sidekick-shared 0.27.6 → 0.28.0

package/dist/esm/accountManager.js

@@ -0,0 +1,606 @@
+import { spawn } from 'child_process';
+import { randomUUID } from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { getAccountsDir, listSavedAccountProfiles, readSavedAccountRegistry, upsertSavedAccountProfile, } from './accountRegistry';
+import { atomicWriteJsonSync as atomicWriteJson } from './writers/atomic';
+import { applyClaudeProfileToLiveHome, listAccounts, readActiveClaudeAccount, storeClaudeProfileCredentials, storeClaudeProfileIdentity, switchToAccount, switchToAccountAsync, } from './accounts';
+import { buildClaudeChildEnv, CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV, ensureClaudeProfileDirs, getClaudeProfileDir, getClaudeProfileHome, isClaudeProfileAuthenticated, readClaudeProfileIdentity, } from './claudeProfiles';
+import { deleteStoredCredentials, readClaudeCredentialStore } from './credentialIO';
+import { recordClaudeCredentialHome } from './claudeCredentialLedger';
+import { finalizeCodexAccount, finalizeCodexAccountAsync, discardCodexLogin, isCodexProfileAuthenticated, isCodexProfileAuthenticatedAsync, listCodexAccounts, prepareCodexAccount, readCodexAccountMetadata, readCodexAccountMetadataAsync, switchToCodexAccount, switchToCodexAccountAsync, } from './codexProfiles';
+import { getCodexLoginHome } from './codexPaths';
+import { readLastSwitch, switchFailure, } from './accountSwitch';
+function getPendingClaudeProfilePath(loginId) {
+    return path.join(getClaudeProfileDir(loginId), 'profile.json');
+}
+function readPendingClaudeProfile(loginId) {
+    try {
+        return JSON.parse(fs.readFileSync(getPendingClaudeProfilePath(loginId), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writePendingClaudeProfile(loginId, pending) {
+    ensureClaudeProfileDirs(loginId);
+    atomicWriteJson(getPendingClaudeProfilePath(loginId), pending);
+}
+function removePendingClaudeProfile(loginId) {
+    try {
+        fs.rmSync(getPendingClaudeProfilePath(loginId), { force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
+/**
+ * A fresh `CLAUDE_CONFIG_DIR` puts the CLI through first-run onboarding before
+ * the login prompt. Seeding the onboarding flag keeps the isolated login on the
+ * sign-in flow only; `oauthAccount` is written by the CLI itself.
+ */
+function seedClaudeLoginHome(home) {
+    const configPath = path.join(home, '.claude.json');
+    if (fs.existsSync(configPath))
+        return;
+    try {
+        atomicWriteJson(configPath, { hasCompletedOnboarding: true });
+    }
+    catch {
+        /* the CLI creates the file itself */
+    }
+}
+function readClaudeOauthAccount(home) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(home, '.claude.json'), 'utf8'));
+        return raw?.oauthAccount ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function copyClaudeProfileToCanonicalHome(sourceHome, accountUuid, credentials, oauthAccount) {
+    const canonicalHome = getClaudeProfileHome(accountUuid);
+    fs.mkdirSync(canonicalHome, { recursive: true, mode: 0o700 });
+    if (path.resolve(sourceHome) !== path.resolve(canonicalHome)) {
+        try {
+            // Credentials go only through the chokepoint below: when this account is
+            // the live one its profile home must not receive a CLI-usable copy.
+            fs.cpSync(sourceHome, canonicalHome, {
+                recursive: true,
+                force: true,
+                filter: (src) => {
+                    const base = path.basename(src);
+                    return base !== '.credentials.json' && !base.startsWith('.oauth_refresh.lock');
+                },
+            });
+        }
+        catch {
+            // The credential and identity files are re-written below when possible.
