sidekick-shared 0.27.6 → 0.28.0

package/dist/esm/accountRegistry.js

@@ -0,0 +1,214 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { getConfigDir } from './paths';
+import { atomicWriteJsonSync, withFileLockSync } from './writers/atomic';
+import { _emitAccountsChanged } from './accountChangeSignal';
+export { ACCOUNT_PROVIDER_IDS } from './providerIds';
+export function getAccountsDir() {
+    return path.join(getConfigDir(), 'accounts');
+}
+function getRegistryPath() {
+    return path.join(getAccountsDir(), 'accounts.json');
+}
+function getRegistryLockPath() {
+    return getRegistryPath() + '.lock';
+}
+function ensureAccountsDir() {
+    fs.mkdirSync(getAccountsDir(), { recursive: true, mode: 0o700 });
+}
+function writeRegistryUnlocked(registry, options = {}) {
+    atomicWriteJsonSync(getRegistryPath(), normalizeRegistry(registry));
+    if (!options.silent)
+        _emitAccountsChanged('local');
+}
+/**
+ * Run `operation` while holding the registry lock. For callers that need a
+ * read-modify-write across several steps (the legacy Claude facade's
+ * add/remove); inside it use the `*Unlocked` writers, never the locking ones:
+ * the lock is not re-entrant.
+ */
+export function withSavedAccountRegistryLock(operation) {
+    ensureAccountsDir();
+    return withFileLockSync(getRegistryLockPath(), operation);
+}
+/**
+ * Serializes registry read-modify-write cycles across processes. Without the
+ * lock, two concurrent mutators (CLI, editor extension, external consumers)
+ * read the same base state and the second write silently drops the first
+ * mutation. Lock ordering: callers that also hold a provider auth-swap lock
+ * take that lock first and this one inside it, never the reverse.
+ */
+function mutateSavedAccountRegistry(mutator, options = {}) {
+    return withSavedAccountRegistryLock(() => mutateSavedAccountRegistryUnlocked(mutator, options));
+}
+function mutateSavedAccountRegistryUnlocked(mutator, options = {}) {
+    const next = mutator(readSavedAccountRegistry() ?? createEmptyRegistry());
+    writeRegistryUnlocked(next, options);
+    return next;
+}
+function createEmptyRegistry() {
+    return {
+        version: 2,
+        activeByProvider: {
+            'claude-code': null,
+            codex: null,
+        },
+        accounts: [],
+    };
+}
+function normalizeRegistry(registry) {
+    const normalized = createEmptyRegistry();
+    normalized.activeByProvider['claude-code'] = registry.activeByProvider?.['claude-code'] ?? null;
+    normalized.activeByProvider.codex = registry.activeByProvider?.codex ?? null;
+    normalized.accounts = Array.isArray(registry.accounts)
+        ? registry.accounts
+            .filter((account) => !!account &&
+            (account.providerId === 'claude-code' || account.providerId === 'codex') &&
+            typeof account.id === 'string' &&
+            typeof account.addedAt === 'string')
+            .map((account) => ({
+            ...account,
+            label: account.label || undefined,
+            email: account.email || undefined,
+            providerAccountId: account.providerAccountId || undefined,
+            metadata: account.metadata
+                ? {
+                    email: account.metadata.email || undefined,
+                    workspaceId: account.metadata.workspaceId || undefined,
+                    planType: account.metadata.planType || undefined,
+                    authMode: account.metadata.authMode || undefined,
+                    origin: account.metadata.origin || undefined,
+                }
+                : undefined,
+        }))
+        : [];
+    return normalized;
+}
+function migrateLegacyRegistry(legacy) {
+    return {
+        version: 2,
+        activeByProvider: {
+            'claude-code': legacy.activeAccountUuid,
+            codex: null,
+        },
+        accounts: legacy.accounts.map((account) => ({
+            id: account.uuid,
+            providerId: 'claude-code',
+            providerAccountId: account.uuid,
+            email: account.email,
+            label: account.label,
+            addedAt: account.addedAt,
+            metadata: {
+                email: account.email,
+            },
+        })),
+    };
+}
+export function readSavedAccountRegistry() {
+    try {
+        const content = fs.readFileSync(getRegistryPath(), 'utf8');
