sidekick-shared 0.27.6 → 0.28.0

package/dist/esm/accountHealth.js

@@ -0,0 +1,288 @@
+/**
+ * Per-account credential health. Health is derived from a secret-free sidecar
+ * (`health.json`) next to each profile, written whenever sidekick stores a
+ * credential, so reading health never spawns `security` or the provider CLI.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getClaudeCredentialBackupPath, getClaudeProfileDir, getClaudeProfileHome, readLiveClaudeIdentity, } from './claudeProfiles';
+import { claudeCredentialFreshness, claudeRefreshFingerprint, parseClaudeCredentialBlob, resolveClaudeRefreshExpiry, } from './claudeCredentials';
+import { readActiveCredentials, readClaudeCredentialStore } from './credentialIO';
+import { identitiesMatch, codexRefreshFingerprint, compareCodexAuthFreshness, readAccessTokenExpiry, readAuthIdentityFromRaw, readLastRefresh, STALE_AUTH_THRESHOLD_MS, } from './codexAuth';
+import { getCodexBackupPath, getCodexProfileDir, getCodexProfileHome, getSystemCodexHome, readFileOrNull, } from './codexPaths';
+import { getActiveSavedAccount, listSavedAccountProfiles, } from './accountRegistry';
+import { readCodexBackup, readCodexCredentialStore } from './codexCredentialStore';
+import { atomicWriteJsonSync } from './writers/atomic';
+/** Refresh tokens that expire within this window count as `expiring`. */
+const REFRESH_EXPIRY_WARNING_MS = 3 * 24 * 60 * 60 * 1000;
+export function getHealthSidecarPath(provider, accountId) {
+    const dir = provider === 'codex' ? getCodexProfileDir(accountId) : getClaudeProfileDir(accountId);
+    return path.join(dir, 'health.json');
+}
+export function readHealthSidecar(provider, accountId) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(getHealthSidecarPath(provider, accountId), 'utf8'));
+        return parsed?.version === 1 && typeof parsed.capturedAt === 'number' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeSidecar(provider, accountId, sidecar) {
+    try {
+        atomicWriteJsonSync(getHealthSidecarPath(provider, accountId), sidecar);
+    }
+    catch {
+        // Health is advisory; a failed sidecar write must not fail the credential write.
+    }
+}
+/** Build the sidecar for a Claude credential blob. */
+export function claudeHealthSidecarFromBlob(blob, source, now = Date.now()) {
+    const credentials = parseClaudeCredentialBlob(blob);
+    if (!credentials)
+        return null;
+    const refresh = resolveClaudeRefreshExpiry(credentials);
+    return {
+        version: 1,
+        capturedAt: now,
+        accessExpiresAt: credentials.expiresAt,
+        refreshExpiresAt: refresh?.refreshExpiresAt,
+        refreshExpiryEstimated: refresh?.estimated,
+        hasRefreshToken: Boolean(credentials.refreshToken),
+        authMode: 'oauth',
+        refreshFp: claudeRefreshFingerprint(credentials) ?? undefined,
+        source,
+    };
+}
+/** Record the health of a Claude profile from the credential just stored. */
+export function writeClaudeHealthSidecar(accountId, blob, source, now = Date.now()) {
+    const sidecar = claudeHealthSidecarFromBlob(blob, source, now);
+    if (sidecar)
+        writeSidecar('claude-code', accountId, sidecar);
+    return sidecar;
+}
+/** Build the sidecar for a raw Codex `auth.json`. */
+export function codexHealthSidecarFromAuth(authRaw, source, now = Date.now(), fallbackPath) {
+    const identity = readAuthIdentityFromRaw(authRaw);
+    if (!identity)
+        return null;
+    const lastRefreshAt = readLastRefresh(authRaw, fallbackPath) ?? undefined;
+    return {
+        version: 1,
+        capturedAt: now,
+        accessExpiresAt: readAccessTokenExpiry(authRaw) ?? undefined,
+        lastRefreshAt,
+        hasRefreshToken: codexRefreshFingerprint(authRaw) !== null,
+        refreshFp: codexRefreshFingerprint(authRaw) ?? undefined,
+        authMode: identity.authMode,
+        source,
+    };
+}
+/** Record the health of a Codex profile from the auth file just stored. */
+export function writeCodexHealthSidecar(accountId, authRaw, source, now = Date.now()) {
+    const sidecar = codexHealthSidecarFromAuth(authRaw, source, now);
+    if (sidecar)
+        writeSidecar('codex', accountId, sidecar);
+    return sidecar;
+}
+function stateFromClaudeSidecar(sidecar, now) {
+    const accessKnown = sidecar.accessExpiresAt !== undefined;
+    const accessExpired = accessKnown && sidecar.accessExpiresAt <= now;
+    if (sidecar.refreshExpiresAt !== undefined) {
+        if (sidecar.refreshExpiresAt <= now) {
+            return {
+                state: 'expired',
+                reason: sidecar.refreshExpiryEstimated
+                    ? 'Refresh token has most likely expired (estimated from the snapshot age).'