+        }
+    }
+    storeClaudeProfileIdentity(accountUuid, oauthAccount);
+    storeClaudeProfileCredentials(accountUuid, credentials, 'login');
+}
+function parseClaudeLoginArgs(raw) {
+    const trimmed = raw?.trim();
+    return trimmed ? trimmed.split(/\s+/) : null;
+}
+/**
+ * `claude auth login` signs in without the interactive first-run flow the bare
+ * `claude /login` form triggers in a fresh config directory. Override with
+ * `SIDEKICK_CLAUDE_LOGIN_ARGS` (space separated) for older CLIs.
+ */
+export function resolveClaudeLoginCommand(opts = {}) {
+    if (opts.loginCommand)
+        return opts.loginCommand;
+    return {
+        command: 'claude',
+        args: parseClaudeLoginArgs(process.env.SIDEKICK_CLAUDE_LOGIN_ARGS) ?? ['auth', 'login'],
+    };
+}
+export function beginAccountLogin(provider, label, opts = {}) {
+    if (provider === 'codex') {
+        const existing = opts.existingAccountId
+            ? listCodexAccounts().find((account) => account.id === opts.existingAccountId)
+            : undefined;
+        if (opts.existingAccountId && !existing) {
+            return { success: false, error: `Codex account ${opts.existingAccountId} not found.` };
+        }
+        // A re-login uses a throwaway label: finalize folds the fresh credentials
+        // into the existing profile by identity and keeps its label.
+        const effectiveLabel = existing
+            ? `${existing.label ?? existing.email ?? 'codex'} (re-login ${randomUUID().slice(0, 8)})`
+            : label.trim() || `Codex ${listCodexAccounts().length + 1}`;
+        const prepared = prepareCodexAccount(effectiveLabel, { importCurrent: false });
+        if (!prepared.success || !prepared.profileId || !prepared.codexHome) {
+            return { success: false, error: prepared.error ?? 'Could not prepare Codex account login.' };
+        }
+        if (prepared.needsLogin === false) {
+            return {
+                success: true,
+                loginId: prepared.profileId,
+                alreadyComplete: true,
+                configDir: prepared.codexHome,
+                existingAccountId: existing?.id,
+            };
+        }
+        const loginCommand = opts.loginCommand ?? { command: 'codex', args: ['login'] };
+        return {
+            success: true,
+            loginId: prepared.profileId,
+            command: loginCommand.command,
+            args: loginCommand.args,
+            env: { CODEX_HOME: prepared.codexHome },
+            configDir: prepared.codexHome,
+            existingAccountId: existing?.id,
+        };
+    }
+    const existing = opts.existingAccountId
+        ? listSavedAccountProfiles('claude-code').find((account) => account.id === opts.existingAccountId)
+        : undefined;
+    if (opts.existingAccountId && !existing) {
+        return { success: false, error: `Claude account ${opts.existingAccountId} not found.` };
+    }
+    const loginId = randomUUID();
+    const home = getClaudeProfileHome(loginId);
+    writePendingClaudeProfile(loginId, {
+        label: existing?.label ?? label.trim(),
+        addedAt: existing?.addedAt ?? new Date().toISOString(),
+        existingAccountId: existing?.id,
+    });
+    seedClaudeLoginHome(home);
+    // Claude Code creates this home's Keychain item itself; record the home
+    // first so the item is provably Sidekick's even if everything else fails.
