sidekick-shared 0.27.6 → 0.28.0

package/dist/esm/keepAlive.js

@@ -0,0 +1,189 @@
+/**
+ * Opt-in keep-alive for saved-but-inactive accounts. Sidekick never calls the
+ * providers' OAuth endpoints itself: it runs the official CLI inside the
+ * profile's isolated home and lets the CLI refresh (and rotate) the token
+ * where it belongs, then re-reads the store to record the new expiry.
+ *
+ * A refresh rotates the refresh token, so keep-alive only runs where the
+ * profile home holds the one live copy of its chain: never the live account,
+ * never a copy whose refresh token equals live's, never a copy taken from the
+ * live store that no switch has handed back yet, and never a stale copy when
+ * the backup is newer. The check and a lease are taken under the swap lock, so
+ * no switch can install that account while its CLI is refreshing.
+ */
+import { runCodexKeepAlive } from './codexKeepAlive';
+import { beginCodexKeepAlive, finishCodexKeepAlive, getCodexKeepAliveBlocker, } from './codexProfiles';
+import { getSystemCodexHome } from './codexPaths';
+import { canonicalCodexPath, readCodexCredentialStore } from './codexCredentialStore';
+import { compareCodexAuthFreshness, identitiesMatch, readAuthIdentityFromRaw } from './codexAuth';
+import { execFile } from 'child_process';
+import { getAccountHealth, listAccountsWithHealth } from './accountHealth';
+import { getAccountLaunchEnv } from './accountLaunch';
+import { beginClaudeKeepAlive, finishClaudeKeepAlive, getClaudeKeepAliveBlocker } from './accounts';
+/** The command each CLI runs to load (and refresh) its stored login. */
+export function keepAliveCommand(provider) {
+    if (provider === 'codex')
+        return { command: 'codex', args: ['app-server', '-c', 'cli_auth_credentials_store="file"'] };
+    const override = process.env.SIDEKICK_CLAUDE_KEEPALIVE_ARGS?.trim();
+    return { command: 'claude', args: override ? override.split(/\s+/) : ['auth', 'status'] };
+}
+/** How long a keep-alive lease outlives the CLI timeout before it lapses on its own. */
+const LEASE_GRACE_MS = 30_000;
+const defaultRunner = (command, args, env, timeoutMs) => command === 'codex'
+    ? runCodexKeepAlive(command, args, env, timeoutMs)
+    : new Promise((resolve) => {
+        try {
+            execFile(command, args, { encoding: 'utf8', env, timeout: timeoutMs, killSignal: 'SIGKILL', windowsHide: true }, (error, stdout) => {
+                const status = error
+                    ? (error.code ?? null)
+                    : 0;
+                resolve({
+                    status: typeof status === 'number' ? status : null,
+                    stdout: String(stdout ?? ''),
+                });
+            });
+        }
+        catch {
+            resolve({ status: null, stdout: '' });
+        }
+    });
+function eligible(view, includeFresh) {
+    if (view.health.isLive)
+        return 'live account; the CLI refreshes it in normal use';
+    if (view.health.state === 'expired')
+        return 'expired; sign in again';
+    if (view.health.state === 'missing')
+        return 'no stored credentials';
+    if (view.health.state === 'fresh' && !includeFresh)
+        return 'fresh';
+    if (view.providerId === 'codex' && view.health.state === 'unknown')
+        return 'api-key login';
+    return null;
+}
+/**
+ * Serialised, bounded refresh of every inactive account that is `expiring`
+ * (or `unknown` for Claude). Never touches the live account or any copy of
+ * its chain.
+ */
+export async function refreshInactiveAccounts(options = {}) {
+    const result = { refreshed: [], skipped: [], failed: [] };
+    const timeoutMs = options.timeoutMs ?? 20_000;
+    const runner = options.runner ?? defaultRunner;
+    const views = listAccountsWithHealth(undefined, { now: options.now }).filter((view) => !options.providers || options.providers.includes(view.providerId));
+    for (const view of views) {
+        const reason = eligible(view, options.includeFresh ?? false);
+        if (reason) {
+            result.skipped.push({ id: view.id, providerId: view.providerId, reason });
+            continue;
+        }
+        const isClaude = view.providerId === 'claude-code';
+        const beginLease = isClaude ? beginClaudeKeepAlive : beginCodexKeepAlive;
+        const finishLease = isClaude ? finishClaudeKeepAlive : finishCodexKeepAlive;
+        if (options.dryRun) {
+            const blocker = (isClaude ? getClaudeKeepAliveBlocker : getCodexKeepAliveBlocker)(view.id);