+        const parsed = JSON.parse(content);
+        if (parsed?.version === 2) {
+            return normalizeRegistry(parsed);
+        }
+        if (parsed?.version === 1 && Array.isArray(parsed.accounts)) {
+            return migrateLegacyRegistry(parsed);
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSavedAccountRegistry(registry) {
+    ensureAccountsDir();
+    withFileLockSync(getRegistryLockPath(), () => writeRegistryUnlocked(registry));
+}
+export function listSavedAccountProfiles(providerId) {
+    const registry = readSavedAccountRegistry();
+    if (!registry)
+        return [];
+    return providerId
+        ? registry.accounts.filter((account) => account.providerId === providerId)
+        : registry.accounts;
+}
+export function getActiveSavedAccount(providerId) {
+    const registry = readSavedAccountRegistry();
+    if (!registry)
+        return null;
+    const activeId = registry.activeByProvider[providerId];
+    if (!activeId)
+        return null;
+    return (registry.accounts.find((account) => account.providerId === providerId && account.id === activeId) ?? null);
+}
+export function upsertSavedAccountProfile(profile) {
+    return mutateSavedAccountRegistry(upsertProfile(profile));
+}
+export function setActiveSavedAccount(providerId, accountId, options = {}) {
+    return mutateSavedAccountRegistry(setActive(providerId, accountId), options);
+}
+function setActive(providerId, accountId) {
+    return (registry) => {
+        registry.activeByProvider[providerId] = accountId;
+        return registry;
+    };
+}
+function upsertProfile(profile) {
+    return (registry) => {
+        const index = registry.accounts.findIndex((account) => account.providerId === profile.providerId && account.id === profile.id);
+        if (index >= 0) {
+            registry.accounts[index] = profile;
+        }
+        else {
+            registry.accounts.push(profile);
+        }
+        return registry;
+    };
+}
+/** {@link upsertSavedAccountProfile} for callers already inside {@link withSavedAccountRegistryLock}. */
+export function upsertSavedAccountProfileUnlocked(profile) {
+    return mutateSavedAccountRegistryUnlocked(upsertProfile(profile));
+}
+/** {@link setActiveSavedAccount} for callers already inside {@link withSavedAccountRegistryLock}. */
+export function setActiveSavedAccountUnlocked(providerId, accountId, options = {}) {
+    return mutateSavedAccountRegistryUnlocked(setActive(providerId, accountId), options);
+}
+function replaceProfiles(providerId, accounts, activeId) {
+    return (registry) => {
+        registry.accounts = registry.accounts
+            .filter((account) => account.providerId !== providerId)
+            .concat(accounts);
+        registry.activeByProvider[providerId] = activeId;
+        return registry;
+    };
+}
+export function replaceSavedAccountProfiles(providerId, accounts, activeId) {
+    return mutateSavedAccountRegistry(replaceProfiles(providerId, accounts, activeId));
+}
+/**
+ * Same as {@link replaceSavedAccountProfiles} without taking the registry
+ * lock: for callers already inside {@link withSavedAccountRegistryLock}.
+ */
+export function replaceSavedAccountProfilesUnlocked(providerId, accounts, activeId) {
+    return mutateSavedAccountRegistryUnlocked(replaceProfiles(providerId, accounts, activeId));
+}
+export function removeSavedAccountProfile(providerId, accountId) {
+    ensureAccountsDir();
+    return withFileLockSync(getRegistryLockPath(), () => removeSavedAccountProfileUnlocked(providerId, accountId));
+}
+/** {@link removeSavedAccountProfile} for callers already inside {@link withSavedAccountRegistryLock}. */
+export function removeSavedAccountProfileUnlocked(providerId, accountId) {
+    const registry = readSavedAccountRegistry();
+    if (!registry)
+        return null;
+    const index = registry.accounts.findIndex((account) => account.providerId === providerId && account.id === accountId);
+    if (index === -1)
+        return null;
+    const [removed] = registry.accounts.splice(index, 1);
+    if (registry.activeByProvider[providerId] === accountId) {
+        registry.activeByProvider[providerId] =
+            registry.accounts.find((account) => account.providerId === providerId)?.id ?? null;
+    }
+    writeRegistryUnlocked(registry);
+    return removed;
+}

