sidekick-shared 0.27.6 → 0.28.0

package/dist/esm/codexCredentialDoctor.js

@@ -0,0 +1,265 @@
+/** Inspection is read-only. Repairs touch only credential paths Sidekick owns. */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getAccountsDir, listSavedAccountProfiles } from './accountRegistry';
+import { codexRefreshFingerprint, compareCodexAuthFreshness, identitiesMatch, readAuthIdentityFromRaw, } from './codexAuth';
+import { getCodexLoginsDir, getCodexBackupPath, getCodexCredentialStoreMode, getCodexProfileHome, getCodexProfilesDir, getSystemCodexHome, } from './codexPaths';
+import { canonicalCodexPath, codexSnapshotFingerprint, isCodexLogin, isLegacyCodexLogin, readCodexBackup, readCodexCredentialStore, removeCodexProfileCredentials, writeCodexBackup, } from './codexCredentialStore';
+import { isAccountLeaseHeld } from './accountLease';
+import { inspectRunningAccountConsumersSync } from './processDetection';
+import { syncCodexLiveStateUnlocked, withCodexAuthSwapLock } from './codexProfiles';
+function within(child, root) {
+    const resolved = canonicalCodexPath(child), base = canonicalCodexPath(root);
+    return resolved === base || resolved.startsWith(base + path.sep);
+}
+function ownedDirectories(root) {
+    try {
+        return fs
+            .readdirSync(root, { withFileTypes: true })
+            .filter((e) => e.isDirectory() && !e.isSymbolicLink())
+            .map((e) => path.join(root, e.name))
+            .filter((dir) => within(dir, root));
+    }
+    catch {
+        return [];
+    }
+}
+function readFinding(f) {
+    if (!f.file)
+        return readCodexCredentialStore(f.configDir);
+    try {
+        const raw = fs.readFileSync(f.file, 'utf8');
+        const legacy = path.basename(f.file).startsWith('credentials-');
+        const snapshot = { authRaw: legacy ? null : raw, legacyRaw: legacy ? raw : null };
+        return {
+            status: (legacy ? isLegacyCodexLogin(raw) : isCodexLogin(raw)) ? 'ok' : 'corrupt',
+            snapshot,
+        };
+    }
+    catch (error) {
+        return error.code === 'ENOENT'
+            ? { status: 'absent', snapshot: { authRaw: null, legacyRaw: null } }
+            : { status: 'error' };
+    }
+}
+export function inspectCodexCredentialStores(options = {}) {
+    const now = options.now ?? Date.now();
+    const findings = [];
+    const live = readCodexCredentialStore();
+    if (live.status === 'corrupt' || live.status === 'error')
+        findings.push({
+            kind: live.status === 'error' ? 'unreadable' : 'corrupt',
+            configDir: getSystemCodexHome(),
+            ownership: 'live',
+            detail: 'The live Codex login could not be read; it may be mid-write.',
+            action: 'Close Codex and inspect again; live data is never deleted by doctor.',
+        });
+    const profiles = listSavedAccountProfiles('codex');
+    for (const profile of profiles) {
+        const backup = readCodexBackup(profile.id);
+        if (backup.status === 'error' || backup.status === 'corrupt')
+            findings.push({
+                kind: backup.status === 'error' ? 'unreadable' : 'corrupt',
+                ownership: 'backup',
+                accountId: profile.id,
+                email: profile.email,
+                configDir: path.dirname(getCodexBackupPath(profile.id)),
+                file: getCodexBackupPath(profile.id),
+                detail: 'The private Codex backup could not be read safely.',
+                action: 'Inspect the backup or sign in again; unreadable credentials are preserved.',
+            });
+    }
+    const candidates = [];
+    for (const root of [getCodexProfilesDir(), getCodexLoginsDir()]) {
+        for (const dir of ownedDirectories(root)) {
+            const pending = path.join(dir, 'profile.json');
+            if (fs.existsSync(pending)) {
+                try {
+                    const at = Date.parse(JSON.parse(fs.readFileSync(pending, 'utf8')).addedAt);
+                    if (!Number.isFinite(at) || now - at < 24 * 60 * 60 * 1000)
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+            }
+            const home = path.join(dir, 'codex-home');
+            if (within(home, root) &&
+                canonicalCodexPath(home) !== canonicalCodexPath(getSystemCodexHome())) {
+                candidates.push({
+                    configDir: home,
+                    ownership: root === getCodexProfilesDir() ? 'profile-home' : 'login-home',
+                });
+            }
+        }
+    }
+    const stash = path.join(getAccountsDir(), 'codex', 'stash');
+    for (const dir of ownedDirectories(stash)) {
+        const home = path.join(dir, 'codex-home');
+        if (within(home, stash))
+            candidates.push({ configDir: home, ownership: 'stash' });
+    }
+    try {
+        for (const entry of fs.readdirSync(stash, { withFileTypes: true })) {
+            if (entry.isFile() && /^(auth|credentials)-.*\.json$/.test(entry.name))
+                candidates.push({
+                    configDir: stash,
+                    file: path.join(stash, entry.name),
+                    ownership: 'stash',
+                });
+        }
+    }
+    catch {
+        /* no old stash */
+    }
+    for (const candidate of candidates) {
+        const store = readFinding(candidate);
+        if (store.status === 'absent')
+            continue;
+        const identity = store.status === 'ok' ? readAuthIdentityFromRaw(store.snapshot.authRaw) : null;
+        const profile = profiles.find((p) => identitiesMatch(identity, {
+            email: p.email ?? p.metadata?.email,
+            workspaceId: p.metadata?.workspaceId,
+        })) ??
