sidekick-shared 0.27.5 → 0.28.0

package/dist/accounts.js

@@ -5,10 +5,17 @@
  * Handles saving, listing, switching, syncing, and removing Claude accounts.
  * Both the VS Code extension and CLI consume this module.
  *
- * Model: the live home (`CLAUDE_CONFIG_DIR` or `~/.claude`) is the source of
- * truth for whichever account is logged in right now; every saved profile is a
- * backup that the sync core keeps fresh, because Claude Code rotates the
- * refresh token on every refresh and a stale snapshot is a dead login.
+ * Model: Claude Code rotates the refresh token on every refresh, so every
+ * refresh-token chain may have exactly one copy a `claude` process can use.
+ *
+ * - The live home (`CLAUDE_CONFIG_DIR` or `~/.claude`) is the only CLI-usable
+ *   copy of the account that is logged in right now. Its profile home holds
+ *   identity and health metadata but never a credential; Sidekick mirrors the
+ *   live credential into a private backup Claude Code never reads.
+ * - An inactive account's profile home holds its single CLI-usable copy (the
+ *   Claude login only; MCP tokens follow the live store).
+ * - Writes into the live store go through one guarded installer that refuses
+ *   downgrades, and a switch saves the outgoing login before replacing it.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -45,6 +52,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.storeClaudeProfileIdentity = storeClaudeProfileIdentity;
+exports.storeClaudeProfileCredentialsUnlocked = storeClaudeProfileCredentialsUnlocked;
 exports.storeClaudeProfileCredentials = storeClaudeProfileCredentials;
 exports.readStoredClaudeAccount = readStoredClaudeAccount;
 exports.readAccountRegistry = readAccountRegistry;
@@ -55,6 +63,10 @@ exports.withClaudeAuthSwapLock = withClaudeAuthSwapLock;
 exports.syncClaudeLiveStateUnlocked = syncClaudeLiveStateUnlocked;
 exports.syncClaudeLiveState = syncClaudeLiveState;
 exports.cleanupAbandonedClaudeLogins = cleanupAbandonedClaudeLogins;
+exports.getClaudeKeepAliveBlocker = getClaudeKeepAliveBlocker;
+exports.beginClaudeKeepAlive = beginClaudeKeepAlive;
+exports.finishClaudeKeepAlive = finishClaudeKeepAlive;
+exports.restoreClaudeProfileFromBackup = restoreClaudeProfileFromBackup;
 exports.switchToAccount = switchToAccount;
 exports.switchToAccountAsync = switchToAccountAsync;
 exports.applyClaudeProfileToLiveHome = applyClaudeProfileToLiveHome;
@@ -73,6 +85,9 @@ const atomic_1 = require("./writers/atomic");
 const accountRegistry_1 = require("./accountRegistry");
 const claudeProfiles_1 = require("./claudeProfiles");
 const claudeCredentials_1 = require("./claudeCredentials");
+const claudeLiveGuard_1 = require("./claudeLiveGuard");
+const claudeRefreshLock_1 = require("./claudeRefreshLock");
+const accountLease_1 = require("./accountLease");
 const accountHealth_1 = require("./accountHealth");
 const accountSwitch_1 = require("./accountSwitch");
 const accountSyncTypes_1 = require("./accountSyncTypes");
@@ -87,6 +102,9 @@ function getConfigsDir() {
 function getClaudeMigrationMarkerPath() {
     return path.join((0, accountRegistry_1.getAccountsDir)(), 'claude', '.profiles-migrated-v1');
 }
+function getSwitchJournalPath() {
+    return path.join((0, accountRegistry_1.getAccountsDir)(), 'claude', 'switch-journal.json');
+}
 // ── Directory bootstrap ──────────────────────────────────────────────────
 function ensureDirs() {
     for (const dir of [(0, accountRegistry_1.getAccountsDir)(), getCredentialsDir(), getConfigsDir()]) {
@@ -105,6 +123,9 @@ function readOauthAccountFromConfigPath(filePath) {
     const parsed = readJsonOrNull(filePath);
     return parsed?.oauthAccount ?? null;
 }
+function isLiveClaudeAccount(uuid) {
+    return (0, claudeProfiles_1.readLiveClaudeIdentity)()?.uuid === uuid;
+}
 /** Store a profile's identity (`oauthAccount`) in its home and the flat backup. */
 function storeClaudeProfileIdentity(uuid, oauthAccount) {
     (0, atomic_1.atomicWriteJsonSync)(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json'), { oauthAccount });
@@ -115,27 +136,53 @@ function storeClaudeProfileIdentity(uuid, oauthAccount) {
         /* the profile home is canonical; the flat copy is a fallback */
     }
 }
+// ── Private credential backups ───────────────────────────────────────────
+function readClaudeBackup(uuid) {
+    return readJsonOrNull((0, claudeProfiles_1.getClaudeCredentialBackupPath)(uuid));
+}
+/** Write and verify the private backup. Throws: for the live account it is the only saved copy. */
+function writeClaudeBackup(uuid, credentials) {
+    const target = (0, claudeProfiles_1.getClaudeCredentialBackupPath)(uuid);
+    (0, atomic_1.atomicWriteJsonSync)(target, credentials);
+    if (JSON.stringify(readJsonOrNull(target)) !== JSON.stringify(credentials)) {
+        throw new Error(`The credential backup for ${uuid} did not verify after writing.`);
+    }
+}
+function fresherOf(a, b) {
+    const aCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(a);
+    const bCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(b);
+    if (!aCreds)
+        return bCreds ? b : null;
+    if (!bCreds)
+        return a;
+    return (0, claudeCredentials_1.claudeCredentialFreshness)(bCreds) > (0, claudeCredentials_1.claudeCredentialFreshness)(aCreds) ? b : a;
+}
 /**
- * The single chokepoint for storing a Claude credential in a profile: profile
- * home store (suffixed Keychain item on macOS, file elsewhere), the flat
- * backup, and the secret-free health sidecar.
+ * The single chokepoint for storing a Claude credential in a profile. Always
+ * writes the private backup and the secret-free health sidecar. Writes the
+ * profile-home store (suffixed Keychain item on macOS, file elsewhere) only
+ * when the account is NOT the live login: the live store is that account's one
+ * CLI-usable copy, and a second one would fight it over the refresh token.
+ * Caller holds the swap lock.