package/dist/esm/accountStatus.js

@@ -0,0 +1,51 @@
+import { resolveActiveClaudeAccount } from './accounts';
+import { resolveActiveCodexAccount } from './codexProfiles';
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Reads active Claude Code and Codex account status in one filesystem pass.
+ *
+ * If reading either provider throws, the result still has provider-shaped
+ * fields so startup flows can render a consistent "not configured" state.
+ */
+export function getActiveAccountStatus(error, options = {}) {
+    try {
+        const claudeAccount = resolveActiveClaudeAccount(options);
+        const codexAccount = resolveActiveCodexAccount(options);
+        const claude = claudeAccount.source !== 'none'
+            ? {
+                present: true,
+                ...(claudeAccount.registryAccountId
+                    ? { accountId: claudeAccount.registryAccountId }
+                    : {}),
+                email: claudeAccount.email,
+                label: claudeAccount.label ?? claudeAccount.email,
+            }
+            : { present: false };
+        const codex = codexAccount.source !== 'none'
+            ? {
+                present: true,
+                ...(codexAccount.registryAccountId
+                    ? { accountId: codexAccount.registryAccountId }
+                    : {}),
+                email: codexAccount.email,
+                label: codexAccount.label ?? codexAccount.email ?? codexAccount.providerAccountId,
+            }
+            : { present: false };
+        return {
+            ok: claude.present || codex.present,
+            claude,
+            codex,
+            error,
+        };
+    }
+    catch (caught) {
+        return {
+            ok: false,
+            claude: { present: false },
+            codex: { present: false },
+            error: error ?? errorMessage(caught),
+        };
+    }
+}

package/dist/esm/accountSwitch.js

@@ -0,0 +1,74 @@
+/**
+ * Shared shape of a verified account switch plus the undo record. The
+ * provider-specific switch cores live in accounts.ts (Claude) and
+ * codexProfiles.ts (Codex); accountManager.ts exposes the provider-agnostic
+ * `switchAccount*` and `undoLastSwitch` entry points.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { randomUUID } from 'crypto';
+import { getAccountsDir } from './accountRegistry';
+import { atomicWriteJsonSync } from './writers/atomic';
+function providerDirName(provider) {
+    return provider === 'codex' ? 'codex' : 'claude';
+}
+export function getLastSwitchPath(provider) {
+    return path.join(getAccountsDir(), providerDirName(provider), 'last-switch.json');
+}
+export function readLastSwitch(provider) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(getLastSwitchPath(provider), 'utf8'));
+        return parsed && typeof parsed.token === 'string' && typeof parsed.to === 'string'
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeLastSwitch(provider, from, to) {
+    const record = {
+        token: randomUUID(),
+        provider,
+        from,
+        to,
+        at: new Date().toISOString(),
+    };
+    atomicWriteJsonSync(getLastSwitchPath(provider), record);
+    return record;
+}
+export function clearLastSwitch(provider) {
+    try {
+        fs.rmSync(getLastSwitchPath(provider), { force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
+export function switchFailure(provider, accountId, error, extra = {}) {
+    return {
+        success: false,
+        error,
+        provider,
+        accountId,
+        previousAccountId: null,
+        verified: false,
+        verification: 'none',
+        warnings: [],
+        hints: [],
+        runningConsumers: [],
+        ...extra,
+    };
+}
+/** Fold per-consumer warnings into a result; keeps `warning` (legacy) in sync. */
+export function finishSwitchResult(result) {
+    const warnings = [
+        ...result.warnings,
+        ...result.runningConsumers.map((consumer) => consumer.reachability),
+    ];
+    return {
+        ...result,
+        warnings,
+        warning: warnings.length ? warnings.join(' ') : undefined,
+    };
+}