+            profiles.find((p) => canonicalCodexPath(getCodexProfileHome(p.id)) === canonicalCodexPath(candidate.configDir));
+        const base = { ...candidate, accountId: profile?.id, email: identity?.email ?? profile?.email };
+        if (store.status === 'error' || store.status === 'corrupt') {
+            findings.push({
+                ...base,
+                kind: store.status === 'error' ? 'unreadable' : 'corrupt',
+                detail: 'This credential store could not be read safely.',
+                action: 'Inspect or sign in again; unreadable credentials are preserved.',
+            });
+            continue;
+        }
+        const fingerprint = codexSnapshotFingerprint(store.snapshot);
+        const liveDuplicate = live.status === 'ok' &&
+            (identitiesMatch(identity, readAuthIdentityFromRaw(live.snapshot.authRaw)) ||
+                fingerprint === codexSnapshotFingerprint(live.snapshot));
+        if (candidate.ownership === 'stash')
+            findings.push({
+                ...base,
+                fingerprint,
+                kind: 'stale-stash',
+                detail: 'An old stash holds another account credential.',
+                action: 'Preserve the freshest known login privately, then remove this credential.',
+            });
+        else if (liveDuplicate)
+            findings.push({
+                ...base,
+                fingerprint,
+                kind: 'live-duplicate',
+                detail: 'This home holds a second usable copy of the live Codex login.',
+                action: 'Repair a newer login first, then remove the duplicate when Codex is stopped.',
+            });
+        else if (!profile || candidate.ownership === 'login-home')
+            findings.push({
+                ...base,
+                fingerprint,
+                kind: 'orphan',
+                detail: 'An abandoned home holds a login outside a saved profile.',
+                action: 'Preserve it under its known account before removing it; unknown identities need manual review.',
+            });
+    }
+    if (fs.existsSync(path.join(getAccountsDir(), 'codex', 'switch-journal.json')))
+        findings.push({
+            kind: 'pending-switch',
+            ownership: 'journal',
+            configDir: path.join(getAccountsDir(), 'codex'),
+            detail: 'An interrupted account switch needs reconciliation.',
+            action: 'Close Codex and finish recovery from the live fingerprint.',
+        });
+    return { findings, homesChecked: candidates.length + 1 };
+}
+export function repairCodexCredentialStores(options = {}) {
+    const inspection = inspectCodexCredentialStores(options);
+    const result = {
+        ...inspection,
+        dryRun: options.dryRun ?? true,
+        repaired: [],
+    };
+    if (result.dryRun)
+        return result;
+    const scan = inspectRunningAccountConsumersSync('codex');
+    const mode = getCodexCredentialStoreMode();
+    if (!scan.ok || scan.consumers.length || (mode !== 'file' && mode !== 'unknown')) {
+        result.repaired = inspection.findings.map((finding) => ({
+            finding,
+            ok: false,
+            error: 'Repair requires stopped Codex consumers, a successful process scan, and readable file-mode configuration.',
+        }));
+        return result;
+    }
+    withCodexAuthSwapLock(() => {
+        result.sync = syncCodexLiveStateUnlocked('migration', { scan });
+        for (const finding of inspection.findings) {
+            let error;
+            try {
+                if (finding.kind === 'pending-switch') {
+                    if (fs.existsSync(path.join(finding.configDir, 'switch-journal.json')))
+                        throw new Error();
+                }
+                else if (finding.kind === 'live-duplicate' && finding.ownership === 'profile-home') {
+                    if (readFinding(finding).status !== 'absent')
+                        throw new Error();
+                }
+                else if (finding.kind === 'stale-stash' ||
+                    finding.kind === 'orphan' ||
+                    finding.kind === 'live-duplicate') {