  */
-function storeClaudeProfileCredentials(uuid, credentials, source) {
-    (0, credentialIO_1.writeActiveCredentials)(credentials, (0, claudeProfiles_1.getClaudeProfileHome)(uuid));
-    try {
-        (0, atomic_1.atomicWriteJsonSync)(path.join(getCredentialsDir(), `${uuid}.credentials.json`), credentials);
+function storeClaudeProfileCredentialsUnlocked(uuid, credentials, source) {
+    const login = (0, claudeCredentials_1.claudeLoginOnly)(credentials);
+    if (!login || !(0, claudeCredentials_1.parseClaudeCredentialBlob)(login)) {
+        throw new Error('Refusing to store something that is not a Claude login.');
     }
-    catch {
-        /* the profile home is canonical; the flat copy is a fallback */
+    writeClaudeBackup(uuid, credentials);
+    if (!isLiveClaudeAccount(uuid)) {
+        (0, credentialIO_1.writeActiveCredentials)(login, (0, claudeProfiles_1.getClaudeProfileHome)(uuid));
     }
     (0, accountHealth_1.writeClaudeHealthSidecar)(uuid, credentials, source);
 }
-function writeClaudeProfileMirror(uuid, credentials, oauthAccount, source) {
-    storeClaudeProfileIdentity(uuid, oauthAccount);
-    storeClaudeProfileCredentials(uuid, credentials, source);
+/** {@link storeClaudeProfileCredentialsUnlocked} under the swap lock. */
+function storeClaudeProfileCredentials(uuid, credentials, source) {
+    withClaudeAuthSwapLock(() => storeClaudeProfileCredentialsUnlocked(uuid, credentials, source));
 }
-function readFlatClaudeCredentials(uuid) {
-    return readJsonOrNull(path.join(getCredentialsDir(), `${uuid}.credentials.json`));
+function writeClaudeProfileMirrorUnlocked(uuid, credentials, oauthAccount, source) {
+    storeClaudeProfileIdentity(uuid, oauthAccount);
+    storeClaudeProfileCredentialsUnlocked(uuid, credentials, source);
 }
 function readFlatClaudeOauthAccount(uuid) {
     return readJsonOrNull(path.join(getConfigsDir(), `${uuid}.config.json`));
@@ -143,24 +190,16 @@ function readFlatClaudeOauthAccount(uuid) {
 function readProfileClaudeOauthAccount(uuid) {
     return readOauthAccountFromConfigPath(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json'));
 }
+/**
+ * The saved credential and identity of a profile: the fresher of its
+ * profile-home store and its private backup. Read-only — it never
+ * re-materialises a backup into a CLI-visible place.
+ */
 function readStoredClaudeAccount(uuid) {
-    const profileCredentials = (0, credentialIO_1.readActiveCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(uuid));
-    const profileOauthAccount = readProfileClaudeOauthAccount(uuid);
-    if (profileCredentials && profileOauthAccount) {
-        return { credentials: profileCredentials, oauthAccount: profileOauthAccount };
-    }
-    const flatCredentials = readFlatClaudeCredentials(uuid);
-    const flatOauthAccount = readFlatClaudeOauthAccount(uuid);
-    if (flatCredentials && flatOauthAccount) {
-        try {
-            writeClaudeProfileMirror(uuid, flatCredentials, flatOauthAccount, 'migration');
-        }
-        catch {
-            // Flat backups remain the fallback when profile materialization fails.
-        }
-        return { credentials: flatCredentials, oauthAccount: flatOauthAccount };
-    }
-    return null;
+    const store = (0, credentialIO_1.readClaudeCredentialStore)((0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+    const credentials = fresherOf(store.status === 'ok' ? store.blob : null, readClaudeBackup(uuid));
+    const oauthAccount = readProfileClaudeOauthAccount(uuid) ?? readFlatClaudeOauthAccount(uuid);
+    return credentials && oauthAccount ? { credentials, oauthAccount } : null;
 }
 function readCurrentLiveOauthAccount() {
     return readOauthAccountFromConfigPath((0, claudeProfiles_1.getClaudeConfigPath)());
@@ -177,6 +216,40 @@ function mergeOauthAccountIntoLiveConfig(oauthAccount) {
     configObj.oauthAccount = oauthAccount;
     (0, atomic_1.atomicWriteJsonSync)(configPath, configObj);
 }
+// ── The guarded live installer ───────────────────────────────────────────
+function liveStateFrom(read) {
+    return read.status === 'ok' ? { status: 'ok', blob: read.blob } : { status: read.status };
+}
+/**
+ * The only writer of the live Claude credential store. Asks the guard, merges
+ * (the live MCP tokens stay; the candidate's Claude login replaces live's),
+ * writes, and verifies. `rollback` restores `candidate` verbatim.
+ */
+function installIntoLiveClaudeStore(candidate, candidateAccountUuid, intent, context) {
+    const live = liveStateFrom(context.live);
+    const decision = (0, claudeLiveGuard_1.decideLiveClaudeWrite)({
+        intent,
+        live,
+        liveAccountUuid: context.liveAccountUuid,
+        candidate,
+        candidateAccountUuid,
+        capturedOutgoing: context.capturedOutgoing,
+        written: context.written,
+    });
+    if (!decision.allow) {
+        return { ok: false, code: decision.code, reason: decision.reason, wrote: false };
+    }
+    const blob = intent === 'rollback'
+        ? candidate
+        : (0, claudeCredentials_1.mergeClaudeLoginIntoLive)(live.status === 'ok' ? live.blob : null, candidate);
+    try {
+        (0, credentialIO_1.writeLiveClaudeCredentialStoreUnguarded)(blob);
+    }
+    catch (err) {
+        return { ok: false, code: 'write-failed', reason: `${err}`, wrote: true, attempted: blob };
+    }
+    return { ok: true, installed: blob };
+}
 // ── Registry operations (legacy v1 view over the shared v2 registry) ───────
 function readAccountRegistry() {
     const registry = (0, accountRegistry_1.readSavedAccountRegistry)();
@@ -230,6 +303,9 @@ function findClaudeProfileForIdentity(identity) {
         profiles.find((p) => (p.email ?? p.metadata?.email) === identity.email) ??
         null);
 }
+function profileKey(profile) {
+    return profile.providerAccountId ?? profile.id;
+}
 // ── Add current account ──────────────────────────────────────────────────
 function addCurrentAccount(label) {
     const active = readActiveClaudeAccount();
@@ -249,7 +325,8 @@ function addCurrentAccount(label) {
     }
     ensureDirs();
     try {
-        writeClaudeProfileMirror(active.uuid, credBlob, configBlob, 'login');
+        // The live account: backup and metadata only (see the chokepoint).
+        withClaudeAuthSwapLock(() => writeClaudeProfileMirrorUnlocked(active.uuid, credBlob, configBlob, 'login'));
     }
     catch (err) {
         return { success: false, error: `Failed to back up Claude credentials: ${err}` };
@@ -279,25 +356,180 @@ function addCurrentAccount(label) {
 // ── Live-state sync ──────────────────────────────────────────────────────
 /**
  * Serializes live Claude credential swaps across processes so two concurrent
- * switchers cannot interleave their backup/write/rollback sequences. It cannot
- * exclude Claude Code's own writes to the live home — only our switchers. Lock
- * ordering: this lock first, the registry lock (inside setActiveSavedAccount)
- * inside it — never the reverse. Never spawn a child process while holding it.
+ * switchers cannot interleave their backup/write/rollback sequences. Claude
+ * Code's own refreshes are kept out separately by borrowing its refresh lock
+ * (claudeRefreshLock.ts). Lock ordering: this lock first, then the refresh
+ * locks, the registry lock (inside setActiveSavedAccount), and the ledger
+ * lock — never the reverse. Never spawn a `claude` process while holding it.