+            if (blocker) {
+                result.skipped.push({ id: view.id, providerId: view.providerId, reason: blocker });
+                continue;
+            }
+        }
+        const { command, args } = keepAliveCommand(view.providerId);
+        if (options.dryRun) {
+            result.skipped.push({
+                id: view.id,
+                providerId: view.providerId,
+                reason: `dry run: would run ${command} ${args.join(' ')}`,
+            });
+            continue;
+        }
+        {
+            const begin = beginLease(view.id, timeoutMs + LEASE_GRACE_MS);
+            if (!begin.ok) {
+                result.skipped.push({ id: view.id, providerId: view.providerId, reason: begin.reason });
+                continue;
+            }
+        }
+        let released = false;
+        const release = () => {
+            if (!released) {
+                released = true;
+                finishLease(view.id);
+            }
+        };
+        try {
+            const launch = getAccountLaunchEnv(view.providerId, view.id, {
+                materialize: true,
+                restoreBackup: false,
+            });
+            if (launch.error) {
+                release();
+                result.skipped.push({ id: view.id, providerId: view.providerId, reason: launch.error });
+                continue;
+            }
+            if (!isClaude &&
+                canonicalCodexPath(launch.home) === canonicalCodexPath(getSystemCodexHome())) {
+                result.skipped.push({
+                    id: view.id,
+                    providerId: view.providerId,
+                    reason: 'the account became live before refresh',
+                });
+                continue;
+            }
+            const before = isClaude ? null : readCodexCredentialStore(launch.home);
+            const env = { ...process.env, ...launch.env };
+            for (const name of launch.envUnset)
+                delete env[name];
+            if (!isClaude)
+                for (const name of [
+                    'OPENAI_API_KEY',
+                    'CODEX_API_KEY',
+                    'CODEX_ACCESS_TOKEN',
+                    'OPENAI_FEDERATION_RULE_ID',
+                    'OPENAI_IDENTITY_TOKEN_FILE',
+                    'OPENAI_WORKLOAD_IDENTITY_CONTEXT',
+                ])
+                    delete env[name];
+            let run;
+            try {
+                run = await runner(command, args, env, timeoutMs);
+            }
+            finally {
+                release();
+            }
+            const after = getAccountHealth(view.providerId, view.id, {
+                probe: 'store',
+                now: options.now,
+            });
+            const codexAfter = isClaude ? null : readCodexCredentialStore(launch.home);
+            const advanced = isClaude ||
+                (before?.status === 'ok' &&
+                    codexAfter?.status === 'ok' &&
+                    identitiesMatch(readAuthIdentityFromRaw(before.snapshot.authRaw), readAuthIdentityFromRaw(codexAfter.snapshot.authRaw)) &&
+                    compareCodexAuthFreshness(codexAfter.snapshot.authRaw, before.snapshot.authRaw) > 0);
+            if (after.state === 'fresh' && advanced && (isClaude || run.status === 0)) {
+                result.refreshed.push({ id: view.id, providerId: view.providerId });
+            }
+            else {
+                result.failed.push({
+                    id: view.id,
+                    providerId: view.providerId,
+                    error: run.status === 0
+                        ? isClaude
+                            ? `${command} ran but the stored credential is still ${after.state}.`
+                            : `${command} ran but no verified credential advance was observed (health: ${after.state}).`
+                        : `${command} exited with status ${run.status ?? 'unknown'}.${isClaude ? '' : ' Codex app-server refresh requires a compatible Codex CLI; update it and retry.'}`,
+                });
+            }
+        }
+        catch (err) {
+            result.failed.push({
+                id: view.id,
+                providerId: view.providerId,
+                error: isClaude ? String(err) : 'Codex keep-alive could not complete safely.',
+            });
+        }
+        finally {
+            release();
+        }
+    }
+    return result;
+}