+                    if (!within(finding.file ?? finding.configDir, path.join(getAccountsDir(), 'codex')) ||
+                        canonicalCodexPath(finding.configDir) === canonicalCodexPath(getSystemCodexHome()))
+                        throw new Error();
+                    const current = readFinding(finding);
+                    if (current.status === 'absent') {
+                        result.repaired.push({ finding, ok: true });
+                        continue;
+                    }
+                    if (current.status !== 'ok' ||
+                        codexSnapshotFingerprint(current.snapshot) !== finding.fingerprint ||
+                        !finding.accountId ||
+                        isAccountLeaseHeld('codex', finding.accountId))
+                        throw new Error();
+                    const backup = readCodexBackup(finding.accountId);
+                    if (backup.status === 'ok' &&
+                        compareCodexAuthFreshness(backup.snapshot.authRaw, current.snapshot.authRaw) === 0 &&
+                        codexSnapshotFingerprint(backup.snapshot) !==
+                            codexSnapshotFingerprint(current.snapshot) &&
+                        (!codexRefreshFingerprint(backup.snapshot.authRaw) ||
+                            codexRefreshFingerprint(backup.snapshot.authRaw) !==
+                                codexRefreshFingerprint(current.snapshot.authRaw))) {
+                        throw new Error(); // Two incomparable chains: deletion would guess which is usable.
+                    }
+                    const chosen = backup.status === 'ok' &&
+                        compareCodexAuthFreshness(backup.snapshot.authRaw, current.snapshot.authRaw) >= 0
+                        ? backup.snapshot
+                        : current.snapshot;
+                    writeCodexBackup(finding.accountId, chosen);
+                    const live = readCodexCredentialStore();
+                    if (live.status === 'ok' &&
+                        identitiesMatch(readAuthIdentityFromRaw(live.snapshot.authRaw), readAuthIdentityFromRaw(chosen.authRaw)) &&
+                        compareCodexAuthFreshness(chosen.authRaw, live.snapshot.authRaw) > 0) {
+                        result.sync = syncCodexLiveStateUnlocked('migration', { scan });
+                        const repairedLive = readCodexCredentialStore();
+                        if (repairedLive.status !== 'ok' ||
+                            compareCodexAuthFreshness(repairedLive.snapshot.authRaw, chosen.authRaw) < 0)
+                            throw new Error();
+                    }
+                    if (finding.file)
+                        fs.rmSync(finding.file);
+                    else
+                        removeCodexProfileCredentials(finding.configDir, current.snapshot);
+                    if (finding.ownership === 'login-home')
+                        fs.rmSync(path.dirname(finding.configDir), { recursive: true, force: true });
+                }
+                else
+                    throw new Error();
+            }
+            catch {
+                error =
+                    'Preserved for review: unreadable, ambiguous, changed, leased, or not safely repairable yet.';
+            }
+            result.repaired.push({ finding, ok: !error, error });
+        }
+    });
+    return result;
+}

package/dist/esm/codexCredentialStore.js

@@ -0,0 +1,164 @@
+/** Raw credential I/O. Backups are never Codex homes and never launchable. */
+import * as fs from 'fs';
+import * as path from 'path';
+import { createHash } from 'crypto';
+import { getAccountsDir } from './accountRegistry';
+import { getCodexBackupPath, getSystemCodexHome } from './codexPaths';
+import { parseAuthJson } from './codexAuth';
+import { atomicWriteFileSync } from './writers/atomic';
+export function isLegacyCodexLogin(raw) {
+    const value = parseAuthJson(raw);
+    return Boolean(value &&
+        ['OPENAI_API_KEY', 'CODEX_API_KEY'].some((key) => typeof value[key] === 'string' && value[key].length > 0));
+}
+export function isCodexLogin(raw) {