+                    : 'Refresh token expired; sign in again.',
+            };
+        }
+        if (sidecar.refreshExpiresAt - now <= REFRESH_EXPIRY_WARNING_MS) {
+            return { state: 'expiring', reason: 'Refresh token expires within 3 days.' };
+        }
+    }
+    if (sidecar.hasRefreshToken === false && accessExpired) {
+        return { state: 'expired', reason: 'Access token expired and no refresh token is stored.' };
+    }
+    if (accessExpired) {
+        return { state: 'expiring', reason: 'Access token expired; the CLI refreshes it on next use.' };
+    }
+    if (!accessKnown && sidecar.refreshExpiresAt === undefined) {
+        return { state: 'unknown', reason: 'The stored credential carries no expiry.' };
+    }
+    return { state: 'fresh' };
+}
+function stateFromCodexSidecar(sidecar, now) {
+    if (sidecar.authMode === 'api-key') {
+        return { state: 'unknown', reason: 'API-key login; expiry is not observable locally.' };
+    }
+    if (sidecar.accessExpiresAt !== undefined && sidecar.accessExpiresAt > now) {
+        return { state: 'fresh' };
+    }
+    if (sidecar.lastRefreshAt !== undefined &&
+        now - sidecar.lastRefreshAt > STALE_AUTH_THRESHOLD_MS) {
+        const days = Math.floor((now - sidecar.lastRefreshAt) / (24 * 60 * 60 * 1000));
+        return {
+            state: 'expiring',
+            reason: `Not refreshed in ${days} days; codex may ask you to log in again.`,
+        };
+    }
+    if (sidecar.accessExpiresAt !== undefined) {
+        return { state: 'expiring', reason: 'Access token expired; codex refreshes it on next use.' };
+    }
+    return { state: 'unknown', reason: 'The stored credential carries no expiry.' };
+}
+function isLiveClaudeAccount(accountId) {
+    return readLiveClaudeIdentity()?.uuid === accountId;
+}
+function isLiveCodexAccount(profile) {
+    const live = readAuthIdentityFromRaw(readFileOrNull(path.join(getSystemCodexHome(), 'auth.json')));
+    if (!live)
+        return false;
+    return identitiesMatch(live, {
+        email: profile.email ?? profile.metadata?.email,
+        workspaceId: profile.metadata?.workspaceId,
+    });
+}
+function readClaudeBackupBlob(accountId) {
+    try {
+        return JSON.parse(fs.readFileSync(getClaudeCredentialBackupPath(accountId), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The credential a Claude profile would use right now: the live store for the
+ * live account (its profile home is empty by design), otherwise the fresher of
+ * the profile-home store and Sidekick's backup.
+ */
+export function readEffectiveClaudeCredential(accountId) {
+    if (isLiveClaudeAccount(accountId))
+        return readActiveCredentials();
+    const store = readClaudeCredentialStore(getClaudeProfileHome(accountId));
+    const fromStore = store.status === 'ok' ? store.blob : null;
+    const backup = readClaudeBackupBlob(accountId);
+    const storeFreshness = claudeCredentialFreshness(parseClaudeCredentialBlob(fromStore));
+    const backupFreshness = claudeCredentialFreshness(parseClaudeCredentialBlob(backup));
+    if (parseClaudeCredentialBlob(backup) && backupFreshness > storeFreshness)
+        return backup;
+    return parseClaudeCredentialBlob(fromStore) ? fromStore : null;
+}
+function probeClaudeStore(accountId, now, persist = true) {
+    const blob = readEffectiveClaudeCredential(accountId);
+    if (!blob)
+        return null;
+    // A probe reads; it must not rewrite provenance (keep-alive relies on it).
+    const source = readHealthSidecar('claude-code', accountId)?.source ??