  */
 function withClaudeAuthSwapLock(operation) {
     const lockDir = path.join((0, accountRegistry_1.getAccountsDir)(), 'claude');
     fs.mkdirSync(lockDir, { recursive: true, mode: 0o700 });
     return (0, atomic_1.withFileLockSync)(path.join(lockDir, 'auth-swap.lock'), operation);
 }
+function readSwitchJournal() {
+    const raw = readJsonOrNull(getSwitchJournalPath());
+    return raw && typeof raw.to === 'string' ? raw : null;
+}
+function writeSwitchJournal(journal) {
+    (0, atomic_1.atomicWriteJsonSync)(getSwitchJournalPath(), journal);
+}
+function clearSwitchJournal() {
+    try {
+        fs.rmSync(getSwitchJournalPath(), { force: true });
+    }
+    catch {
+        /* the next sync clears it */
+    }
+}
+/** Give a switched-away account its single CLI-usable copy (it is inactive now). */
+function materializeInactiveProfile(uuid, credentials) {
+    const login = (0, claudeCredentials_1.claudeLoginOnly)(credentials);
+    if (!login || isLiveClaudeAccount(uuid))
+        return;
+    (0, credentialIO_1.writeActiveCredentials)(login, (0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+}
+/**
+ * A switch that died mid-way left its journal behind (sync runs under the swap
+ * lock, so a journal it can see belongs to no running switch). Finish or roll
+ * back from the live fingerprint — never from `.claude.json` alone, which may
+ * still name the other account.
+ */
+function resolveSwitchJournalUnlocked(report) {
+    const journal = readSwitchJournal();
+    if (!journal)
+        return;
+    const live = (0, credentialIO_1.readClaudeCredentialStore)();
+    if (live.status === 'error') {
+        report.warnings.push('An interrupted account switch is pending; the live login could not be read yet.');
+        return;
+    }
+    const liveFp = live.status === 'ok' ? (0, claudeCredentials_1.claudeRefreshFingerprint)((0, claudeCredentials_1.parseClaudeCredentialBlob)(live.blob)) : null;
+    if (liveFp !== null && liveFp === journal.toFp) {
+        // The target was installed: finish the commit.
+        const toOauth = readProfileClaudeOauthAccount(journal.to) ?? readFlatClaudeOauthAccount(journal.to);
+        try {
+            if (toOauth && (0, claudeProfiles_1.readLiveClaudeIdentity)()?.uuid !== journal.to) {
+                mergeOauthAccountIntoLiveConfig(toOauth);
+            }
+            if (journal.from) {
+                const backup = readClaudeBackup(journal.from);
+                if ((0, claudeCredentials_1.claudeRefreshFingerprint)((0, claudeCredentials_1.parseClaudeCredentialBlob)(backup)) === journal.fromFp) {
+                    materializeInactiveProfile(journal.from, backup);
+                }
+            }
+            (0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(journal.to));
+            const target = findClaudeProfile(journal.to);
+            if (target)
+                (0, accountRegistry_1.setActiveSavedAccount)('claude-code', target.id, { silent: true });
+            report.journal = 'finished';
+        }
+        catch (err) {
+            report.warnings.push(`Could not finish an interrupted account switch: ${err}`);
+            return;
+        }
+    }
+    else if (liveFp === journal.fromFp) {
+        // Nothing was installed (or it was rolled back): the outgoing login is live.
+        report.journal = 'rolled-back';
+    }
+    else {
+        report.journal = 'cleared';
+        report.warnings.push('An interrupted account switch was found, but the live login matches neither side; it was left as is.');
+    }
+    clearSwitchJournal();
+}
+/** The profile whose recorded refresh-token fingerprint is `fp`, other than `exceptUuid`. */
+function findProfileHoldingFingerprint(fp, exceptUuid) {
+    return ((0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((profile) => {
+        const uuid = profileKey(profile);
+        return uuid !== exceptUuid && (0, accountHealth_1.readHealthSidecar)('claude-code', profile.id)?.refreshFp === fp;
+    }) ?? null);
+}
 /**
- * Fold the live login into the saved profiles: register an unknown login
- * (label = email), refresh the matching profile's backup when the live
- * credential is newer, and re-point the active pointer at it. Caller holds the
- * swap lock. Never throws; problems land in `warnings`.
+ * Enforce "the live account keeps no CLI-usable copy": if its profile home
+ * still holds a credential (older builds mirrored every fold there), remove
+ * it. When that copy is strictly newer than live, live is the dying link of
+ * the chain, so the copy is installed first (guarded `repair`). The fresher
+ * of the two stays in the private backup.
+ */
+function demoteLiveDuplicateUnlocked(uuid, report) {
+    const home = (0, claudeProfiles_1.getClaudeProfileHome)(uuid);
+    const probe = (0, credentialIO_1.readClaudeCredentialStore)(home);
+    if (probe.status === 'absent')
+        return;
+    if (probe.status === 'error') {
+        report.warnings.push("The live account's profile copy could not be read; it was left in place.");
+        return;
+    }
+    try {
+        (0, claudeRefreshLock_1.withClaudeRefreshLocksSync)([(0, claudeProfiles_1.getLiveClaudeHome)(), home], () => {
+            const live = (0, credentialIO_1.readClaudeCredentialStore)();
+            const duplicate = (0, credentialIO_1.readClaudeCredentialStore)(home);
+            if (live.status === 'error' || duplicate.status === 'error') {
+                report.warnings.push('A credential store could not be read; the profile copy was left in place.');
+                return;
+            }
+            if (duplicate.status === 'absent')
+                return;
+            const liveCreds = live.status === 'ok' ? (0, claudeCredentials_1.parseClaudeCredentialBlob)(live.blob) : null;
+            const dupBlob = duplicate.status === 'ok' ? duplicate.blob : null;
+            const dupCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(dupBlob);
+            if (dupCreds &&
+                (0, claudeCredentials_1.claudeRefreshFingerprint)(dupCreds) !== (0, claudeCredentials_1.claudeRefreshFingerprint)(liveCreds) &&
+                (0, claudeCredentials_1.claudeCredentialFreshness)(dupCreds) > (0, claudeCredentials_1.claudeCredentialFreshness)(liveCreds)) {
+                const install = installIntoLiveClaudeStore(dupBlob, uuid, 'repair', {
+                    live,
+                    liveAccountUuid: uuid,
+                });
+                if (install.ok) {
+                    writeClaudeBackup(uuid, install.installed);
+                    (0, accountHealth_1.writeClaudeHealthSidecar)(uuid, install.installed, 'live-sync');
+                    report.repaired = uuid;
+                }
+                else {
+                    // Keep the newer copy somewhere Claude Code cannot use it.