+    const parsed = parseAuthJson(raw);
+    if (!parsed || Array.isArray(parsed))
+        return false;
+    if (typeof parsed.OPENAI_API_KEY === 'string' && parsed.OPENAI_API_KEY)
+        return true;
+    return Boolean(typeof parsed.tokens?.access_token === 'string' &&
+        parsed.tokens.access_token &&
+        typeof parsed.tokens.refresh_token === 'string' &&
+        parsed.tokens.refresh_token);
+}
+export function codexLoginOnly(snapshot) {
+    return {
+        authRaw: snapshot.authRaw,
+        legacyRaw: isLegacyCodexLogin(snapshot.legacyRaw) ? snapshot.legacyRaw : null,
+    };
+}
+function readRaw(file) {
+    try {
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+function readFiles(auth, legacy) {
+    try {
+        const snapshot = { authRaw: readRaw(auth), legacyRaw: readRaw(legacy) };
+        const status = snapshot.authRaw !== null
+            ? isCodexLogin(snapshot.authRaw)
+                ? 'ok'
+                : 'corrupt'
+            : isLegacyCodexLogin(snapshot.legacyRaw)
+                ? 'ok'
+                : 'absent';
+        return { status, snapshot };
+    }
+    catch {
+        return { status: 'error' };
+    }
+}
+export function readCodexCredentialStore(home = getSystemCodexHome()) {
+    return readFiles(path.join(home, 'auth.json'), path.join(home, '.credentials.json'));
+}
+export function readCodexBackup(id) {
+    return readFiles(getCodexBackupPath(id), getCodexBackupPath(id, true));
+}
+export function codexSnapshotFingerprint(snapshot) {
+    return createHash('sha256').update(JSON.stringify(snapshot)).digest('hex');
+}
+/** The whole snapshot, including absence, must agree before destructive operations. */
+export function codexStoreMatches(read, snapshot) {
+    return (read.status !== 'error' &&
+        codexSnapshotFingerprint(read.snapshot) === codexSnapshotFingerprint(snapshot));
+}
+export function writeCodexBackup(id, snapshot) {
+    const login = codexLoginOnly(snapshot);
+    if (!isCodexLogin(login.authRaw) && !isLegacyCodexLogin(login.legacyRaw)) {
+        throw new Error('Refusing to back up an invalid Codex login.');
+    }
+    for (const [file, raw] of [
+        [getCodexBackupPath(id), login.authRaw],
+        [getCodexBackupPath(id, true), login.legacyRaw],
+    ]) {
+        if (raw !== null)
+            atomicWriteFileSync(file, raw);
+        else
+            fs.rmSync(file, { force: true });
+    }
+    if (!codexStoreMatches(readCodexBackup(id), login))
+        throw new Error('The private Codex backup did not verify.');
+}
+/** Resolve existing parents too, so nonexistent children of a symlink cannot bypass ownership. */
+export function canonicalCodexPath(value) {
+    const resolved = path.resolve(value);
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        const parent = path.dirname(resolved);
+        return parent === resolved
+            ? resolved
+            : path.join(canonicalCodexPath(parent), path.basename(resolved));
+    }
+}
+export function isSidekickCodexHome(home) {
+    const root = canonicalCodexPath(path.join(getAccountsDir(), 'codex'));
+    const resolved = canonicalCodexPath(home);
+    return resolved === root || resolved.startsWith(root + path.sep);
+}
+/** Install only account data; an unrelated MCP credential file is never copied or deleted. */
+export function codexInstalledSnapshot(before, candidate) {
+    const login = codexLoginOnly(candidate);
+    if (login.legacyRaw && before.legacyRaw && !isLegacyCodexLogin(before.legacyRaw)) {
+        throw new Error('Legacy Codex credentials would replace MCP data; sign in with Codex again.');
+    }
+    return {
+        authRaw: login.authRaw,
+        legacyRaw: before.legacyRaw && !isLegacyCodexLogin(before.legacyRaw)
+            ? before.legacyRaw
+            : login.legacyRaw,
+    };
+}
+function writeFiles(home, snapshot) {
+    for (const [name, raw] of [
+        ['auth.json', snapshot.authRaw],
+        ['.credentials.json', snapshot.legacyRaw],
+    ]) {
+        const file = path.join(home, name);
+        // Do not rewrite even identical MCP data; its own refresh writer owns it.
