sidekick-shared 0.27.5 → 0.28.0

package/dist/accountManager.js

@@ -39,6 +39,7 @@ exports.getAccountLoginStatus = getAccountLoginStatus;
 exports.getAccountLoginStatusAsync = getAccountLoginStatusAsync;
 exports.finalizeAccountLogin = finalizeAccountLogin;
 exports.finalizeAccountLoginAsync = finalizeAccountLoginAsync;
+exports.discardAccountLogin = discardAccountLogin;
 exports.spawnAccountLogin = spawnAccountLogin;
 exports.switchAccount = switchAccount;
 exports.switchAccountAsync = switchAccountAsync;
@@ -54,7 +55,9 @@ const atomic_1 = require("./writers/atomic");
 const accounts_1 = require("./accounts");
 const claudeProfiles_1 = require("./claudeProfiles");
 const credentialIO_1 = require("./credentialIO");
+const claudeCredentialLedger_1 = require("./claudeCredentialLedger");
 const codexProfiles_1 = require("./codexProfiles");
+const codexPaths_1 = require("./codexPaths");
 const accountSwitch_1 = require("./accountSwitch");
 function getPendingClaudeProfilePath(loginId) {
     return path.join((0, claudeProfiles_1.getClaudeProfileDir)(loginId), 'profile.json');
@@ -109,7 +112,16 @@ function copyClaudeProfileToCanonicalHome(sourceHome, accountUuid, credentials,
     fs.mkdirSync(canonicalHome, { recursive: true, mode: 0o700 });
     if (path.resolve(sourceHome) !== path.resolve(canonicalHome)) {
         try {
-            fs.cpSync(sourceHome, canonicalHome, { recursive: true, force: true });
+            // Credentials go only through the chokepoint below: when this account is
+            // the live one its profile home must not receive a CLI-usable copy.
+            fs.cpSync(sourceHome, canonicalHome, {
+                recursive: true,
+                force: true,
+                filter: (src) => {
+                    const base = path.basename(src);
+                    return base !== '.credentials.json' && !base.startsWith('.oauth_refresh.lock');
+                },
+            });
         }
         catch {
             // The credential and identity files are re-written below when possible.
@@ -148,7 +160,7 @@ function beginAccountLogin(provider, label, opts = {}) {
         const effectiveLabel = existing
             ? `${existing.label ?? existing.email ?? 'codex'} (re-login ${(0, crypto_1.randomUUID)().slice(0, 8)})`
             : label.trim() || `Codex ${(0, codexProfiles_1.listCodexAccounts)().length + 1}`;
-        const prepared = (0, codexProfiles_1.prepareCodexAccount)(effectiveLabel);
+        const prepared = (0, codexProfiles_1.prepareCodexAccount)(effectiveLabel, { importCurrent: false });
         if (!prepared.success || !prepared.profileId || !prepared.codexHome) {
             return { success: false, error: prepared.error ?? 'Could not prepare Codex account login.' };
         }
@@ -186,6 +198,9 @@ function beginAccountLogin(provider, label, opts = {}) {
         existingAccountId: existing?.id,
     });
     seedClaudeLoginHome(home);
+    // Claude Code creates this home's Keychain item itself; record the home
+    // first so the item is provably Sidekick's even if everything else fails.