+        (isLiveClaudeAccount(accountId) ? 'live-sync' : 'migration');
+    return persist
+        ? writeClaudeHealthSidecar(accountId, blob, source, now)
+        : claudeHealthSidecarFromBlob(blob, source, now);
+}
+function probeCodexStore(accountId, now, persist = true) {
+    const profile = listSavedAccountProfiles('codex').find((p) => p.id === accountId);
+    const live = profile !== undefined && isLiveCodexAccount(profile);
+    const home = readCodexCredentialStore(live ? getSystemCodexHome() : getCodexProfileHome(accountId));
+    const backup = live ? null : readCodexBackup(accountId);
+    let raw = home.status === 'ok' ? home.snapshot.authRaw : null;
+    if (backup?.status === 'ok' &&
+        (!raw || compareCodexAuthFreshness(backup.snapshot.authRaw, raw) > 0))
+        raw = backup.snapshot.authRaw;
+    const source = readHealthSidecar('codex', accountId)?.source ?? (live ? 'live-sync' : 'migration');
+    const sidecar = codexHealthSidecarFromAuth(raw, source, now);
+    if (sidecar && persist)
+        writeSidecar('codex', accountId, sidecar);
+    return sidecar;
+}
+function hasStoredClaudeCredential(accountId) {
+    const home = getClaudeProfileHome(accountId);
+    return (fs.existsSync(path.join(home, '.credentials.json')) ||
+        fs.existsSync(path.join(getClaudeProfileDir(accountId), 'health.json')) ||
+        fs.existsSync(getClaudeCredentialBackupPath(accountId)) ||
+        (process.platform === 'darwin' && fs.existsSync(path.join(home, '.claude.json'))));
+}
+function hasStoredCodexCredential(accountId) {
+    const home = getCodexProfileHome(accountId);
+    return (fs.existsSync(getCodexBackupPath(accountId)) ||
+        fs.existsSync(getCodexBackupPath(accountId, true)) ||
+        fs.existsSync(path.join(home, 'auth.json')) ||
+        fs.existsSync(path.join(home, '.credentials.json')));
+}
+/**
+ * Health of one saved account. `probe: 'cache'` never spawns anything; a
+ * missing sidecar on a profile that has credentials is reported as `unknown`
+ * (never `expired`) until a store probe or the next sync rewrites it.
+ */
+export function getAccountHealth(provider, accountId, options = {}) {
+    const now = options.now ?? Date.now();
+    const probe = options.probe ?? 'cache';
+    const profile = listSavedAccountProfiles(provider).find((p) => p.id === accountId);
+    const isLive = provider === 'codex'
+        ? profile !== undefined && isLiveCodexAccount(profile)
+        : isLiveClaudeAccount(accountId);
+    let sidecar = null;
+    if (probe === 'store') {
+        sidecar =
+            provider === 'codex'
+                ? probeCodexStore(accountId, now, options.persist)
+                : probeClaudeStore(accountId, now, options.persist);
+    }
+    sidecar ??= readHealthSidecar(provider, accountId);
+    if (!sidecar && provider === 'codex') {
+        // Codex sidecars are cheap to derive from the plaintext file.
+        sidecar = probeCodexStore(accountId, now, options.persist);
+    }
+    if (!sidecar && probe === 'auto' && hasStoredClaudeCredential(accountId)) {
+        // First look at a profile that predates the health model: read its store
+        // once and record the sidecar so later reads are cache hits.
+        sidecar = probeClaudeStore(accountId, now, options.persist);
+    }
+    const base = { providerId: provider, accountId, checkedAt: now, isLive };
+    if (!sidecar) {
+        const stored = provider === 'codex'
+            ? hasStoredCodexCredential(accountId)
+            : hasStoredClaudeCredential(accountId);
+        return stored
+            ? { ...base, state: 'unknown', reason: 'Credential health has not been recorded yet.' }
+            : { ...base, state: 'missing', reason: 'No stored credentials; sign in again.' };
+    }
+    const verdict = provider === 'codex'
+        ? stateFromCodexSidecar(sidecar, now)
+        : stateFromClaudeSidecar(sidecar, now);
+    return {
+        ...base,
+        ...verdict,
+        accessExpiresAt: sidecar.accessExpiresAt,
+        refreshExpiresAt: sidecar.refreshExpiresAt,
+        refreshExpiryEstimated: sidecar.refreshExpiryEstimated,
+        lastRefreshAt: sidecar.lastRefreshAt,
+    };
+}
+/** Saved accounts with their health, in registry order, grouped by provider. */
+export function listAccountsWithHealth(provider, options = {}) {
+    const resolved = { probe: 'auto', ...options };
+    const providers = provider ? [provider] : ['claude-code', 'codex'];
+    const views = [];
+    for (const providerId of providers) {
+        const active = getActiveSavedAccount(providerId);
+        for (const profile of listSavedAccountProfiles(providerId)) {
+            views.push({
+                id: profile.id,
+                providerId,
+                label: profile.label,
+                email: profile.email ?? profile.metadata?.email,