package/dist/esm/accountSync.js

@@ -0,0 +1,156 @@
+/**
+ * Continuous reconciliation between the live provider logins and sidekick's
+ * saved profiles. One engine replaces the old bootstrap/reconcile/backup
+ * paths: it registers logins sidekick has never seen, folds rotated tokens
+ * back into their profile, merges duplicate Codex seats, and re-points the
+ * active pointer at whatever is really logged in.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { cleanupAbandonedClaudeLogins, syncClaudeLiveStateUnlocked, withClaudeAuthSwapLock, } from './accounts';
+import { getLiveClaudeHome, readLiveClaudeIdentity } from './claudeProfiles';
+import { cleanupAbandonedCodexLogins, cleanupAbandonedCodexLoginsAsync, hasPendingCodexRepair, syncCodexLiveStateUnlocked, withCodexAuthSwapLock, } from './codexProfiles';
+import { getSystemCodexHome } from './codexPaths';
+import { inspectRunningAccountConsumers, inspectRunningAccountConsumersSync, } from './processDetection';
+import { emptyProviderSyncReport, } from './accountSyncTypes';
+const DEFAULT_KEYCHAIN_FOLD_INTERVAL_MS = 10 * 60 * 1000;
+const fingerprints = {
+    'claude-code': {},
+    codex: {},
+};
+let syncInProgress = false;
+function statStamp(filePath) {
+    try {
+        const stat = fs.statSync(filePath);
+        return `${stat.mtimeMs}:${stat.size}`;
+    }
+    catch {
+        return 'absent';
+    }
+}
+function claudeFingerprint() {
+    const home = getLiveClaudeHome();
+    const identity = readLiveClaudeIdentity();
+    // Fingerprint the identity, not the config file: Claude Code rewrites
+    // `~/.claude.json` on nearly every prompt, which would defeat the
+    // `onlyIfChanged` short-circuit and the macOS keychain fold interval.
+    return [
+        identity?.uuid ?? 'none',
+        identity?.email ?? '',
+        statStamp(path.join(home, '.credentials.json')),
+    ].join('|');
+}
+function codexFingerprint() {
+    const home = getSystemCodexHome();
+    return [
+        statStamp(path.join(home, 'auth.json')),
+        statStamp(path.join(home, '.credentials.json')),
+    ].join('|');
+}
+function sourceForReason(reason) {
+    return reason === 'pre-switch' ? 'switch' : 'live-sync';
+}
+function shouldSync(provider, fingerprint, options) {
+    if (!options.onlyIfChanged || (provider === 'codex' && hasPendingCodexRepair()))
+        return true;
+    const state = fingerprints[provider];
+    if (state.fingerprint !== fingerprint)
+        return true;
+    if (provider === 'claude-code' && process.platform === 'darwin') {
+        // The Keychain item can change without touching any watched file.
+        return (state.lastFoldAt ?? 0) + options.keychainFoldIntervalMs <= options.now;
+    }
+    return false;
+}
+/** Sync one provider under its swap lock; never throws. */
+function syncProvider(provider, reason, options, scan) {
+    const fingerprint = provider === 'codex' ? codexFingerprint() : claudeFingerprint();
+    if (!shouldSync(provider, fingerprint, options)) {
+        return { ...emptyProviderSyncReport(), skipped: 'unchanged' };
+    }
+    const source = sourceForReason(reason);
+    let report;
+    try {
+        if (provider === 'codex')
+            scan ??= inspectRunningAccountConsumersSync('codex');
+        report =
+            provider === 'codex'
+                ? withCodexAuthSwapLock(() => syncCodexLiveStateUnlocked(source, { scan }))