package/dist/esm/liveCredentialGuard.js

@@ -0,0 +1,33 @@
+export function decideLiveCredentialWrite(f) {
+    const refuse = (code, reason) => ({ allow: false, code, reason });
+    if (f.liveStatus === 'error' || (f.rejectCorrupt && f.liveStatus === 'corrupt')) {
+        return refuse('live-unreadable', `The live ${f.provider} login could not be read, so it was left untouched.`);
+    }
+    if (f.intent === 'rollback') {
+        return f.matchesWritten || (f.allowNonOkRollback && f.liveStatus !== 'ok')
+            ? { allow: true }
+            : refuse('live-changed', `The live ${f.provider} login changed after the switch wrote it; it was kept.`);
+    }
+    if (!f.candidateValid)
+        return refuse('invalid-candidate', `The saved credential is not a ${f.provider} login.`);
+    if (f.intent === 'switch') {
+        if (f.liveAccountId !== null && f.liveAccountId === f.candidateAccountId) {
+            return refuse('same-account', 'That account is already the live login.');
+        }
+        if (f.sameLink)
+            return refuse('same-link', 'The saved login is the same refresh token the live login holds; sign in to that account again.');
+        if (f.liveHasCredential && !f.capturedOutgoing) {
+            return refuse('not-captured', 'The outgoing live login was not saved first, so it was left untouched.');
+        }
+        return { allow: true };
+    }
+    if (f.liveAccountId !== null && f.liveAccountId !== f.candidateAccountId) {
+        return refuse('different-account', `The live ${f.provider} login belongs to another account; switch accounts instead.`);
+    }
+    if (!f.liveHasCredential)
+        return { allow: true };
+    if (!f.strictlyNewer || (f.requireDifferentLinkForAdvance && f.sameLink)) {
+        return refuse('not-newer', `The live ${f.provider} login is already at least as new; it was kept.`);
+    }
+    return { allow: true };
+}

package/dist/esm/modelAliases.js

@@ -0,0 +1,51 @@
+const aliases = new Map();
+function normalizeAlias(value) {
+    return value.trim().toLowerCase();
+}
+/**
+ * Register a short or host-specific model name that resolves to a canonical ID.
+ * Invalid and cyclic registrations are rejected without changing the registry.
+ */
+export function registerModelAlias(alias, canonicalId) {
+    const normalizedAlias = normalizeAlias(alias);
+    const normalizedCanonicalId = normalizeAlias(canonicalId);
+    if (!normalizedAlias || !normalizedCanonicalId || normalizedAlias === normalizedCanonicalId) {
+        return false;
+    }
+    let candidate = normalizedCanonicalId;
+    const visited = new Set([normalizedAlias]);
+    while (aliases.has(candidate)) {
+        if (visited.has(candidate))
+            return false;
+        visited.add(candidate);
+        candidate = aliases.get(candidate);
+    }
+    if (candidate === normalizedAlias)
+        return false;
+    aliases.set(normalizedAlias, normalizedCanonicalId);
+    return true;
+}
+/** Resolve a registered alias, returning normalized input when no alias exists. */
+export function resolveModelAlias(modelId) {
+    let current = normalizeAlias(modelId);
+    const visited = new Set();
+    while (aliases.has(current) && !visited.has(current)) {
+        visited.add(current);
+        current = aliases.get(current);
+    }
+    return current;
+}
+/** Internal snapshot used by the cross-realm catalog serializer. */
+export function _getModelAliases() {
+    return Object.fromEntries(aliases);
+}
+/** Internal hydration hook used by the cross-realm catalog importer. */
+export function _importModelAliases(values) {
+    for (const [alias, canonicalId] of Object.entries(values)) {
+        registerModelAlias(alias, canonicalId);
+    }
+}
+/** Internal test hook. */
+export function _clearModelAliases() {
+    aliases.clear();
+}