+                    writeClaudeBackup(uuid, fresherOf(readClaudeBackup(uuid), dupBlob));
+                    report.warnings.push(`The live Claude login looks older than its saved copy and could not be repaired (${install.reason}).`);
+                    if (install.wrote)
+                        return;
+                }
+            }
+            else if (liveCreds && live.status === 'ok') {
+                writeClaudeBackup(uuid, fresherOf(readClaudeBackup(uuid), live.blob));
+            }
+            if ((0, credentialIO_1.deleteStoredCredentials)(home))
+                report.demoted = uuid;
+            else
+                report.warnings.push("The live account's profile copy could not be removed.");
+        });
+    }
+    catch (err) {
+        if (err instanceof claudeRefreshLock_1.ClaudeRefreshLockBusyError) {
+            report.warnings.push("Claude Code was refreshing; the live account's profile copy is removed on the next sync.");
+        }
+        else {
+            report.warnings.push(`Could not remove the live account's profile copy: ${err}`);
+        }
+    }
+}
+/**
+ * Reconcile the live login with the saved profiles: finish an interrupted
+ * switch, register an unknown login (label = email), refresh the matching
+ * profile's backup when the live credential is newer, remove any CLI-usable
+ * copy of the live account from its profile home, and re-point the active
+ * pointer. Caller holds the swap lock. Never throws; problems land in
+ * `warnings`.
  */
 function syncClaudeLiveStateUnlocked(source = 'live-sync') {
     const report = (0, accountSyncTypes_1.emptyProviderSyncReport)();
+    if ((0, claudeProfiles_1.isLiveClaudeHomeSidekickProfile)()) {
+        report.skipped = 'managed-home';
+        report.warnings.push('Unset CLAUDE_CONFIG_DIR before syncing; it points at a sidekick profile home.');
+        return report;
+    }
     try {
+        resolveSwitchJournalUnlocked(report);
         const identity = readActiveClaudeAccount();
         if (!identity) {
             report.skipped = 'logged-out';
@@ -326,33 +558,48 @@ function syncClaudeLiveStateUnlocked(source = 'live-sync') {
             };
             (0, accountRegistry_1.upsertSavedAccountProfile)(profile);
         }
-        const uuid = profile.providerAccountId ?? profile.id;
-        const liveBlob = (0, credentialIO_1.readActiveCredentials)();
-        const live = (0, claudeCredentials_1.parseClaudeCredentialBlob)(liveBlob);
-        if (live) {
-            const sidecar = (0, accountHealth_1.readHealthSidecar)('claude-code', uuid);
-            const storedFreshness = sidecar?.accessExpiresAt ?? sidecar?.refreshExpiresAt ?? 0;
-            const liveFreshness = (0, claudeCredentials_1.claudeCredentialFreshness)(live);
-            const needsFold = !sidecar ||
-                liveFreshness > storedFreshness ||
-                (liveFreshness === storedFreshness &&
-                    !fs.existsSync(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json')));
-            if (needsFold) {
-                try {
-                    writeClaudeProfileMirror(uuid, liveBlob, readCurrentLiveOauthAccount() ?? {
-                        emailAddress: identity.email,
-                        accountUuid: identity.uuid,
-                    }, source);
-                    report.folded = profile.id;
-                }
-                catch (err) {
-                    report.warnings.push(`Could not back up the live Claude credentials: ${err}`);
+        const uuid = profileKey(profile);
+        const live = (0, credentialIO_1.readClaudeCredentialStore)();
+        if (live.status === 'error') {
+            report.warnings.push('The live Claude credential store could not be read.');
+        }
+        else if (live.status === 'corrupt') {
+            report.warnings.push('The live Claude credential store is unreadable (not valid JSON); sign in again with `claude`.');
+        }
+        else if (live.status === 'ok') {
+            const liveCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(live.blob);
+            const liveFp = (0, claudeCredentials_1.claudeRefreshFingerprint)(liveCreds);
+            const owner = liveFp ? findProfileHoldingFingerprint(liveFp, uuid) : null;
+            if (owner) {
+                // `.claude.json` names one account but the credential is another's
+                // (a switch or login mid-way): folding would file the chain under
+                // the wrong account, and demoting could delete the right one.
+                report.warnings.push(`The live credential belongs to ${owner.label ?? owner.email ?? owner.id}, not ${identity.email}; nothing was folded.`);
+            }
+            else if (liveCreds) {
+                const backupCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(readClaudeBackup(uuid));
+                const liveFreshness = (0, claudeCredentials_1.claudeCredentialFreshness)(liveCreds);
+                const backupFreshness = (0, claudeCredentials_1.claudeCredentialFreshness)(backupCreds);
+                const needsFold = !backupCreds ||
+                    liveFreshness > backupFreshness ||
+                    (liveFreshness === backupFreshness &&
+                        ((0, claudeCredentials_1.claudeRefreshFingerprint)(backupCreds) !== liveFp ||
+                            !fs.existsSync(path.join((0, claudeProfiles_1.getClaudeProfileHome)(uuid), '.claude.json'))));
+                if (needsFold) {
+                    try {
+                        writeClaudeProfileMirrorUnlocked(uuid, live.blob, readCurrentLiveOauthAccount() ?? {
+                            emailAddress: identity.email,
+                            accountUuid: identity.uuid,
+                        }, source);
+                        report.folded = profile.id;
+                    }
+                    catch (err) {
+                        report.warnings.push(`Could not back up the live Claude credentials: ${err}`);
+                    }
                 }
+                demoteLiveDuplicateUnlocked(uuid, report);
             }
         }
-        else if (liveBlob === null) {
-            report.warnings.push('The live Claude credential store could not be read.');
-        }
         const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
         if (!active || active.id !== profile.id) {
             (0, accountRegistry_1.setActiveSavedAccount)('claude-code', profile.id, { silent: true });
@@ -373,9 +620,13 @@ function syncClaudeLiveState(source = 'live-sync') {
         return { warnings: [`Could not acquire the account-switch lock: ${err}`] };
     }
 }
+/** Unregistered login homes that authenticated are kept this long for a late finalize. */
+const AUTHENTICATED_PENDING_LOGIN_TTL_MS = 24 * 60 * 60 * 1000;
 /**
- * Remove isolated login homes that never authenticated (the user closed the
- * browser, the login timed out) once they are older than `olderThanMs`.
+ * Remove isolated login homes that never finished: ones that never
+ * authenticated (the user closed the browser, the login timed out) once they
+ * are older than `olderThanMs`, and ones that authenticated but were never
+ * finalized (the host quit) after a day. Their Keychain item goes with them.
  * Returns the removed login ids.
  */
 function cleanupAbandonedClaudeLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Date.now()) {
@@ -397,11 +648,12 @@ function cleanupAbandonedClaudeLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Da
         if (!pending)
             continue;
         const home = (0, claudeProfiles_1.getClaudeProfileHome)(loginId);
-        if ((0, claudeProfiles_1.isClaudeProfileAuthenticated)(home))
-            continue;
+        const threshold = (0, claudeProfiles_1.isClaudeProfileAuthenticated)(home)
+            ? Math.max(olderThanMs, AUTHENTICATED_PENDING_LOGIN_TTL_MS)
+            : olderThanMs;
         const addedAt = pending.addedAt ? Date.parse(pending.addedAt) : NaN;
         const age = Number.isNaN(addedAt) ? Number.POSITIVE_INFINITY : now - addedAt;
-        if (age < olderThanMs)
+        if (age < threshold)
             continue;
         try {
             (0, credentialIO_1.deleteStoredCredentials)(home);
@@ -414,6 +666,136 @@ function cleanupAbandonedClaudeLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Da
     }
     return removed;
 }
+// ── Keep-alive and launch support ────────────────────────────────────────
+/**
+ * Why keep-alive must not run the CLI for this Claude profile, or null when it
+ * may. A refresh inside a profile home rotates that home's refresh token, so
+ * the home must hold the only live copy of its chain. Caller holds the swap lock.