+    (0, claudeCredentialLedger_1.recordClaudeCredentialHome)(home, 'login');
     const loginCommand = resolveClaudeLoginCommand(opts);
     return {
         success: true,
@@ -207,7 +222,7 @@ function getClaudeAccountLoginStatus(loginId) {
 }
 function getAccountLoginStatus(provider, loginId) {
     if (provider === 'codex') {
-        const codexHome = (0, codexProfiles_1.getCodexProfileHome)(loginId);
+        const codexHome = (0, codexPaths_1.getCodexLoginHome)(loginId);
         if (!(0, codexProfiles_1.isCodexProfileAuthenticated)(codexHome)) {
             return { state: 'pending' };
         }
@@ -226,7 +241,7 @@ function getAccountLoginStatus(provider, loginId) {
  */
 async function getAccountLoginStatusAsync(provider, loginId) {
     if (provider === 'codex') {
-        const codexHome = (0, codexProfiles_1.getCodexProfileHome)(loginId);
+        const codexHome = (0, codexPaths_1.getCodexLoginHome)(loginId);
         if (!(await (0, codexProfiles_1.isCodexProfileAuthenticatedAsync)(codexHome))) {
             return { state: 'pending' };
         }
@@ -257,44 +272,55 @@ function finalizeClaudeAccountLogin(loginId, opts = {}) {
     if (!identity) {
         return { success: false, error: 'Claude profile is not authenticated yet.' };
     }
-    const credentials = (0, credentialIO_1.readActiveCredentials)(home);
-    if (!credentials) {
-        return { success: false, error: 'Could not read Claude profile credentials.' };
-    }
-    const oauthAccount = readClaudeOauthAccount(home);
-    if (!oauthAccount) {
-        return { success: false, error: 'Could not read Claude profile config.' };
+    const read = (0, credentialIO_1.readClaudeCredentialStore)(home);
+    if (read.status === 'error') {
+        // Transient (locked Keychain, timeout): keep the login home for a retry.
+        return { success: false, error: 'Could not read the new Claude login yet; try again.' };
     }
-    const pending = readPendingClaudeProfile(loginId);
-    const existing = (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((account) => (account.providerAccountId ?? account.id) === identity.uuid);
-    copyClaudeProfileToCanonicalHome(home, identity.uuid, credentials, oauthAccount);
     const warnings = [];
-    if (pending?.existingAccountId && pending.existingAccountId !== identity.uuid) {
-        warnings.push(`You signed in as ${identity.email}, which is a different account from the one you chose to re-authenticate; it was saved separately.`);
-    }
-    (0, accountRegistry_1.upsertSavedAccountProfile)({
-        id: existing?.id ?? identity.uuid,
-        providerId: 'claude-code',
-        providerAccountId: identity.uuid,
-        email: identity.email,
-        label: existing?.label ?? (pending?.label || identity.email),
-        addedAt: existing?.addedAt ?? pending?.addedAt ?? new Date().toISOString(),
-        metadata: {
-            ...existing?.metadata,
-            email: identity.email,
-            origin: 'login',
-        },
-    });
-    removePendingClaudeProfile(loginId);
-    if (loginId !== identity.uuid) {
-        removePendingClaudeProfile(identity.uuid);
-        // The temporary home's keychain item holds live tokens; nothing references it now.
-        (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
-        try {
-            fs.rmSync((0, claudeProfiles_1.getClaudeProfileDir)(loginId), { recursive: true, force: true });
+    try {
+        if (read.status !== 'ok') {
+            return {
+                success: false,
+                error: 'The sign-in finished without a readable credential; sign in again.',
+            };
         }
-        catch {
-            /* the temporary login home is disposable */
+        const oauthAccount = readClaudeOauthAccount(home);
+        if (!oauthAccount) {
+            return { success: false, error: 'Could not read Claude profile config.' };
+        }
+        const pending = readPendingClaudeProfile(loginId);
+        const existing = (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((account) => (account.providerAccountId ?? account.id) === identity.uuid);
+        // The chokepoint writes the private backup first, so a failure below
+        // still leaves the new login saved.
+        copyClaudeProfileToCanonicalHome(home, identity.uuid, read.blob, oauthAccount);
+        if (pending?.existingAccountId && pending.existingAccountId !== identity.uuid) {
+            warnings.push(`You signed in as ${identity.email}, which is a different account from the one you chose to re-authenticate; it was saved separately.`);
+        }
+        (0, accountRegistry_1.upsertSavedAccountProfile)({
+            id: existing?.id ?? identity.uuid,
+            providerId: 'claude-code',
+            providerAccountId: identity.uuid,
+            email: identity.email,
+            label: existing?.label ?? (pending?.label || identity.email),
+            addedAt: existing?.addedAt ?? pending?.addedAt ?? new Date().toISOString(),
+            metadata: {
+                ...existing?.metadata,
+                email: identity.email,
+                origin: 'login',
+            },
+        });
+    }
+    catch (err) {
+        return { success: false, error: `Could not save the new Claude login: ${err}` };
+    }
+    finally {
+        // Every exit after authentication: the temporary home's Keychain item
+        // holds a live refresh token that nothing will ever reference again.