+                planType: profile.metadata?.planType,
+                isActive: active?.id === profile.id,
+                health: getAccountHealth(providerId, profile.id, resolved),
+                source: profile.metadata?.origin === 'live-sync' ? 'learned' : 'registered',
+                addedAt: profile.addedAt,
+            });
+        }
+    }
+    return views;
+}
+/** Sidecar helper shared by the credential chokepoints: extracts the Claude credential shape. */
+export function describeClaudeCredential(blob) {
+    return parseClaudeCredentialBlob(blob);
+}

package/dist/esm/accountLaunch.js

@@ -0,0 +1,145 @@
+/**
+ * Environment for running a provider CLI against a saved profile without
+ * touching the live home: two accounts can run side by side, each with its
+ * own refresh-token chain.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { listSavedAccountProfiles } from './accountRegistry';
+import { getAccountHealth } from './accountHealth';
+import { CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV, getClaudeProfileHome, getLiveClaudeHome, isDefaultClaudeHome, } from './claudeProfiles';
+import { restoreClaudeProfileFromBackup } from './accounts';
+import { isSidekickCodexHome } from './codexCredentialStore';
+import { restoreCodexProfileFromBackup, isLiveCodexProfile } from './codexProfiles';
+import { forceFileCredentialStore, getCodexCredentialStoreMode, getCodexProfileHome, getSystemCodexHome, readFileOrNull, } from './codexPaths';
+import { atomicWriteFileSync, atomicWriteJsonSync } from './writers/atomic';
+function materializeClaudeHome(home) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const liveHome = getLiveClaudeHome();
+    const settingsTarget = path.join(home, 'settings.json');
+    if (!fs.existsSync(settingsTarget)) {
+        const settings = readFileOrNull(path.join(liveHome, 'settings.json'));
+        if (settings)
+            atomicWriteFileSync(settingsTarget, settings);
+    }
+    const configPath = path.join(home, '.claude.json');
+    let config = {};
+    try {
+        config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    }
+    catch {
+        /* fresh */
+    }
+    if (config.hasCompletedOnboarding !== true) {
+        atomicWriteJsonSync(configPath, { ...config, hasCompletedOnboarding: true });
+    }
+}
+function materializeCodexHome(home) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const configTarget = path.join(home, 'config.toml');
+    const current = readFileOrNull(configTarget);
+    const source = current ?? readFileOrNull(path.join(getSystemCodexHome(), 'config.toml')) ?? '';
+    const fileMode = forceFileCredentialStore(source);
+    if (fileMode !== current)
+        atomicWriteFileSync(configTarget, fileMode);
+}
+export function getAccountLaunchEnv(provider, accountId, options = {}) {
+    const profile = listSavedAccountProfiles(provider).find((p) => p.id === accountId);
+    const command = provider === 'codex' ? 'codex' : 'claude';
+    const home = provider === 'codex'
+        ? getCodexProfileHome(accountId)
+        : getClaudeProfileHome(profile?.providerAccountId ?? accountId);
+    const health = getAccountHealth(provider, accountId);
+    const warnings = [];
+    const base = {
+        provider,
+        accountId,
+        label: profile?.label,
+        email: profile?.email ?? profile?.metadata?.email,
+        home,
+        env: provider === 'codex' ? { CODEX_HOME: home } : { CLAUDE_CONFIG_DIR: home },
+        envUnset: provider === 'codex' ? [] : [CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV],
+        command,
+        health,
+        warnings,
+    };
+    if (!profile) {
+        return { ...base, error: `${provider} account ${accountId} not found.` };
+    }
+    if (provider === 'codex' && isSidekickCodexHome(getSystemCodexHome())) {
+        return {
+            ...base,
+            error: 'Unset CODEX_HOME before managing accounts; it names a Sidekick-owned home.',
+        };
+    }
+    if (provider === 'codex' && !['file', 'unknown'].includes(getCodexCredentialStoreMode())) {
+        return { ...base, error: 'Codex account launches require readable file-mode credentials.' };
+    }
+    if (provider === 'codex' && isLiveCodexProfile(profile)) {
+        const liveHome = getSystemCodexHome();
+        return {
+            ...base,
+            home: liveHome,
+            env: { CODEX_HOME: liveHome },
+            warnings: ['This account is the live login, so the session uses the normal Codex home.'],
+        };
+    }
+    if (provider === 'claude-code' && health.isLive) {
+        // The live account's only CLI-usable copy is the live store; a session in
+        // its profile home would be a second copy racing it over the refresh
+        // token. Point the session at the live home instead.