+ */
+function claudeKeepAliveBlockerUnlocked(profile) {
+    const uuid = profileKey(profile);
+    if (isLiveClaudeAccount(uuid))
+        return 'live account; the CLI refreshes it in normal use';
+    const store = (0, credentialIO_1.readClaudeCredentialStore)((0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+    if (store.status === 'error')
+        return 'its saved login could not be read';
+    const storeCreds = store.status === 'ok' ? (0, claudeCredentials_1.parseClaudeCredentialBlob)(store.blob) : null;
+    if (!storeCreds)
+        return 'no profile copy to refresh (keep-alive never restores backups)';
+    const live = (0, credentialIO_1.readClaudeCredentialStore)();
+    if (live.status === 'error')
+        return 'the live login could not be read';
+    const liveCreds = live.status === 'ok' ? (0, claudeCredentials_1.parseClaudeCredentialBlob)(live.blob) : null;
+    if (liveCreds && (0, claudeCredentials_1.claudeRefreshFingerprint)(liveCreds) === (0, claudeCredentials_1.claudeRefreshFingerprint)(storeCreds)) {
+        return 'same refresh token as the live login';
+    }
+    if ((0, accountHealth_1.readHealthSidecar)('claude-code', profile.id)?.source === 'live-sync') {
+        return 'copied from the live login; waits for a switch away from it';
+    }
+    const backupCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(readClaudeBackup(uuid));
+    if ((0, claudeCredentials_1.claudeCredentialFreshness)(backupCreds) > (0, claudeCredentials_1.claudeCredentialFreshness)(storeCreds)) {
+        return 'its saved backup is newer than the profile copy';
+    }
+    return null;
+}
+function findClaudeProfileById(accountId) {
+    return (0, accountRegistry_1.listSavedAccountProfiles)('claude-code').find((p) => p.id === accountId) ?? null;
+}
+/** {@link beginClaudeKeepAlive} without taking the lease (dry runs). */
+function getClaudeKeepAliveBlocker(accountId) {
+    try {
+        return withClaudeAuthSwapLock(() => {
+            const profile = findClaudeProfileById(accountId);
+            return profile ? claudeKeepAliveBlockerUnlocked(profile) : 'account not found';
+        });
+    }
+    catch (err) {
+        return `could not acquire the account-switch lock: ${err}`;
+    }
+}
+/**
+ * Check a Claude profile for keep-alive and take its lease, both under the
+ * swap lock, so no switch can make it live (or copy it into live) while the
+ * CLI refreshes it. Pair with {@link finishClaudeKeepAlive}.
+ */
+function beginClaudeKeepAlive(accountId, leaseMs) {
+    try {
+        return withClaudeAuthSwapLock(() => {
+            const profile = findClaudeProfileById(accountId);
+            if (!profile)
+                return { ok: false, reason: 'account not found' };
+            const blocker = claudeKeepAliveBlockerUnlocked(profile);
+            if (blocker)
+                return { ok: false, reason: blocker };
+            if (!(0, accountLease_1.acquireAccountLease)('claude-code', accountId, leaseMs)) {
+                return { ok: false, reason: 'another keep-alive run holds this account' };
+            }
+            return { ok: true };
+        });
+    }
+    catch (err) {
+        return { ok: false, reason: `could not acquire the account-switch lock: ${err}` };
+    }
+}
+/** Record what the CLI refreshed (backup + sidecar) and release the lease. */
+function finishClaudeKeepAlive(accountId) {
+    try {
+        withClaudeAuthSwapLock(() => {
+            const profile = findClaudeProfileById(accountId);
+            if (!profile)
+                return;
+            const uuid = profileKey(profile);
+            if (isLiveClaudeAccount(uuid))
+                return;
+            const store = (0, credentialIO_1.readClaudeCredentialStore)((0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+            if (store.status !== 'ok')
+                return;
+            const backup = readClaudeBackup(uuid);
+            const storeCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(store.blob);
+            if (storeCreds &&
+                (0, claudeCredentials_1.claudeCredentialFreshness)(storeCreds) >
+                    (0, claudeCredentials_1.claudeCredentialFreshness)((0, claudeCredentials_1.parseClaudeCredentialBlob)(backup))) {
+                const updated = (0, claudeCredentials_1.mergeClaudeLoginIntoLive)(backup, store.blob);
+                writeClaudeBackup(uuid, updated);
+                (0, accountHealth_1.writeClaudeHealthSidecar)(profile.id, updated, 'keepalive');
+            }
+        });
+    }
+    catch {
+        /* the next sync or probe records the refresh */
+    }
+    finally {
+        (0, accountLease_1.releaseAccountLease)('claude-code', accountId);
+    }
+}
+/**
+ * Give an inactive profile a CLI-usable copy from its backup when its profile
+ * home has none (it was live when it was last seen, or a switch could not
+ * write it). User-initiated launches only; keep-alive never does this.
+ */
+function restoreClaudeProfileFromBackup(accountId) {
+    try {
+        return withClaudeAuthSwapLock(() => {
+            const profile = findClaudeProfileById(accountId);
+            if (!profile)
+                return 'none';
+            const uuid = profileKey(profile);
+            if (isLiveClaudeAccount(uuid))
+                return 'live';
+            const store = (0, credentialIO_1.readClaudeCredentialStore)((0, claudeProfiles_1.getClaudeProfileHome)(uuid));
+            if (store.status !== 'absent')
+                return store.status === 'ok' ? 'present' : 'none';
+            const backup = readClaudeBackup(uuid);
+            if (!(0, claudeCredentials_1.parseClaudeCredentialBlob)(backup))
+                return 'none';
+            materializeInactiveProfile(uuid, backup);
+            return 'restored';
+        });
+    }
+    catch {
+        return 'none';
+    }
+}
 // ── Switch to account ────────────────────────────────────────────────────
 function switchToAccount(uuid, options = {}) {
     const consumers = (0, processDetection_1.detectRunningAccountConsumersSync)('claude-code');
@@ -441,15 +823,13 @@ function switchToAccountUnlocked(uuid, options, consumers) {
     const targetName = target.label ?? target.email ?? uuid;
     // Refuse to treat one of our own profile homes as the live home: a shell
     // that eval'd `sidekick accounts env` would otherwise overwrite that profile.
-    const liveHome = path.resolve((0, claudeProfiles_1.getLiveClaudeHome)());
-    const profilesDir = path.resolve((0, claudeProfiles_1.getClaudeProfilesDir)());
-    if (liveHome === profilesDir || liveHome.startsWith(profilesDir + path.sep)) {
-        return (0, accountSwitch_1.switchFailure)('claude-code', uuid, `CLAUDE_CONFIG_DIR points at a sidekick profile home (${liveHome}); unset it before switching accounts.`);
-    }
-    // Phase 1: capture the outgoing login (rotated refresh token included) and
-    // register it if sidekick has never seen it. Only then is the "previous"
-    // account known: it is whatever was really live, not the stale pointer.
