swapdex 0.34.1

//! The subcommand handlers. Each returns an exit code; a hard error propagates
//! and `main` prints a redacted message + exits 1. Output is identity-based and
//! never prints a credential byte (the A11 egress guarantee) - the only reader
//! of a `Secret` is inside the adapters/store.

use crate::adapters::{self, Account, AuthTool};
use crate::paths::Paths;
use crate::store::Store;
use anyhow::Result;
use serde_json::Value;
use std::process::Command;

/// Is a CLI on PATH and runnable?
/// The `--tool` flag value for a tool name (claude-code -> claude).
fn pretty_tool_flag(tool: &str) -> &str {
    if tool == "claude-code" {
        "claude"
    } else {
        tool
    }
}

fn now_nanos() -> u128 {
    std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_nanos())
        .unwrap_or(0)
}

/// Is `cmd` on PATH? Answered by LOOKING, never by running it.
///
/// This used to shell out to `cmd --version`, which meant `swapdex doctor` -
/// whose whole job is to observe - executed whatever `claude` resolved to. With
/// the shim installed that is the shim, and the shim starts a proxy: a
/// diagnostic that silently launched a daemon every time it ran.
fn command_exists(cmd: &str) -> bool {
    let Some(path) = std::env::var_os("PATH") else {
        return false;
    };
    std::env::split_paths(&path).any(|dir| is_executable(&dir.join(cmd)))
}

#[cfg(unix)]
fn is_executable(p: &std::path::Path) -> bool {
    use std::os::unix::fs::PermissionsExt;
    std::fs::metadata(p).is_ok_and(|m| m.is_file() && m.permissions().mode() & 0o111 != 0)
}

#[cfg(not(unix))]
fn is_executable(p: &std::path::Path) -> bool {
    p.is_file()
}

/// Which tool a `--tool` value targets. A clap `ValueEnum`, so an unknown or
/// miscased value (`--tool cluade`) is rejected with a did-you-mean instead of
/// silently falling through to "both" and switching a tool you meant to leave
/// alone. `None` (no `--tool`) means the default: act on whichever tools apply.
#[derive(Clone, Copy, PartialEq, Eq, clap::ValueEnum)]
pub enum ToolSel {
    #[value(alias = "claude-code")]
    Claude,
    Codex,
    Gemini,
    Antigravity,
    /// Every tool (the default when --tool is omitted)
    #[value(alias = "both")]
    All,
}

impl ToolSel {
    fn wants(self, tool: &str) -> bool {
        match self {
            ToolSel::Claude => tool == "claude-code",
            ToolSel::Codex => tool == "codex",
            ToolSel::Gemini => tool == "gemini",
            ToolSel::Antigravity => tool == "antigravity",
            ToolSel::All => true,
        }
    }
}

/// The adapters a command targets. `None` and `Some(Both)` mean all; an explicit
/// single tool narrows it.
fn selected_adapters(sel: Option<ToolSel>) -> Vec<Box<dyn AuthTool>> {
    adapters::all()
        .into_iter()
        .filter(|a| sel.map(|s| s.wants(a.name())).unwrap_or(true))
        .collect()
}

/// Whether the user explicitly asked for one tool (so a missing one is an error,
/// not a silent skip). `--tool both` is treated as the lenient default.
fn is_explicit(sel: Option<ToolSel>) -> bool {
    matches!(
        sel,
        Some(ToolSel::Claude)
            | Some(ToolSel::Codex)
            | Some(ToolSel::Gemini)
            | Some(ToolSel::Antigravity)
    )
}

/// On macOS, Claude Code keeps its OAuth login in the Keychain rather than in
/// `~/.claude/.credentials.json`, so swapdex sees "not logged in" even when a
/// login exists. When the config file proves a login is present, explain that
/// instead of gaslighting the user. (`cfg!` keeps this type-checked on Linux.)
fn macos_keychain_note(_paths: &Paths, _tool: &str) -> Option<&'static str> {
    // Claude Code on macOS is now supported: the adapter reads and writes the
    // login Keychain via `security`. So there is no longer anything to skip or
    // warn about - this returns None everywhere and the old skip branches are
    // inert. (Kept as a single seam in case a future tool needs a similar
    // platform note.)
    None
}