+        removePendingClaudeProfile(loginId);
+        if (loginId !== identity.uuid) {
+            removePendingClaudeProfile(identity.uuid);
+            discardClaudeLoginHome(loginId);
         }
     }
     if (opts.activate === false) {
@@ -306,6 +332,8 @@ function finalizeClaudeAccountLogin(loginId, opts = {}) {
         const applied = (0, accounts_1.applyClaudeProfileToLiveHome)(identity.uuid);
         if (!applied.success)
             return applied;
+        if (applied.warning)
+            warnings.push(applied.warning);
     }
     const switched = (0, accounts_1.switchToAccount)(identity.uuid);
     return warnings.length
@@ -356,22 +384,82 @@ function latestHomeActivity(home) {
     }
     return latest;
 }
+/** Delete a temporary Claude login home: its Keychain item first, then the directory. */
+function discardClaudeLoginHome(loginId) {
+    const dir = (0, claudeProfiles_1.getClaudeProfileDir)(loginId);
+    if (!path.resolve(dir).startsWith(path.resolve((0, accountRegistry_1.getAccountsDir)()) + path.sep))
+        return;
+    (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        /* the temporary login home is disposable */
+    }
+}
 function discardPendingLogin(provider, loginId) {
     try {
-        const dir = provider === 'codex'
-            ? path.dirname((0, codexProfiles_1.getCodexProfileHome)(loginId))
-            : (0, claudeProfiles_1.getClaudeProfileDir)(loginId);
-        if (!dir.startsWith((0, accountRegistry_1.getAccountsDir)()))
+        if (provider === 'claude-code') {
+            discardClaudeLoginHome(loginId);
             return;
-        if (provider === 'claude-code')
-            (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
-        fs.rmSync(dir, { recursive: true, force: true });
+        }
+        (0, codexProfiles_1.discardCodexLogin)(loginId);
     }
     catch {
         /* best effort */
     }
 }
+/**
+ * Abandon a login started with {@link beginAccountLogin} (cancelled, timed
+ * out, or failed): removes the temporary home and, for Claude, its Keychain
+ * item. Refuses ids that belong to a saved profile. Returns true when
+ * something was discarded.
+ */
+function discardAccountLogin(provider, loginId) {
+    const registered = provider === 'codex'
+        ? (0, codexProfiles_1.listCodexAccounts)().some((account) => account.id === loginId)
+        : (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').some((account) => account.id === loginId || account.providerAccountId === loginId);
+    if (registered)
+        return false;
+    if (provider === 'claude-code' && !readPendingClaudeProfile(loginId)) {
+        // Not a pending login; still drop a stray item for a home we created.
+        (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(loginId));
+        return false;
+    }
+    discardPendingLogin(provider, loginId);
+    return true;
+}
+class AccountLoginWriterActiveError extends Error {
+}
 async function spawnAccountLogin(provider, label, opts = {}) {
+    let loginId;
+    let result;
+    let writerActive = false;
+    try {
+        result = await runAccountLogin(provider, label, opts, (id) => {
+            loginId = id;
+        });
+        return result;
+    }
+    catch (error) {
+        if (error instanceof AccountLoginWriterActiveError) {
+            writerActive = true;
+            return {
+                success: false,
+                error: 'The Codex login process could not be stopped. Its temporary home was preserved; close that process before retrying.',
+            };
+        }
+        throw error;
+    }
+    finally {
+        // Every exit that did not end in a saved login (spawn error, early exit,
+        // abort, timeout, a throw) removes the temporary home and its Keychain item.