-    const sync = syncClaudeLiveStateUnlocked('switch');
+    if ((0, claudeProfiles_1.isLiveClaudeHomeSidekickProfile)()) {
+        return (0, accountSwitch_1.switchFailure)('claude-code', uuid, `CLAUDE_CONFIG_DIR points at a sidekick profile home (${path.resolve((0, claudeProfiles_1.getLiveClaudeHome)())}); unset it before switching accounts.`);
+    }
+    // Phase 1: register the outgoing login if sidekick has never seen it, finish
+    // any interrupted switch, and enforce the one-copy rule. Only then is the
+    // "previous" account known: it is whatever was really live.
+    const sync = syncClaudeLiveStateUnlocked('live-sync');
     const previousAccountId = (0, accountRegistry_1.getActiveSavedAccount)('claude-code')?.id ?? null;
     const base = {
         success: true,
@@ -475,8 +855,6 @@ function switchToAccountUnlocked(uuid, options, consumers) {
             hints: [`${targetName} is already the active Claude account.`],
         });
     }
-    // Materialise pre-migration flat backups into the profile home first so the
-    // health probe (and the install) read one canonical store.
     const stored = readStoredClaudeAccount(uuid);
     if (!stored) {
         return (0, accountSwitch_1.finishSwitchResult)({
@@ -486,7 +864,8 @@ function switchToAccountUnlocked(uuid, options, consumers) {
             error: `Stored credentials for "${targetName}" not found; sign in again.`,
         });
     }
-    // Preflight: never install a credential we already know is dead.
+    // Preflight on the credential that would be installed: never install one we
+    // already know is dead.
     const health = (0, accountHealth_1.getAccountHealth)('claude-code', target.id, { probe: 'store' });
     base.health = health;
     if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
@@ -500,8 +879,123 @@ function switchToAccountUnlocked(uuid, options, consumers) {
     if (health.state === 'expiring' && health.reason) {
         base.warnings.push(`"${targetName}": ${health.reason}`);
     }
-    // Snapshot the live state for rollback.
-    const originalCreds = (0, credentialIO_1.readActiveCredentials)();
+    if (!options.force && (0, accountLease_1.isAccountLeaseHeld)('claude-code', target.id)) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            error: `Keep-alive is refreshing "${targetName}" right now; try again in a few seconds.`,
+        });
+    }
+    try {
+        return (0, claudeRefreshLock_1.withClaudeRefreshLocksSync)([(0, claudeProfiles_1.getLiveClaudeHome)(), (0, claudeProfiles_1.getClaudeProfileHome)(uuid)], () => installSwitchTargetUnlocked(target, targetName, base, previousAccountId));
+    }
+    catch (err) {
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            success: false,
+            error: err instanceof claudeRefreshLock_1.ClaudeRefreshLockBusyError
+                ? `${err.message} Nothing was changed.`
+                : `The switch failed before anything was changed: ${err}`,
+        });
+    }
+}
+/**
+ * Capture → journal → install → verify → commit, holding the swap lock and
+ * Claude Code's refresh locks for the live home and the target's home.
+ */
+function installSwitchTargetUnlocked(target, targetName, base, previousAccountId) {
+    const uuid = profileKey(target);
+    const fail = (error, extra = {}) => (0, accountSwitch_1.finishSwitchResult)({ ...base, success: false, error, ...extra });
+    // Re-read inside the refresh locks: a keep-alive or CLI may have moved either store.
+    const stored = readStoredClaudeAccount(uuid);
+    const targetCreds = (0, claudeCredentials_1.parseClaudeCredentialBlob)(stored?.credentials);
+    if (!stored || !targetCreds) {
+        return fail(`Stored credentials for "${targetName}" not found; sign in again.`, {
+            needsLogin: true,
+        });
+    }
+    let live = (0, credentialIO_1.readClaudeCredentialStore)();
+    if (live.status === 'error') {
+        return fail('The live Claude login could not be read, so nothing was changed. Try again.');
+    }
+    const liveIdentity = readActiveClaudeAccount();
+    const outgoing = liveIdentity ? findClaudeProfileForIdentity(liveIdentity) : null;
+    const outgoingUuid = outgoing ? profileKey(outgoing) : null;
+    let liveCreds = live.status === 'ok' ? (0, claudeCredentials_1.parseClaudeCredentialBlob)(live.blob) : null;
+    if (outgoingUuid === uuid) {
+        // The live login is this profile under a rotated account id (matched by
+        // email): installing its saved copy would be a downgrade, not a switch.
+        return (0, accountSwitch_1.finishSwitchResult)({
+            ...base,
+            alreadyActive: true,
+            verified: true,
+            verification: 'store',
+            health: (0, accountHealth_1.getAccountHealth)('claude-code', target.id),
+            hints: [`${targetName} is already the active Claude account.`],
+        });
+    }
+    const liveFp = (0, claudeCredentials_1.claudeRefreshFingerprint)(liveCreds);
+    const liveOwner = liveFp && outgoingUuid ? findProfileHoldingFingerprint(liveFp, outgoingUuid) : null;
+    if (liveOwner) {
+        // Capturing would file that chain under the wrong account.
+        return fail(`The live credential belongs to ${liveOwner.label ?? liveOwner.email ?? liveOwner.id}, but the live identity says ${liveIdentity?.email}; run \`claude\` once (or sign in again) and retry. Nothing was changed.`);
+    }
+    // Capture the outgoing login, verified, before anything replaces it. This
+    // is mandatory even with `force`: losing it would lose that account's chain.
+    let captured = false;
+    const capture = (blob) => {
+        if (!outgoingUuid) {
+            return 'The live login has no account identity to save it under; run `claude` once and retry.';
+        }
+        try {
+            writeClaudeBackup(outgoingUuid, blob);
+            return null;
+        }
+        catch (err) {
+            return `The outgoing login could not be saved, so nothing was changed: ${err}`;
+        }
+    };
+    if (liveCreds && live.status === 'ok') {
+        const error = capture(live.blob);
+        if (error)
+            return fail(error);
+        captured = true;
+    }
+    const fromFp = (0, claudeCredentials_1.claudeRefreshFingerprint)(liveCreds);
+    const toFp = (0, claudeCredentials_1.claudeRefreshFingerprint)(targetCreds);
+    writeSwitchJournal({
+        from: outgoingUuid,
+        to: uuid,
+        fromFp,
+        toFp,
+        at: new Date().toISOString(),
+    });
+    // The live store must not have moved since the capture.