/// The account_id inside a snapshot's blobs (works for stored profiles and
/// backups alike).
fn snapshot_account_id(snap: &crate::adapters::Snapshot, tool: &str) -> Option<String> {
    match tool {
        "codex" => {
            let v: Value = serde_json::from_slice(snap.part("auth")?.expose()).ok()?;
            v["tokens"]["account_id"].as_str().map(|s| s.to_string())
        }
        "claude-code" => {
            let v: Value = serde_json::from_slice(snap.part("oauth_account")?.expose()).ok()?;
            v["accountUuid"].as_str().map(|s| s.to_string())
        }
        "gemini" => {
            let v: Value = serde_json::from_slice(snap.part("oauth")?.expose()).ok()?;
            crate::adapters::gemini_jwt_claim(v["id_token"].as_str(), "sub")
        }
        "antigravity" => {
            let v: Value = serde_json::from_slice(snap.part("token")?.expose()).ok()?;
            let fp = crate::adapters::antigravity_fingerprint(&v);
            (!fp.is_empty()).then_some(fp)
        }
        _ => None,
    }
}

/// The account_id a stored profile's snapshot resolves to, for matching a live
/// identity back to a profile name (A2). Reads the snapshot, not `active.json`.
fn profile_account_id(store: &Store, name: &str, tool: &str) -> Option<String> {
    let snap = store.load(name, tool).ok()??;
    snapshot_account_id(&snap, tool)
}

/// Find the stored profile name whose snapshot matches this live account_id.
pub(crate) fn matched_profile_name(store: &Store, tool: &str, live_id: &str) -> Option<String> {
    if live_id.is_empty() {
        return None;
    }
    store
        .list()
        .into_iter()
        .find(|p| {
            p.tools.iter().any(|t| t == tool)
                && profile_account_id(store, &p.name, tool).as_deref() == Some(live_id)
        })
        .map(|p| p.name)
}

/// Every profile holding this tool+account - refresh targets when the live
/// login (with its freshest, possibly rotated tokens) is switched away.
fn matching_profile_names(store: &Store, tool: &str, live_id: &str) -> Vec<String> {
    if live_id.is_empty() {
        return Vec::new();
    }
    store
        .list()
        .into_iter()
        .filter(|p| {
            p.tools.iter().any(|t| t == tool)
                && profile_account_id(store, &p.name, tool).as_deref() == Some(live_id)
        })
        .map(|p| p.name)
        .collect()
}

/// Reject a profile name that could escape the store (path traversal). Returns
/// the exit code to use if invalid.
fn reject_bad_name(name: &str) -> Option<i32> {
    if crate::store::valid_profile_name(name) {
        None
    } else {
        eprintln!(
            "swapdex: invalid profile name '{name}' (1-64 bytes, not all spaces; \
             no '/', '\\', leading '.', or control chars)"
        );
        Some(2)
    }
}

/// Additionally reject "-" where a profile is CREATED (`use -` toggles, so a
/// new profile must never take that name; a legacy one stays manageable).
fn reject_reserved_name(name: &str) -> Option<i32> {
    if name == "-" {
        eprintln!("swapdex: '-' is reserved (`swapdex use -` toggles to the previous profile)");
        Some(2)
    } else if name.trim().is_empty() {
        // CREATION-time only (like '-'): a legacy all-whitespace profile from
        // 0.2.x must stay rm-able/renamable after an upgrade.
        eprintln!("swapdex: a profile name cannot be only whitespace");
        Some(2)
    } else {
        None
    }
}