+        if (!writerActive && loginId && (provider === 'codex' || !result?.success)) {
+            discardPendingLogin(provider, loginId);
+        }
+    }
+}
+async function runAccountLogin(provider, label, opts, onBegin) {
     if (opts.signal?.aborted) {
         return { success: false, error: 'Account login aborted.' };
     }
@@ -381,6 +469,7 @@ async function spawnAccountLogin(provider, label, opts = {}) {
     });
     if (!begin.success)
         return { success: false, error: begin.error };
+    onBegin(begin.loginId);
     if (begin.alreadyComplete) {
         return finalizeAccountLoginAsync(provider, begin.loginId, { activate: opts.activate ?? true });
     }
@@ -419,57 +508,105 @@ async function spawnAccountLogin(provider, label, opts = {}) {
         childExited = true;
         childState.spawnError = error;
     });
-    const abort = () => {
-        child.kill();
+    const stopCodexChild = async () => {
+        if (provider !== 'codex' || childExited)
+            return;
+        const waitForExit = (ms) => new Promise((resolve) => {
+            if (childExited) {
+                resolve();
+                return;
+            }
+            const done = () => {
+                clearTimeout(timer);
+                child.off('exit', done);
+                child.off('error', done);
+                resolve();
+            };
+            const timer = setTimeout(done, ms);
+            child.once('exit', done);
+            child.once('error', done);
+        });
+        await waitForExit(100);
+        try {
+            if (!childExited) {
+                child.kill();
+                await waitForExit(1000);
+            }
+            if (!childExited) {
+                child.kill('SIGKILL');
+                await waitForExit(1000);
+            }
+        }
+        catch {
+            throw new AccountLoginWriterActiveError();
+        }
+        if (!childExited)
+            throw new AccountLoginWriterActiveError();
+    };
+    const abort = async () => {
+        if (provider === 'codex')
+            await stopCodexChild();
+        else
+            child.kill();
         discardPendingLogin(provider, begin.loginId);
         emitStatus(opts, { state: 'failed', error: 'Account login aborted.' });
         return { success: false, error: 'Account login aborted.' };
     };
-    while (true) {
-        if (opts.signal?.aborted)
-            return abort();
-        const status = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
-        if (status.state === 'authenticated') {
-            return finalizeAccountLoginAsync(provider, begin.loginId, {
-                activate: opts.activate ?? true,
-            });
-        }
-        if (childExited) {
-            if (childState.spawnError) {
-                const error = `Could not spawn account login: ${childState.spawnError.message}`;
-                discardPendingLogin(provider, begin.loginId);
-                emitStatus(opts, { state: 'failed', error });
-                return { success: false, error };
-            }
-            const finalStatus = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
-            if (finalStatus.state === 'authenticated') {
-                return finalizeAccountLoginAsync(provider, begin.loginId, {
+    try {
+        while (true) {
+            if (opts.signal?.aborted)
+                return await abort();
+            const status = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
+            if (status.state === 'authenticated') {
+                await stopCodexChild();
+                return await finalizeAccountLoginAsync(provider, begin.loginId, {
                     activate: opts.activate ?? true,
                 });
             }
-            discardPendingLogin(provider, begin.loginId);
-            emitStatus(opts, {
-                state: 'failed',
-                error: `Account login exited before authentication completed${childExitCode === null ? '.' : ` (exit ${childExitCode}).`}`,
-            });
-            return { success: false, error: 'Account login did not complete.' };
-        }
-        const now = Date.now();
-        const mtime = latestHomeActivity(begin.configDir);
-        if (mtime > lastSeenMtime) {
-            lastSeenMtime = mtime;
-            lastActivity = now;
-        }
-        const remainingMs = Math.min(inactivityMs - (now - lastActivity), maxMs - (now - startedAt));
-        if (remainingMs <= 0) {
-            child.kill();
-            discardPendingLogin(provider, begin.loginId);