+    const recheck = (0, credentialIO_1.readClaudeCredentialStore)();
+    if (recheck.status === 'error') {
+        clearSwitchJournal();
+        return fail('The live Claude login could not be re-read, so nothing was changed. Try again.');
+    }
+    const recheckCreds = recheck.status === 'ok' ? (0, claudeCredentials_1.parseClaudeCredentialBlob)(recheck.blob) : null;
+    if ((0, claudeCredentials_1.claudeRefreshFingerprint)(recheckCreds) !== fromFp &&
+        recheck.status === 'ok' &&
+        recheckCreds) {
+        const error = capture(recheck.blob);
+        if (error) {
+            clearSwitchJournal();
+            return fail(error);
+        }
+        captured = true;
+        live = recheck;
+        liveCreds = recheckCreds;
+        writeSwitchJournal({
+            from: outgoingUuid,
+            to: uuid,
+            fromFp: (0, claudeCredentials_1.claudeRefreshFingerprint)(liveCreds),
+            toFp,
+            at: new Date().toISOString(),
+        });
+    }
     let originalConfig = null;
     try {
         originalConfig = fs.readFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), 'utf8');
@@ -509,13 +1003,25 @@ function switchToAccountUnlocked(uuid, options, consumers) {
     catch {
         /* no existing config to back up */
     }
-    const rollback = () => {
-        if (originalCreds) {
-            try {
-                (0, credentialIO_1.writeActiveCredentials)(originalCreds);
-            }
-            catch {
-                /* rollback failed */
+    const install = installIntoLiveClaudeStore(stored.credentials, uuid, 'switch', {
+        live,
+        liveAccountUuid: liveIdentity?.uuid ?? null,
+        capturedOutgoing: captured,
+    });
+    const rollback = (written) => {
+        // Nothing usable was displaced when live held no login: there is nothing
+        // to put back, and the result must not claim otherwise.
+        let restored = live.status === 'ok';
+        if (live.status === 'ok') {
+            const current = (0, credentialIO_1.readClaudeCredentialStore)();
+            const untouched = current.status === 'ok' && JSON.stringify(current.blob) === JSON.stringify(live.blob);
+            if (!untouched) {
+                const undo = installIntoLiveClaudeStore(live.blob, outgoingUuid ?? uuid, 'rollback', {
+                    live: current,
+                    liveAccountUuid: readActiveClaudeAccount()?.uuid ?? null,
+                    written,
+                });
+                restored = undo.ok;
             }
         }
         if (originalConfig !== null) {
@@ -523,7 +1029,7 @@ function switchToAccountUnlocked(uuid, options, consumers) {
                 fs.writeFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), originalConfig);
             }
             catch {
-                /* rollback failed */
+                restored = false;
             }
         }
         try {
@@ -532,50 +1038,69 @@ function switchToAccountUnlocked(uuid, options, consumers) {
         catch {
             /* rollback failed */
         }
+        clearSwitchJournal();
+        return restored;
     };
-    // Install.
+    const restoredSuffix = (restored) => restored
+        ? 'the previous login was restored.'
+        : captured
+            ? 'the previous login could not be restored automatically; it is saved, run `sidekick accounts doctor`.'
+            : 'the live store held no usable login before the switch; run `sidekick accounts doctor`.';
+    if (!install.ok) {
+        if (!install.wrote) {
+            clearSwitchJournal();
+            return fail(install.reason);
+        }
+        const restored = rollback(install.attempted);
+        return fail(`Failed to write Claude credentials (${install.reason}); ${restoredSuffix(restored)}`);
+    }
     try {
-        (0, credentialIO_1.writeActiveCredentials)(stored.credentials);
         mergeOauthAccountIntoLiveConfig(stored.oauthAccount);
     }
     catch (err) {
-        rollback();
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            error: `Failed to write Claude credentials: ${err}`,
-        });
+        const restored = rollback(install.installed);
+        return fail(`Failed to write the Claude identity (${err}); ${restoredSuffix(restored)}`);
     }
     // Verify by re-reading the live store.
-    const installed = (0, claudeCredentials_1.parseClaudeCredentialBlob)((0, credentialIO_1.readActiveCredentials)());
-    const expected = (0, claudeCredentials_1.parseClaudeCredentialBlob)(stored.credentials);
-    const liveIdentity = readActiveClaudeAccount();
-    const verified = installed !== null &&
-        expected !== null &&
-        installed.accessToken === expected.accessToken &&
-        liveIdentity?.uuid === uuid;
+    const installed = (0, credentialIO_1.readClaudeCredentialStore)(undefined, { keychainOnly: true });
+    const installedCreds = installed.status === 'ok' ? (0, claudeCredentials_1.parseClaudeCredentialBlob)(installed.blob) : null;
+    const verified = installedCreds !== null &&
+        installedCreds.accessToken === targetCreds.accessToken &&
+        readActiveClaudeAccount()?.uuid === uuid;
     if (!verified) {
-        rollback();
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            verification: 'failed',
-            error: `The live Claude credential store did not reflect the switch to "${targetName}"; the previous login was restored.`,
-        });
+        const restored = rollback(install.installed);
+        return fail(`The live Claude credential store did not reflect the switch to "${targetName}"; ${restoredSuffix(restored)}`, { verification: 'failed' });
     }
-    // Pointer last: a crash before this line leaves the registry pointing at the
-    // previous account, which the next sync repairs from the live identity.
+    // Pointer before the rest of the commit: from here on the switch happened.
     try {
         (0, accountRegistry_1.setActiveSavedAccount)('claude-code', target.id);
     }
     catch (err) {
-        rollback();
-        return (0, accountSwitch_1.finishSwitchResult)({
-            ...base,
-            success: false,
-            error: `Failed to update account registry: ${err}`,
-        });
+        const restored = rollback(install.installed);
+        return fail(`Failed to update account registry (${err}); ${restoredSuffix(restored)}`);
     }
+    // Commit: the outgoing account becomes inactive and gets its single CLI copy;
+    // the target is live and keeps none.
+    if (outgoingUuid && captured && live.status === 'ok') {
+        try {
+            materializeInactiveProfile(outgoingUuid, live.blob);
+            (0, accountHealth_1.writeClaudeHealthSidecar)(outgoingUuid, live.blob, 'switch');
+        }
+        catch (err) {
+            base.warnings.push(`The previous login is saved, but its profile copy could not be written yet (${err}).`);
+        }
+    }
+    try {
+        writeClaudeBackup(uuid, install.installed);
+        (0, accountHealth_1.writeClaudeHealthSidecar)(uuid, install.installed, 'switch');
+    }
+    catch {
+        /* the next sync refreshes the live account's backup */
+    }
+    if (!(0, credentialIO_1.deleteStoredCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(uuid))) {
+        base.warnings.push(`"${targetName}"'s profile copy could not be removed; the next sync retries.`);
+    }
+    clearSwitchJournal();
     let undoToken;
     try {
         undoToken = (0, accountSwitch_1.writeLastSwitch)('claude-code', previousAccountId, target.id).token;
@@ -594,94 +1119,89 @@ function switchToAccountUnlocked(uuid, options, consumers) {
 /**
  * Install a saved profile's credentials into the live home without changing
  * which account is active: used right after a re-login of the live account,
- * whose freshly minted token must replace the (possibly dead) live one.
+ * whose freshly minted token must replace the (possibly dead) live one. The
+ * guard only lets a strictly fresher credential of the same account through;
+ * when live is already at least as new, nothing is written.