+    recordClaudeCredentialHome(home, 'login');
+    const loginCommand = resolveClaudeLoginCommand(opts);
+    return {
+        success: true,
+        loginId,
+        command: loginCommand.command,
+        args: loginCommand.args,
+        env: { CLAUDE_CONFIG_DIR: home },
+        envUnset: [CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV],
+        configDir: home,
+        existingAccountId: existing?.id,
+    };
+}
+function getClaudeAccountLoginStatus(loginId) {
+    const home = getClaudeProfileHome(loginId);
+    const identity = readClaudeProfileIdentity(home);
+    return isClaudeProfileAuthenticated(home)
+        ? { state: 'authenticated', email: identity?.email }
+        : { state: 'pending' };
+}
+export function getAccountLoginStatus(provider, loginId) {
+    if (provider === 'codex') {
+        const codexHome = getCodexLoginHome(loginId);
+        if (!isCodexProfileAuthenticated(codexHome)) {
+            return { state: 'pending' };
+        }
+        const metadata = readCodexAccountMetadata(codexHome);
+        return {
+            state: 'authenticated',
+            email: metadata.email,
+        };
+    }
+    return getClaudeAccountLoginStatus(loginId);
+}
+/**
+ * {@link getAccountLoginStatus} without blocking the event loop on the codex
+ * CLI probe. The sync variant blocks up to 4s per call while a codex login is
+ * pending — ruinous for callers that poll it on an interval.
+ */
+export async function getAccountLoginStatusAsync(provider, loginId) {
+    if (provider === 'codex') {
+        const codexHome = getCodexLoginHome(loginId);
+        if (!(await isCodexProfileAuthenticatedAsync(codexHome))) {
+            return { state: 'pending' };
+        }
+        const metadata = await readCodexAccountMetadataAsync(codexHome);
+        return {
+            state: 'authenticated',
+            email: metadata.email,
+        };
+    }
+    return getClaudeAccountLoginStatus(loginId);
+}
+export function finalizeAccountLogin(provider, loginId, opts = {}) {
+    if (provider === 'codex') {
+        return finalizeCodexAccount(loginId, opts);
+    }
+    return finalizeClaudeAccountLogin(loginId, opts);
+}
+/** {@link finalizeAccountLogin} without blocking the event loop on CLI probes. */
+export async function finalizeAccountLoginAsync(provider, loginId, opts = {}) {
+    if (provider === 'codex') {
+        return finalizeCodexAccountAsync(loginId, opts);
+    }
+    return finalizeClaudeAccountLogin(loginId, opts);
+}
+function finalizeClaudeAccountLogin(loginId, opts = {}) {
+    const home = getClaudeProfileHome(loginId);
+    const identity = readClaudeProfileIdentity(home);
+    if (!identity) {
+        return { success: false, error: 'Claude profile is not authenticated yet.' };
+    }
+    const read = readClaudeCredentialStore(home);
+    if (read.status === 'error') {
+        // Transient (locked Keychain, timeout): keep the login home for a retry.
+        return { success: false, error: 'Could not read the new Claude login yet; try again.' };
+    }
+    const warnings = [];
+    try {
+        if (read.status !== 'ok') {
+            return {
+                success: false,
+                error: 'The sign-in finished without a readable credential; sign in again.',
+            };
+        }
+        const oauthAccount = readClaudeOauthAccount(home);
+        if (!oauthAccount) {
+            return { success: false, error: 'Could not read Claude profile config.' };
+        }
+        const pending = readPendingClaudeProfile(loginId);
+        const existing = listSavedAccountProfiles('claude-code').find((account) => (account.providerAccountId ?? account.id) === identity.uuid);
+        // The chokepoint writes the private backup first, so a failure below
+        // still leaves the new login saved.
+        copyClaudeProfileToCanonicalHome(home, identity.uuid, read.blob, oauthAccount);
+        if (pending?.existingAccountId && pending.existingAccountId !== identity.uuid) {
+            warnings.push(`You signed in as ${identity.email}, which is a different account from the one you chose to re-authenticate; it was saved separately.`);
+        }
+        upsertSavedAccountProfile({
+            id: existing?.id ?? identity.uuid,
+            providerId: 'claude-code',
+            providerAccountId: identity.uuid,
+            email: identity.email,
+            label: existing?.label ?? (pending?.label || identity.email),
+            addedAt: existing?.addedAt ?? pending?.addedAt ?? new Date().toISOString(),
+            metadata: {
+                ...existing?.metadata,
+                email: identity.email,
+                origin: 'login',
+            },
+        });
+    }
+    catch (err) {
+        return { success: false, error: `Could not save the new Claude login: ${err}` };
+    }
+    finally {
+        // Every exit after authentication: the temporary home's Keychain item
+        // holds a live refresh token that nothing will ever reference again.