-            emitStatus(opts, { state: 'failed', error: 'Account login timed out.' });
-            return { success: false, error: 'Account login timed out.' };
+            if (childExited) {
+                if (childState.spawnError) {
+                    const error = `Could not spawn account login: ${childState.spawnError.message}`;
+                    discardPendingLogin(provider, begin.loginId);
+                    emitStatus(opts, { state: 'failed', error });
+                    return { success: false, error };
+                }
+                const finalStatus = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
+                if (finalStatus.state === 'authenticated') {
+                    await stopCodexChild();
+                    return await finalizeAccountLoginAsync(provider, begin.loginId, {
+                        activate: opts.activate ?? true,
+                    });
+                }
+                discardPendingLogin(provider, begin.loginId);
+                emitStatus(opts, {
+                    state: 'failed',
+                    error: `Account login exited before authentication completed${childExitCode === null ? '.' : ` (exit ${childExitCode}).`}`,
+                });
+                return { success: false, error: 'Account login did not complete.' };
+            }
+            const now = Date.now();
+            const mtime = latestHomeActivity(begin.configDir);
+            if (mtime > lastSeenMtime) {
+                lastSeenMtime = mtime;
+                lastActivity = now;
+            }
+            const remainingMs = Math.min(inactivityMs - (now - lastActivity), maxMs - (now - startedAt));
+            if (remainingMs <= 0) {
+                if (provider === 'codex')
+                    await stopCodexChild();
+                else
+                    child.kill();
+                discardPendingLogin(provider, begin.loginId);
+                emitStatus(opts, { state: 'failed', error: 'Account login timed out.' });
+                return { success: false, error: 'Account login timed out.' };
+            }
+            const shouldContinue = await waitForNextPoll(Math.min(2_000, remainingMs), opts.signal);
+            if (!shouldContinue)
+                return await abort();
         }
-        const shouldContinue = await waitForNextPoll(Math.min(2_000, remainingMs), opts.signal);
-        if (!shouldContinue)
-            return abort();
+    }
+    finally {
+        await stopCodexChild();
     }
 }
 function switchAccount(provider, id, options = {}) {

package/dist/accountSync.d.ts

@@ -12,11 +12,6 @@ export interface SyncLiveAccountStateOptions {
     keychainFoldIntervalMs?: number;
     now?: number;
 }
-/**
- * Reconcile the live logins with the saved profiles for both providers.
- * Safe to call from watchers: re-entrant calls return an empty report, and
- * `onlyIfChanged` short-circuits when the live files are unchanged.
- */
 export declare function syncLiveAccountStateSync(options?: SyncLiveAccountStateOptions): SyncReport;
 /** Promise-returning twin of {@link syncLiveAccountStateSync} for async hosts. */
 export declare function syncLiveAccountState(options?: SyncLiveAccountStateOptions): Promise<SyncReport>;
@@ -28,3 +23,4 @@ export interface CleanupAbandonedLoginsResult {
 }
 /** Remove isolated login homes that never authenticated (both providers). */
 export declare function cleanupAbandonedLogins(olderThanMs?: number, now?: number): CleanupAbandonedLoginsResult;
+export declare function cleanupAbandonedLoginsAsync(olderThanMs?: number, now?: number): Promise<CleanupAbandonedLoginsResult>;

package/dist/accountSync.js

@@ -37,6 +37,7 @@ exports.syncLiveAccountStateSync = syncLiveAccountStateSync;
 exports.syncLiveAccountState = syncLiveAccountState;
 exports._resetSyncFingerprints = _resetSyncFingerprints;
 exports.cleanupAbandonedLogins = cleanupAbandonedLogins;
+exports.cleanupAbandonedLoginsAsync = cleanupAbandonedLoginsAsync;
 /**
  * Continuous reconciliation between the live provider logins and sidekick's
  * saved profiles. One engine replaces the old bootstrap/reconcile/backup
@@ -50,6 +51,7 @@ const accounts_1 = require("./accounts");
 const claudeProfiles_1 = require("./claudeProfiles");
 const codexProfiles_1 = require("./codexProfiles");
 const codexPaths_1 = require("./codexPaths");
+const processDetection_1 = require("./processDetection");
 const accountSyncTypes_1 = require("./accountSyncTypes");
 const DEFAULT_KEYCHAIN_FOLD_INTERVAL_MS = 10 * 60 * 1000;