  */
 function applyClaudeProfileToLiveHome(uuid) {
+    if ((0, claudeProfiles_1.isLiveClaudeHomeSidekickProfile)()) {
+        return {
+            success: false,
+            error: `CLAUDE_CONFIG_DIR points at a sidekick profile home (${path.resolve((0, claudeProfiles_1.getLiveClaudeHome)())}); the login was saved, but unset it before making the account live.`,
+        };
+    }
     try {
         return withClaudeAuthSwapLock(() => {
             const stored = readStoredClaudeAccount(uuid);
             if (!stored) {
                 return { success: false, error: `Stored credentials for ${uuid} not found.` };
             }
-            (0, credentialIO_1.writeActiveCredentials)(stored.credentials);
-            mergeOauthAccountIntoLiveConfig(stored.oauthAccount);
-            return { success: true };
+            const profileHome = (0, claudeProfiles_1.getClaudeProfileHome)(uuid);
+            return (0, claudeRefreshLock_1.withClaudeRefreshLocksSync)([(0, claudeProfiles_1.getLiveClaudeHome)(), profileHome], () => {
+                const live = (0, credentialIO_1.readClaudeCredentialStore)();
+                const liveUuid = readActiveClaudeAccount()?.uuid ?? null;
+                const install = installIntoLiveClaudeStore(stored.credentials, uuid, 'relogin', {
+                    live,
+                    liveAccountUuid: liveUuid,
+                });
+                if (!install.ok) {
+                    if (install.code === 'not-newer') {
+                        return { success: true, warning: install.reason };
+                    }
+                    return {
+                        success: false,
+                        error: `Could not install the refreshed credentials: ${install.reason}`,
+                    };
+                }
+                mergeOauthAccountIntoLiveConfig(stored.oauthAccount);
+                writeClaudeBackup(uuid, install.installed);
+                (0, accountHealth_1.writeClaudeHealthSidecar)(uuid, install.installed, 'login');
+                // The account is live now: its profile home keeps no CLI copy.
+                (0, credentialIO_1.deleteStoredCredentials)(profileHome);
+                return { success: true };
+            });
         });
     }
     catch (err) {
         return { success: false, error: `Could not install the refreshed credentials: ${err}` };
     }
 }
+/**
+ * @deprecated The home `claude` should use for the active account. The live
+ * account's profile home holds no credential, so this is the live home for the
+ * live account; kept for API compatibility.
+ */
 function resolveActiveClaudeHome() {
     const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
     if (!active)
         return (0, claudeProfiles_1.getLiveClaudeHome)();
-    return (0, claudeProfiles_1.getClaudeProfileHome)(active.providerAccountId ?? active.id);
+    const uuid = active.providerAccountId ?? active.id;
+    return isLiveClaudeAccount(uuid) ? (0, claudeProfiles_1.getLiveClaudeHome)() : (0, claudeProfiles_1.getClaudeProfileHome)(uuid);
 }
+/**
+ * @deprecated Re-install the active profile's credential into the live home.
+ * It never follows the registry pointer across accounts (after a native
+ * `claude /login` the pointer can be stale): when the live login is another
+ * account it refuses — use {@link switchToAccount}. For the same account it is
+ * a guarded re-login that writes only a strictly fresher credential.
+ */
 function applyActiveClaudeToLiveHome() {
-    try {
-        // Keep the non-throwing result contract when the lock cannot be acquired.
-        return withClaudeAuthSwapLock(applyActiveClaudeToLiveHomeUnlocked);
-    }
-    catch (err) {
-        return { success: false, error: `Could not acquire the account-switch lock: ${err}` };
-    }
-}
-function applyActiveClaudeToLiveHomeUnlocked() {
     const active = (0, accountRegistry_1.getActiveSavedAccount)('claude-code');
     if (!active) {
         return { success: false, error: 'No active Claude account found.' };
     }
     const uuid = active.providerAccountId ?? active.id;
-    const stored = readStoredClaudeAccount(uuid);
-    if (!stored) {
-        return { success: false, error: `Stored credentials for ${active.email ?? uuid} not found.` };
-    }
-    const originalCreds = (0, credentialIO_1.readActiveCredentials)();
-    let originalConfig = null;
-    try {
-        originalConfig = fs.readFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), 'utf8');
-    }
-    catch {
-        /* no existing config to back up */
-    }
-    try {
-        (0, credentialIO_1.writeActiveCredentials)(stored.credentials);
-    }
-    catch (err) {
-        if (originalCreds) {
-            try {
-                (0, credentialIO_1.writeActiveCredentials)(originalCreds);
-            }
-            catch {
-                /* rollback failed */
-            }
-        }
-        return { success: false, error: `Failed to write credentials: ${err}` };
-    }
-    try {
-        mergeOauthAccountIntoLiveConfig(stored.oauthAccount);
+    const liveUuid = readActiveClaudeAccount()?.uuid;
+    if (liveUuid && liveUuid !== uuid) {
+        return {
+            success: false,
+            error: 'The live Claude login belongs to another account; use switchToAccount() to change accounts.',
+        };
     }
-    catch (err) {
-        if (originalCreds) {
-            try {
-                (0, credentialIO_1.writeActiveCredentials)(originalCreds);
-            }
-            catch {
-                /* rollback failed */
-            }
-        }
-        if (originalConfig) {
-            try {
-                fs.writeFileSync((0, claudeProfiles_1.getClaudeConfigPath)(), originalConfig);
-            }
-            catch {
-                /* rollback failed */
-            }
-        }
-        return { success: false, error: `Failed to write config: ${err}` };
+    if (!readStoredClaudeAccount(uuid)) {
+        return { success: false, error: `Stored credentials for ${active.email ?? uuid} not found.` };
     }
-    return { success: true };
+    return applyClaudeProfileToLiveHome(uuid);
 }
 function reconcileClaudeAuthState() {
     try {
@@ -693,15 +1213,18 @@ function reconcileClaudeAuthState() {
             for (const profile of registry.accounts.filter((account) => account.providerId === 'claude-code')) {
                 try {
                     const uuid = profile.providerAccountId ?? profile.id;
+                    // The live account keeps no profile-home copy; nothing to migrate.
+                    if (isLiveClaudeAccount(uuid))
+                        continue;
                     if ((0, credentialIO_1.readActiveCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(uuid)) &&
                         readProfileClaudeOauthAccount(uuid)) {
                         continue;
                     }
-                    const credentials = readFlatClaudeCredentials(uuid);
+                    const credentials = readClaudeBackup(uuid);
                     const oauthAccount = readFlatClaudeOauthAccount(uuid);
                     if (!credentials || !oauthAccount)
                         continue;
-                    writeClaudeProfileMirror(uuid, credentials, oauthAccount, 'migration');
+                    withClaudeAuthSwapLock(() => writeClaudeProfileMirrorUnlocked(uuid, credentials, oauthAccount, 'migration'));
                 }
                 catch {
                     // Migration is best-effort per account.
@@ -728,7 +1251,7 @@ function removeAccount(uuid) {
         }
         // Remove backed-up files and the profile home (credential store included).
         for (const filePath of [
-            path.join(getCredentialsDir(), `${uuid}.credentials.json`),
+            (0, claudeProfiles_1.getClaudeCredentialBackupPath)(uuid),
             path.join(getConfigsDir(), `${uuid}.config.json`),
         ]) {
             try {