+                : withClaudeAuthSwapLock(() => syncClaudeLiveStateUnlocked(source));
+    }
+    catch (err) {
+        return { warnings: [`Could not acquire the ${provider} account-switch lock: ${err}`] };
+    }
+    fingerprints[provider] = {
+        // Re-fingerprint after the sync: folding rewrites nothing in the live home,
+        // but registering touches accounts.json, which is also watched.
+        fingerprint: provider === 'codex' ? codexFingerprint() : claudeFingerprint(),
+        lastFoldAt: options.now,
+    };
+    return report;
+}
+/**
+ * Reconcile the live logins with the saved profiles for both providers.
+ * Safe to call from watchers: re-entrant calls return an empty report, and
+ * `onlyIfChanged` short-circuits when the live files are unchanged.
+ */
+function syncLiveAccountStateCore(options = {}, scan) {
+    const reason = options.reason ?? 'manual';
+    const now = options.now ?? Date.now();
+    const resolved = {
+        onlyIfChanged: options.onlyIfChanged ?? (reason === 'watch' || reason === 'poll'),
+        keychainFoldIntervalMs: options.keychainFoldIntervalMs ?? DEFAULT_KEYCHAIN_FOLD_INTERVAL_MS,
+        now,
+    };
+    const providers = options.providers ?? ['claude-code', 'codex'];
+    const report = {
+        claude: { ...emptyProviderSyncReport(), skipped: 'not-requested' },
+        codex: { ...emptyProviderSyncReport(), skipped: 'not-requested' },
+        ranAt: now,
+        reason,
+    };
+    if (syncInProgress) {
+        report.claude.skipped = 'in-progress';
+        report.codex.skipped = 'in-progress';
+        return report;
+    }
+    syncInProgress = true;
+    try {
+        if (providers.includes('claude-code'))
+            report.claude = syncProvider('claude-code', reason, resolved);
+        if (providers.includes('codex'))
+            report.codex = syncProvider('codex', reason, resolved, scan);
+    }
+    finally {
+        syncInProgress = false;
+    }
+    return report;
+}
+export function syncLiveAccountStateSync(options = {}) {
+    return syncLiveAccountStateCore(options);
+}
+/** Promise-returning twin of {@link syncLiveAccountStateSync} for async hosts. */
+export async function syncLiveAccountState(options = {}) {
+    const scan = !options.providers || options.providers.includes('codex')
+        ? await inspectRunningAccountConsumers('codex')
+        : undefined;
+    return syncLiveAccountStateCore(options, scan);
+}
+/** Forget the change fingerprints (tests, or after an external reset). */
+export function _resetSyncFingerprints() {
+    fingerprints['claude-code'] = {};
+    fingerprints.codex = {};
+}
+/** Remove isolated login homes that never authenticated (both providers). */
+export function cleanupAbandonedLogins(olderThanMs = 6 * 60 * 60 * 1000, now = Date.now()) {
+    return {
+        claude: cleanupAbandonedClaudeLogins(olderThanMs, now),
+        codex: cleanupAbandonedCodexLogins(olderThanMs, now),
+    };
+}
+export async function cleanupAbandonedLoginsAsync(olderThanMs = 24 * 60 * 60 * 1000, now = Date.now()) {
+    return {
+        claude: cleanupAbandonedClaudeLogins(olderThanMs, now),
+        codex: await cleanupAbandonedCodexLoginsAsync(olderThanMs, now),
+    };
+}

package/dist/esm/accountSyncTypes.js

@@ -0,0 +1,4 @@
+/** Reports produced by the live-state sync engine (see accountSync.ts). */
+export function emptyProviderSyncReport() {
+    return { warnings: [] };
+}