+        if (readRaw(file) === raw)
+            continue;
+        if (raw === null)
+            fs.rmSync(file, { force: true });
+        else
+            atomicWriteFileSync(file, raw);
+    }
+}
+export function writeInactiveCodexCredentialStore(home, candidate) {
+    if (canonicalCodexPath(home) === canonicalCodexPath(getSystemCodexHome())) {
+        throw new Error('A profile credential writer cannot write the live Codex home.');
+    }
+    const before = readCodexCredentialStore(home);
+    if (before.status === 'error')
+        throw new Error('The Codex profile could not be read.');
+    const expected = codexInstalledSnapshot(before.snapshot, candidate);
+    writeFiles(home, expected);
+    if (!codexStoreMatches(readCodexCredentialStore(home), expected))
+        throw new Error('The Codex profile write did not verify.');
+}
+/** Internal capability: only the guarded installer in codexProfiles may call this. */
+export function writeLiveCodexCredentialStoreUnguarded(snapshot) {
+    const home = getSystemCodexHome();
+    if (isSidekickCodexHome(home))
+        throw new Error('Unset CODEX_HOME before changing the live login; it names a Sidekick-owned home.');
+    writeFiles(home, snapshot);
+}
+export function removeCodexProfileCredentials(home, expected) {
+    if (canonicalCodexPath(home) === canonicalCodexPath(getSystemCodexHome()))
+        throw new Error('Refusing to remove live Codex credentials.');
+    if (!codexStoreMatches(readCodexCredentialStore(home), expected))
+        throw new Error('The Codex profile changed; its credential was kept.');
+    if (expected.authRaw !== null)
+        fs.rmSync(path.join(home, 'auth.json'), { force: true });
+    if (isLegacyCodexLogin(expected.legacyRaw))
+        fs.rmSync(path.join(home, '.credentials.json'), { force: true });
+    if (readCodexCredentialStore(home).status !== 'absent')
+        throw new Error('The Codex profile credential could not be removed.');
+}

package/dist/esm/codexKeepAlive.js

@@ -0,0 +1,112 @@
+/** A bounded, inference-free official CLI refresh. Never expose child output. */
+import { spawn } from 'child_process';
+export const runCodexKeepAlive = (command, args, env, timeoutMs) => new Promise((resolve) => {
+    let child;
+    try {
+        child = spawn(command, args, {
+            env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
+            cwd: env.CODEX_HOME,
+        });
+    }
+    catch {
+        resolve({ status: null, stdout: '' });
+        return;
+    }
+    let buffer = '';
+    let bytes = 0;
+    let initialized = false;
+    let result = null;
+    let finishing = false;
+    let settled = false;
+    let killTimer;
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    function finish(status) {
+        if (finishing)
+            return;
+        finishing = true;
+        result = status;
+        child.stdin?.end();
+        // The lease stays held until the child exits, including timeout/error paths.
+        killTimer = setTimeout(() => child.kill('SIGKILL'), Math.min(1000, timeoutMs));
+        if (status !== 0)
+            child.kill('SIGKILL');
+    }
+    function settle() {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        if (killTimer)
+            clearTimeout(killTimer);
+        child.stdin?.destroy();
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        resolve({ status: result, stdout: '' });
+    }
+    const send = (message) => {
+        if (!child.stdin?.writable) {
+            finish(null);
+            return;
+        }
+        child.stdin.write(JSON.stringify(message) + '\n');
+    };
+    child.once('error', settle);
+    child.once('close', settle);
+    child.once('exit', settle);
+    child.stdin?.on('error', () => finish(null));
+    child.stderr?.on('data', () => {
+        /* Drain, never log possibly sensitive diagnostics. */
+    });
+    child.stdout?.setEncoding('utf8');
+    child.stdout?.on('data', (chunk) => {
+        if (finishing)
+            return;
+        bytes += Buffer.byteLength(chunk);
+        if (bytes > 1024 * 1024) {
+            finish(null);
+            return;
+        }
+        buffer += chunk;
+        let newline;
+        while (!finishing && (newline = buffer.indexOf('\n')) >= 0) {
+            const line = buffer.slice(0, newline);
+            buffer = buffer.slice(newline + 1);
+            if (!line.trim())
+                continue;
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                finish(null);
+                return;
+            }
+            if (!message || typeof message !== 'object') {
+                finish(null);
+                return;
+            }
+            if (message.id === 0 && !initialized) {
+                if (message.error || !message.result) {
+                    finish(1);
+                    return;
+                }
+                initialized = true;
+                send({ method: 'initialized', params: {} });
+                send({ method: 'account/read', id: 1, params: { refreshToken: true } });
+            }
+            else if (message.id === 1 && initialized) {
+                finish(!message.error && message.result?.account?.type === 'chatgpt' ? 0 : 1);
+            }
+        }
+    });
+    send({
+        method: 'initialize',
+        id: 0,
+        params: {
+            clientInfo: { name: 'sidekick_agent_hub', title: 'Sidekick Agent Hub', version: '1' },
+            capabilities: null,
+        },
+    });
+});