+        removePendingClaudeProfile(loginId);
+        if (loginId !== identity.uuid) {
+            removePendingClaudeProfile(identity.uuid);
+            discardClaudeLoginHome(loginId);
+        }
+    }
+    if (opts.activate === false) {
+        return { success: true, warning: warnings.length ? warnings.join(' ') : undefined };
+    }
+    if (readActiveClaudeAccount()?.uuid === identity.uuid) {
+        // Re-login of the account that is already live: the new token replaces
+        // the live one (which may be the dead credential that prompted the login).
+        const applied = applyClaudeProfileToLiveHome(identity.uuid);
+        if (!applied.success)
+            return applied;
+        if (applied.warning)
+            warnings.push(applied.warning);
+    }
+    const switched = switchToAccount(identity.uuid);
+    return warnings.length
+        ? { ...switched, warning: [switched.warning, ...warnings].filter(Boolean).join(' ') }
+        : switched;
+}
+function emitStatus(opts, status) {
+    opts.onStatus?.(status);
+    return status;
+}
+function waitForNextPoll(ms, signal) {
+    if (ms <= 0)
+        return Promise.resolve(true);
+    if (signal?.aborted)
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            cleanup();
+            resolve(true);
+        }, ms);
+        const onAbort = () => {
+            cleanup();
+            resolve(false);
+        };
+        const cleanup = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/** Most recent modification inside an isolated login home (the CLI writes as the user progresses). */
+function latestHomeActivity(home) {
+    if (!home)
+        return 0;
+    let latest = 0;
+    const candidates = [
+        home,
+        ...['.claude.json', '.credentials.json', 'auth.json', 'config.toml'].map((f) => path.join(home, f)),
+    ];
+    for (const candidate of candidates) {
+        try {
+            latest = Math.max(latest, fs.statSync(candidate).mtimeMs);
+        }
+        catch {
+            /* absent */
+        }
+    }
+    return latest;
+}
+/** Delete a temporary Claude login home: its Keychain item first, then the directory. */
+function discardClaudeLoginHome(loginId) {
+    const dir = getClaudeProfileDir(loginId);
+    if (!path.resolve(dir).startsWith(path.resolve(getAccountsDir()) + path.sep))
+        return;
+    deleteStoredCredentials(getClaudeProfileHome(loginId));
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        /* the temporary login home is disposable */
+    }
+}
+function discardPendingLogin(provider, loginId) {
+    try {
+        if (provider === 'claude-code') {
+            discardClaudeLoginHome(loginId);
+            return;
+        }
+        discardCodexLogin(loginId);
+    }
+    catch {
+        /* best effort */
+    }
+}
+/**
+ * Abandon a login started with {@link beginAccountLogin} (cancelled, timed
+ * out, or failed): removes the temporary home and, for Claude, its Keychain
+ * item. Refuses ids that belong to a saved profile. Returns true when
+ * something was discarded.
+ */
+export function discardAccountLogin(provider, loginId) {
+    const registered = provider === 'codex'
+        ? listCodexAccounts().some((account) => account.id === loginId)
+        : listSavedAccountProfiles('claude-code').some((account) => account.id === loginId || account.providerAccountId === loginId);
+    if (registered)
+        return false;
+    if (provider === 'claude-code' && !readPendingClaudeProfile(loginId)) {
+        // Not a pending login; still drop a stray item for a home we created.