+        const liveHome = getLiveClaudeHome();
+        const customHome = !isDefaultClaudeHome();
+        return {
+            ...base,
+            home: liveHome,
+            env: customHome ? { CLAUDE_CONFIG_DIR: liveHome } : {},
+            envUnset: customHome
+                ? [CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV]
+                : ['CLAUDE_CONFIG_DIR', CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV],
+            warnings: ['This account is the live login, so the session uses the normal Claude home.'],
+        };
+    }
+    if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
+        return {
+            ...base,
+            error: `Stored credentials for "${profile.label ?? profile.email ?? accountId}" have ${health.state === 'missing' ? 'not been saved' : 'expired'}; sign in again before launching.`,
+        };
+    }
+    if (health.isLive) {
+        warnings.push('This account is also the live login. Two sessions refreshing the same login can invalidate each other; prefer switching instead.');
+    }
+    if (health.state === 'expiring' && health.reason)
+        warnings.push(health.reason);
+    if (provider === 'claude-code' && options.restoreBackup !== false) {
+        if (restoreClaudeProfileFromBackup(accountId) === 'restored') {
+            warnings.push("Restored this account's saved login into its profile home. If a session elsewhere still uses this login, close it first: two copies of one login invalidate each other.");
+        }
+    }
+    if (provider === 'codex') {
+        const restored = restoreCodexProfileFromBackup(accountId, {
+            restore: options.restoreBackup !== false,
+        });
+        if (restored === 'none')
+            return { ...base, error: 'No safe inactive Codex credential is available; sign in again.' };
+        if (restored === 'live')
+            return { ...base, home: getSystemCodexHome(), env: { CODEX_HOME: getSystemCodexHome() } };
+    }
+    if (provider === 'codex' &&
+        options.materialize === false &&
+        !['file', 'unknown'].includes(getCodexCredentialStoreMode(home))) {
+        return { ...base, error: 'The isolated Codex home must use file credential storage.' };
+    }
+    if (options.materialize !== false) {
+        try {
+            if (provider === 'codex')
+                materializeCodexHome(home);
+            else
+                materializeClaudeHome(home);
+        }
+        catch (err) {
+            warnings.push(`Could not prepare the isolated home: ${err}`);
+        }
+    }
+    return base;
+}

package/dist/esm/accountLease.js

@@ -0,0 +1,60 @@
+/**
+ * Keep-alive leases: while keep-alive runs a provider CLI inside a profile
+ * home, that home's credential may be mid-refresh. A switch to that account
+ * would copy the pre-refresh token into the live store just as the CLI kills
+ * it, so switches refuse a leased target. Leases are acquired under the
+ * provider's swap lock (the same lock a switch holds), expire on their own,
+ * and are ignored once their process is gone.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getClaudeProfileDir } from './claudeProfiles';
+import { getCodexProfileDir } from './codexPaths';
+import { atomicWriteJsonSync } from './writers/atomic';
+function leasePath(provider, accountId) {
+    const dir = provider === 'codex' ? getCodexProfileDir(accountId) : getClaudeProfileDir(accountId);
+    return path.join(dir, 'keepalive.lease');
+}
+function processAlive(pid) {
+    if (pid === process.pid)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+export function isAccountLeaseHeld(provider, accountId, now = Date.now()) {
+    try {
+        const lease = JSON.parse(fs.readFileSync(leasePath(provider, accountId), 'utf8'));
+        return (typeof lease.pid === 'number' &&
+            typeof lease.expiresAt === 'number' &&
+            lease.expiresAt > now &&
+            processAlive(lease.pid));
+    }
+    catch {
+        return false;
+    }
+}
+/** Take the lease; the caller holds the provider's swap lock. False when held elsewhere. */
+export function acquireAccountLease(provider, accountId, durationMs, now = Date.now()) {
+    if (isAccountLeaseHeld(provider, accountId, now))
+        return false;
+    const target = leasePath(provider, accountId);
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    atomicWriteJsonSync(target, {
+        pid: process.pid,
+        expiresAt: now + durationMs,
+    });
+    return true;
+}
+export function releaseAccountLease(provider, accountId) {
+    try {
+        fs.rmSync(leasePath(provider, accountId), { force: true });
+    }
+    catch {
+        /* expires on its own */
+    }
+}