package/dist/esm/modelCatalog.js

@@ -0,0 +1,139 @@
+import { _getModelContextIds, _setImportedResolvedContextWindows, resolveModelContextWindow, } from './modelContext';
+import { _getModelPricingIds, _setImportedResolvedPricing, resolveModelPricing, } from './modelInfo';
+import { _getModelAliases, _importModelAliases, registerModelAlias, resolveModelAlias, } from './modelAliases';
+export const RESOLVED_MODEL_CATALOG_SCHEMA_VERSION = 1;
+function normalizedIds(ids) {
+    if (ids) {
+        return Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)));
+    }
+    const aliases = _getModelAliases();
+    return Array.from(new Set([
+        ..._getModelContextIds(),
+        ..._getModelPricingIds(),
+        ...Object.keys(aliases),
+        ...Object.values(aliases),
+    ])).sort();
+}
+/**
+ * Export an entirely serializable catalog suitable for IPC to another JS realm.
+ * Each entry records published, observed, and tier-effective context windows,
+ * plus pricing match provenance (including prefix inheritance).
+ */
+export function exportResolvedModelCatalog(ids) {
+    const models = {};
+    const selectedIds = normalizedIds(ids);
+    for (const id of selectedIds) {
+        const canonicalId = resolveModelAlias(id);
+        models[id] = {
+            id,
+            canonicalId,
+            contextWindow: resolveModelContextWindow(id),
+            pricing: resolveModelPricing(id),
+        };
+    }
+    const selectedCanonicalIds = new Set(Object.values(models).flatMap(({ id, canonicalId }) => [id, canonicalId]));
+    const aliases = Object.fromEntries(Object.entries(_getModelAliases()).filter(([alias, canonicalId]) => selectedCanonicalIds.has(alias) || selectedCanonicalIds.has(canonicalId)));
+    return { schemaVersion: RESOLVED_MODEL_CATALOG_SCHEMA_VERSION, models, aliases };
+}
+/**
+ * Hydrate exact model resolutions exported by another bundle realm.
+ * Invalid entries are skipped and reported; import never partially mutates an
+ * entry or throws for malformed IPC data.
+ */
+export function importResolvedModelCatalog(snapshot) {
+    const diagnostics = [];
+    if (!isRecord(snapshot) || snapshot.schemaVersion !== RESOLVED_MODEL_CATALOG_SCHEMA_VERSION) {
+        return { imported: 0, diagnostics: ['unsupported resolved model catalog snapshot'] };
+    }
+    const aliases = isStringRecord(snapshot.aliases) ? snapshot.aliases : {};
+    _importModelAliases(aliases);
+    const contexts = {};
+    const prices = {};
+    const models = isRecord(snapshot.models) ? snapshot.models : {};
+    let imported = 0;
+    for (const [key, rawEntry] of Object.entries(models)) {
+        if (!isResolvedEntry(rawEntry)) {
+            diagnostics.push(`ignored invalid model catalog entry: ${key}`);
+            continue;
+        }
+        const entry = rawEntry;
+        const normalizedKey = key.trim().toLowerCase();
+        const canonicalId = entry.canonicalId.trim().toLowerCase();
+        const context = cloneContext(entry.contextWindow, entry.id, canonicalId);
+        const pricing = clonePricing(entry.pricing, entry.id, canonicalId);
+        // Unresolved facets are not importable facts: pinning a 'default' window
+        // or 'none' pricing would outrank data the importing realm can resolve
+        // (or later learn) on its own.
+        const contextResolved = context.provenance.source !== 'default';
+        const pricingResolved = pricing.provenance.source !== 'none';
+        if (!contextResolved && !pricingResolved) {
+            diagnostics.push(`skipped unresolved model catalog entry: ${key}`);
+            continue;
+        }
+        for (const id of new Set([normalizedKey, entry.id.trim().toLowerCase(), canonicalId])) {
+            if (!id)
+                continue;
+            if (contextResolved)
+                contexts[id] = context;
+            if (pricingResolved)
+                prices[id] = pricing;
+        }
+        imported++;
+    }
+    _setImportedResolvedContextWindows(contexts);
+    _setImportedResolvedPricing(prices);
+    return { imported, diagnostics };
+}
+function cloneContext(value, modelId, canonicalModelId) {
+    return {
+        ...value,
+        modelId,
+        canonicalModelId,
+        provenance: { ...value.provenance },
+    };
+}
+function clonePricing(value, modelId, canonicalModelId) {
+    return {
+        ...value,
+        modelId,
+        canonicalModelId,
+        pricing: value.pricing ? { ...value.pricing } : null,
+        provenance: { ...value.provenance },
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isStringRecord(value) {
+    return isRecord(value) && Object.values(value).every((item) => typeof item === 'string');
+}
+function validPricing(value) {
+    if (!isRecord(value))
+        return false;
+    return [
+        value.inputCostPerMillion,
+        value.outputCostPerMillion,
+        value.cacheWriteCostPerMillion,
+        value.cacheReadCostPerMillion,
+    ].every((item) => typeof item === 'number' && Number.isFinite(item) && item >= 0);
+}
+function isResolvedEntry(value) {
+    if (!isRecord(value) || typeof value.id !== 'string' || typeof value.canonicalId !== 'string') {
+        return false;
+    }
+    const context = value.contextWindow;
+    const pricing = value.pricing;
+    if (!isRecord(context) || !isRecord(pricing))
+        return false;
+    if (typeof context.tierEffective !== 'number' ||
+        !Number.isFinite(context.tierEffective) ||
+        context.tierEffective <= 0 ||
+        (context.published !== null && typeof context.published !== 'number') ||
+        (context.observed !== null && typeof context.observed !== 'number') ||
+        !isRecord(context.provenance) ||
+        !isRecord(pricing.provenance)) {
+        return false;
+    }
+    return pricing.pricing === null || validPricing(pricing.pricing);
+}
+export { registerModelAlias, resolveModelAlias };