pub fn add(paths: &Paths, name: Option<&str>, sel: Option<ToolSel>, update: bool) -> Result<i32> {
    crate::atomic::ensure_not_root()?;
    let store = Store::open(paths)?;
    // No name: on a terminal, suggest one from the live account (setup's flow);
    // non-interactively, error with the fix instead of a bare usage error.
    let asked;
    let name: &str = match name {
        Some(n) => n,
        None => {
            use std::io::IsTerminal;
            let tty =
                std::io::stdin().is_terminal() || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
            if !tty {
                eprintln!(
                    "swapdex: a profile name is required: swapdex add <name> \
                     (or run `swapdex setup` for the guided flow)"
                );
                return Ok(2);
            }
            let who = adapters::all()
                .iter()
                .find_map(|a| a.identity(paths).ok().flatten())
                .map(|id| id.email.unwrap_or(id.display))
                .unwrap_or_else(|| "account".into());
            let suggestion = suggest_name(&who);
            match ask_name(
                &store,
                &format!("name for this account [{suggestion}]: "),
                &suggestion,
            ) {
                Some(n) => {
                    asked = n;
                    &asked
                }
                None => {
                    println!("nothing saved.");
                    return Ok(0);
                }
            }
        }
    };
    if let Some(c) = reject_bad_name(name).or_else(|| reject_reserved_name(name)) {
        return Ok(c);
    }
    // Take the switch lock so `add --update` can't race a `use` into a torn
    // (mismatched credentials + identity) two-file Claude snapshot.
    let _lock = match store.lock() {
        Ok(g) => g,
        Err(crate::store::LockError::Busy) => {
            eprintln!(
                "swapdex: another swapdex is busy (a switch, or a `swapdex login` waiting \
                 for a sign-in). Finish or close it, then retry."
            );
            return Ok(4);
        }
        Err(crate::store::LockError::Unwritable(e)) => {
            eprintln!(
                "swapdex: the store is not writable ({e}) - check permissions/mount of \
                 the store directory"
            );
            return Ok(4);
        }
    };
    let mut saved = Vec::new();
    let mut skipped = Vec::new();
    let mut capture_failed: Vec<&str> = Vec::new();
    let mut declined: Vec<&str> = Vec::new(); // repoint prompt answered No
    for adapter in selected_adapters(sel) {
        let tool = adapter.name();
        if !adapter.present(paths) {
            if is_explicit(sel) {
                eprintln!("swapdex: not logged in to {tool}");
                if let Some(note) = macos_keychain_note(paths, tool) {
                    eprintln!("swapdex: note - {note}");
                }
                return Ok(3);
            }
            continue;
        }
        if update {
            // Updating must not silently REPOINT the profile to a different
            // account - that changes what the name means. Same-account
            // updates (the documented stale-token refresh) pass through.
            let stored_id = profile_account_id(&store, name, tool).filter(|s| !s.is_empty());
            let live_id = adapter
                .identity(paths)
                .ok()
                .flatten()
                .map(|i| i.account_id)
                .filter(|s| !s.is_empty());
            if let (Some(stored), Some(live)) = (&stored_id, &live_id) {
                if stored != live {
                    use std::io::IsTerminal;
                    let tty = std::io::stdin().is_terminal()
                        || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
                    let msg = format!(
                        "profile '{name}' holds a different account for {tool} \
                         than the one you're logged into"
                    );
                    if !tty {
                        eprintln!("swapdex: {msg}.");
                        eprintln!(
                            "  keep both: swapdex add <new-name> --tool {}  |  really \
                             repoint: swapdex rm {name} && swapdex add {name}",
                            pretty_tool_flag(tool)
                        );
                        return Ok(7);
                    }
                    if !yes_no(
                        &format!("{msg}. Repoint '{name}' to the current login? [y/N]: "),
                        false,
                    ) {
                        println!("skipped {tool}.");
                        declined.push(tool);
                        continue;
                    }
                }
            }
        }
        if store.load(name, tool)?.is_some() && !update {
            // Explicit --tool on an already-saved tool is an error; in the
            // default case, just skip it and still attach the missing tool(s).
            if is_explicit(sel) {
                eprintln!(
                    "swapdex: profile '{name}' already has a {tool} login; pass --update to replace"
                );
                return Ok(6);
            }
            skipped.push(tool);
            continue;
        }
        let snap = match adapter.capture(paths) {
            Ok(s) => s,
            Err(e) => {
                eprintln!("swapdex: {tool}: could not read the live login ({e:#}) - skipped");
                capture_failed.push(tool);
                continue;
            }
        };
        store.save(name, &snap)?;
        // Surface the captured identity so a stale oauthAccount (saving 'rnd'
        // while bsgong is the live account) is caught at save, not discovered
        // later when `use` connects the wrong account.
        let email = adapter
            .identity(paths)
            .ok()
            .flatten()
            .and_then(|id| id.email);
        saved.push((tool, email));
    }
    if saved.is_empty() {
        if !declined.is_empty() {
            // The user was logged in but declined to repoint - nothing wrong,
            // nothing saved. NOT "not logged in" (exit 3 would be a lie).
            println!(
                "nothing saved for {} (you declined the repoint).",
                declined.join(", ")
            );
            return Ok(0);
        }
        if !skipped.is_empty() {
            eprintln!(
                "swapdex: profile '{name}' already has {}; pass --update to replace",
                skipped.join(", ")
            );
            return Ok(6);
        }
        if !capture_failed.is_empty() {
            // present() said the login IS there but capture failed - a corrupt
            // or unreadable live login (a hand-edited ~/.claude.json with a
            // JSON syntax error is the common one), NOT "not logged in". The
            // per-tool error above carries the fix; this is a hard error (1),
            // never exit 3 (which would send the user to re-log-in in vain).
            eprintln!(
                "swapdex: nothing saved - the live login for {} is present but could not be \
                 read (see the error above)",
                capture_failed.join(", ")
            );
            return Ok(1);
        }
        eprintln!("swapdex: not logged in to any selected tool");
        return Ok(3);
    }
    let note = if skipped.is_empty() {
        String::new()
    } else {
        format!(
            " ({} already saved; --update to replace)",
            skipped.join(", ")
        )
    };
    let saved_disp = saved
        .iter()
        .map(|(tool, email)| match email {
            Some(e) => format!("{tool} = {e}"),
            None => tool.to_string(),
        })
        .collect::<Vec<_>>()
        .join(", ");
    println!("saved profile '{name}' ({saved_disp}){note}");
    if !capture_failed.is_empty() {
        eprintln!(
            "swapdex: {} tool(s) could not be read and were NOT saved: {}",
            capture_failed.len(),
            capture_failed.join(", ")
        );
    }
    if name.contains(char::is_whitespace) {
        println!(
            "note: the name has spaces - quote it in later commands (`swapdex use \"{name}\"`)"
        );
    }
    Ok(if capture_failed.is_empty() { 0 } else { 1 })
}