+        deleteStoredCredentials(getClaudeProfileHome(loginId));
+        return false;
+    }
+    discardPendingLogin(provider, loginId);
+    return true;
+}
+class AccountLoginWriterActiveError extends Error {
+}
+export async function spawnAccountLogin(provider, label, opts = {}) {
+    let loginId;
+    let result;
+    let writerActive = false;
+    try {
+        result = await runAccountLogin(provider, label, opts, (id) => {
+            loginId = id;
+        });
+        return result;
+    }
+    catch (error) {
+        if (error instanceof AccountLoginWriterActiveError) {
+            writerActive = true;
+            return {
+                success: false,
+                error: 'The Codex login process could not be stopped. Its temporary home was preserved; close that process before retrying.',
+            };
+        }
+        throw error;
+    }
+    finally {
+        // Every exit that did not end in a saved login (spawn error, early exit,
+        // abort, timeout, a throw) removes the temporary home and its Keychain item.
+        if (!writerActive && loginId && (provider === 'codex' || !result?.success)) {
+            discardPendingLogin(provider, loginId);
+        }
+    }
+}
+async function runAccountLogin(provider, label, opts, onBegin) {
+    if (opts.signal?.aborted) {
+        return { success: false, error: 'Account login aborted.' };
+    }
+    const begin = beginAccountLogin(provider, label, {
+        loginCommand: opts.loginCommand,
+        existingAccountId: opts.existingAccountId,
+    });
+    if (!begin.success)
+        return { success: false, error: begin.error };
+    onBegin(begin.loginId);
+    if (begin.alreadyComplete) {
+        return finalizeAccountLoginAsync(provider, begin.loginId, { activate: opts.activate ?? true });
+    }
+    if (!begin.command) {
+        return { success: false, error: 'Account login command was not prepared.' };
+    }
+    let childExited = false;
+    let childExitCode = null;
+    const childState = {};
+    const inactivityMs = opts.timeoutMs ?? 180_000;
+    const maxMs = opts.maxTimeoutMs ?? 900_000;
+    const startedAt = Date.now();
+    let lastActivity = startedAt;
+    let lastSeenMtime = latestHomeActivity(begin.configDir);
+    const env = provider === 'codex'
+        ? { ...process.env, ...(begin.env ?? {}) }
+        : buildClaudeChildEnv(begin.configDir ?? '', process.env);
+    for (const name of begin.envUnset ?? [])
+        delete env[name];
+    let child;
+    try {
+        child = spawn(begin.command, begin.args ?? [], {
+            env,
+            stdio: opts.stdio ?? 'inherit',
+        });
+    }
+    catch (err) {
+        discardPendingLogin(provider, begin.loginId);
+        return { success: false, error: `Could not spawn account login: ${err}` };
+    }
+    child.on('exit', (code) => {
+        childExited = true;
+        childExitCode = code;
+    });
+    child.on('error', (error) => {
+        childExited = true;
+        childState.spawnError = error;
+    });
+    const stopCodexChild = async () => {
+        if (provider !== 'codex' || childExited)
+            return;
+        const waitForExit = (ms) => new Promise((resolve) => {
+            if (childExited) {
+                resolve();
+                return;
+            }
+            const done = () => {
+                clearTimeout(timer);
+                child.off('exit', done);
+                child.off('error', done);
+                resolve();
+            };
+            const timer = setTimeout(done, ms);
+            child.once('exit', done);
+            child.once('error', done);
+        });
+        await waitForExit(100);
+        try {
+            if (!childExited) {
+                child.kill();
+                await waitForExit(1000);
+            }
+            if (!childExited) {
+                child.kill('SIGKILL');
+                await waitForExit(1000);
+            }
+        }
+        catch {
+            throw new AccountLoginWriterActiveError();
+        }
+        if (!childExited)
+            throw new AccountLoginWriterActiveError();
+    };
+    const abort = async () => {
+        if (provider === 'codex')
+            await stopCodexChild();
+        else
+            child.kill();
+        discardPendingLogin(provider, begin.loginId);
+        emitStatus(opts, { state: 'failed', error: 'Account login aborted.' });
