId, now))
+        return false;
+    const target = leasePath(provider, accountId);
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    (0, atomic_1.atomicWriteJsonSync)(target, {
+        pid: process.pid,
+        expiresAt: now + durationMs,
+    });
+    return true;
+}
+function releaseAccountLease(provider, accountId) {
+    try {
+        fs.rmSync(leasePath(provider, accountId), { force: true });
+    }
+    catch {
+        /* expires on its own */
+    }
+}

package/dist/accountManager.d.ts

@@ -73,6 +73,13 @@ export declare function getAccountLoginStatusAsync(provider: AccountProviderId,
 export declare function finalizeAccountLogin(provider: AccountProviderId, loginId: string, opts?: FinalizeAccountLoginOptions): AccountManagerResult;
 /** {@link finalizeAccountLogin} without blocking the event loop on CLI probes. */
 export declare function finalizeAccountLoginAsync(provider: AccountProviderId, loginId: string, opts?: FinalizeAccountLoginOptions): Promise<AccountManagerResult>;
+/**
+ * Abandon a login started with {@link beginAccountLogin} (cancelled, timed
+ * out, or failed): removes the temporary home and, for Claude, its Keychain
+ * item. Refuses ids that belong to a saved profile. Returns true when
+ * something was discarded.
+ */
+export declare function discardAccountLogin(provider: AccountProviderId, loginId: string): boolean;
 export declare function spawnAccountLogin(provider: AccountProviderId, label: string, opts?: SpawnAccountLoginOptions): Promise<AccountManagerResult>;
 export declare function switchAccount(provider: AccountProviderId, id: string, options?: SwitchAccountOptions): SwitchAccountResult;
 /**