 const fingerprints = {
@@ -89,7 +91,7 @@ function sourceForReason(reason) {
     return reason === 'pre-switch' ? 'switch' : 'live-sync';
 }
 function shouldSync(provider, fingerprint, options) {
-    if (!options.onlyIfChanged)
+    if (!options.onlyIfChanged || (provider === 'codex' && (0, codexProfiles_1.hasPendingCodexRepair)()))
         return true;
     const state = fingerprints[provider];
     if (state.fingerprint !== fingerprint)
@@ -101,7 +103,7 @@ function shouldSync(provider, fingerprint, options) {
     return false;
 }
 /** Sync one provider under its swap lock; never throws. */
-function syncProvider(provider, reason, options) {
+function syncProvider(provider, reason, options, scan) {
     const fingerprint = provider === 'codex' ? codexFingerprint() : claudeFingerprint();
     if (!shouldSync(provider, fingerprint, options)) {
         return { ...(0, accountSyncTypes_1.emptyProviderSyncReport)(), skipped: 'unchanged' };
@@ -109,9 +111,11 @@ function syncProvider(provider, reason, options) {
     const source = sourceForReason(reason);
     let report;
     try {
+        if (provider === 'codex')
+            scan ??= (0, processDetection_1.inspectRunningAccountConsumersSync)('codex');
         report =
             provider === 'codex'
-                ? (0, codexProfiles_1.withCodexAuthSwapLock)(() => (0, codexProfiles_1.syncCodexLiveStateUnlocked)(source))
+                ? (0, codexProfiles_1.withCodexAuthSwapLock)(() => (0, codexProfiles_1.syncCodexLiveStateUnlocked)(source, { scan }))
                 : (0, accounts_1.withClaudeAuthSwapLock)(() => (0, accounts_1.syncClaudeLiveStateUnlocked)(source));
     }
     catch (err) {
@@ -130,7 +134,7 @@ function syncProvider(provider, reason, options) {
  * Safe to call from watchers: re-entrant calls return an empty report, and
  * `onlyIfChanged` short-circuits when the live files are unchanged.
  */
-function syncLiveAccountStateSync(options = {}) {
+function syncLiveAccountStateCore(options = {}, scan) {
     const reason = options.reason ?? 'manual';
     const now = options.now ?? Date.now();
     const resolved = {
@@ -155,16 +159,22 @@ function syncLiveAccountStateSync(options = {}) {
         if (providers.includes('claude-code'))
             report.claude = syncProvider('claude-code', reason, resolved);
         if (providers.includes('codex'))
-            report.codex = syncProvider('codex', reason, resolved);
+            report.codex = syncProvider('codex', reason, resolved, scan);
     }
     finally {
         syncInProgress = false;
     }
     return report;
 }
+function syncLiveAccountStateSync(options = {}) {
+    return syncLiveAccountStateCore(options);
+}
 /** Promise-returning twin of {@link syncLiveAccountStateSync} for async hosts. */
 async function syncLiveAccountState(options = {}) {
-    return syncLiveAccountStateSync(options);
+    const scan = !options.providers || options.providers.includes('codex')
+        ? await (0, processDetection_1.inspectRunningAccountConsumers)('codex')
+        : undefined;
+    return syncLiveAccountStateCore(options, scan);
 }
 /** Forget the change fingerprints (tests, or after an external reset). */
 function _resetSyncFingerprints() {
@@ -178,3 +188,9 @@ function cleanupAbandonedLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Date.now
         codex: (0, codexProfiles_1.cleanupAbandonedCodexLogins)(olderThanMs, now),
     };
 }
+async function cleanupAbandonedLoginsAsync(olderThanMs = 24 * 60 * 60 * 1000, now = Date.now()) {
+    return {
+        claude: (0, accounts_1.cleanupAbandonedClaudeLogins)(olderThanMs, now),
+        codex: await (0, codexProfiles_1.cleanupAbandonedCodexLoginsAsync)(olderThanMs, now),
+    };
+}

package/dist/accountSyncTypes.d.ts

@@ -11,6 +11,15 @@ export interface ProviderSyncReport {
     repointed?: string;
     /** Duplicate profiles merged away (ids of the removed losers). */
     merged?: string[];
+    /**
+     * The live account's profile home held a CLI-usable copy of its login; it
+     * was removed (the account that is live keeps exactly one copy: live).
+     */
+    demoted?: string;
+    /** That copy was strictly newer than live, so it replaced the dying live login first. */
+    repaired?: string;
+    /** A switch that crashed mid-way was finished or rolled back from its journal. */
+    journal?: 'finished' | 'rolled-back' | 'cleared';
     /** Why nothing was synced (`logged-out`, `keyring`, `no-identity`, `unchanged`). */
     skipped?: string;
     warnings: string[];