+        return { success: false, error: 'Account login aborted.' };
+    };
+    try {
+        while (true) {
+            if (opts.signal?.aborted)
+                return await abort();
+            const status = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
+            if (status.state === 'authenticated') {
+                await stopCodexChild();
+                return await finalizeAccountLoginAsync(provider, begin.loginId, {
+                    activate: opts.activate ?? true,
+                });
+            }
+            if (childExited) {
+                if (childState.spawnError) {
+                    const error = `Could not spawn account login: ${childState.spawnError.message}`;
+                    discardPendingLogin(provider, begin.loginId);
+                    emitStatus(opts, { state: 'failed', error });
+                    return { success: false, error };
+                }
+                const finalStatus = emitStatus(opts, await getAccountLoginStatusAsync(provider, begin.loginId));
+                if (finalStatus.state === 'authenticated') {
+                    await stopCodexChild();
+                    return await finalizeAccountLoginAsync(provider, begin.loginId, {
+                        activate: opts.activate ?? true,
+                    });
+                }
+                discardPendingLogin(provider, begin.loginId);
+                emitStatus(opts, {
+                    state: 'failed',
+                    error: `Account login exited before authentication completed${childExitCode === null ? '.' : ` (exit ${childExitCode}).`}`,
+                });
+                return { success: false, error: 'Account login did not complete.' };
+            }
+            const now = Date.now();
+            const mtime = latestHomeActivity(begin.configDir);
+            if (mtime > lastSeenMtime) {
+                lastSeenMtime = mtime;
+                lastActivity = now;
+            }
+            const remainingMs = Math.min(inactivityMs - (now - lastActivity), maxMs - (now - startedAt));
+            if (remainingMs <= 0) {
+                if (provider === 'codex')
+                    await stopCodexChild();
+                else
+                    child.kill();
+                discardPendingLogin(provider, begin.loginId);
+                emitStatus(opts, { state: 'failed', error: 'Account login timed out.' });
+                return { success: false, error: 'Account login timed out.' };
+            }
+            const shouldContinue = await waitForNextPoll(Math.min(2_000, remainingMs), opts.signal);
+            if (!shouldContinue)
+                return await abort();
+        }
+    }
+    finally {
+        await stopCodexChild();
+    }
+}
+export function switchAccount(provider, id, options = {}) {
+    return provider === 'codex' ? switchToCodexAccount(id, options) : switchToAccount(id, options);
+}
+/**
+ * {@link switchAccount} without blocking the event loop on CLI/process probes.
+ * The Claude path still performs bounded synchronous keychain reads on macOS.
+ */
+export async function switchAccountAsync(provider, id, options = {}) {
+    return provider === 'codex'
+        ? switchToCodexAccountAsync(id, options)
+        : switchToAccountAsync(id, options);
+}
+export function getLastSwitch(provider) {
+    return readLastSwitch(provider);
+}
+/**
+ * Switch back to the account that was live before the last recorded switch.
+ * With `token`, the record must match (a stale Undo button never reverts a
+ * newer switch).
+ */
+export async function undoLastSwitch(provider, token) {
+    const record = readLastSwitch(provider);
+    if (!record) {
+        return switchFailure(provider, '', 'There is no account switch to undo.');
+    }
+    if (token && token !== record.token) {
+        return switchFailure(provider, record.from ?? '', 'A newer account switch has happened since; nothing was undone.');
+    }
+    if (!record.from) {
+        return switchFailure(provider, '', 'The previous state had no saved account to return to.');
+    }
+    return switchAccountAsync(provider, record.from);
+}
+export function listAllAccounts() {
+    return {
+        claude: listAccounts(),
+        codex: listCodexAccounts(),
+        activeByProvider: readSavedAccountRegistry()?.activeByProvider ?? {
+            'claude-code': null,
+            codex: null,
+        },
+    };
+}