/// Whether a name-detectable, non-slotted tool (codex/gemini/antigravity) has a
/// live process - the rotation-logout guard input. A dry-run and SWAPDEX_ROOT
/// never scan real processes (an isolated root's credentials are not the ones a
/// real session uses); under SWAPDEX_ROOT a test hook names the tools to treat
/// as running, e.g. `SWAPDEX_TEST_RUNNING=codex,gemini`.
fn tool_session_running(tool: &str, running: &[String], dry_run: bool) -> bool {
    if dry_run {
        return false;
    }
    if std::env::var_os("SWAPDEX_ROOT").is_some() {
        return std::env::var("SWAPDEX_TEST_RUNNING")
            .map(|v| v.split(',').any(|t| t.trim() == tool))
            .unwrap_or(false);
    }
    crate::proc::tool_running(tool, running)
}

pub fn use_account(
    paths: &Paths,
    name: &str,
    sel: Option<ToolSel>,
    dry_run: bool,
    force: bool,
) -> Result<i32> {
    // Permanent-slot account: `use` just repoints the default pointer (the
    // claude shim follows it) - no credential copy, so no rotation logout. A
    // legacy copy-model profile (not in the slot registry) falls through to the
    // old guarded switch.
    let tool = slot_tool(sel);
    if crate::slots::Slots::open_for(paths, tool)?
        .get(name)
        .is_some()
    {
        return use_slot_default(paths, name, tool, dry_run);
    }
    use_account_inner(paths, name, sel, dry_run, false, None, force)
}

/// `open`: after a successful switch, exec the tool (the --open flag; needs an
/// explicit --tool so there is never a guess about WHICH conversation opens).
pub fn use_account_open(
    paths: &Paths,
    name: &str,
    sel: Option<ToolSel>,
    dir: Option<&std::path::Path>,
    force: bool,
) -> Result<i32> {
    if !is_explicit(sel) {
        eprintln!("swapdex: --open needs --tool <claude|codex|gemini|antigravity> so it knows what to launch");
        return Ok(2);
    }
    if let Some(d) = dir {
        if !d.is_dir() {
            eprintln!("swapdex: --dir is not a directory: {}", d.display());
            return Ok(2);
        }
    }
    use_account_inner(paths, name, sel, false, true, dir, force)
}

fn use_account_inner(
    paths: &Paths,
    name: &str,
    sel: Option<ToolSel>,
    dry_run: bool,
    open: bool,
    open_dir: Option<&std::path::Path>,
    force: bool,
) -> Result<i32> {
    crate::atomic::ensure_not_root()?;
    let store = Store::open(paths)?;
    // Resolve the NAME first: `-` toggles to the previous/other profile and a
    // unique prefix expands, so the daily switch is two keystrokes.
    let name = match resolve_use_name(&store, paths, name, sel)? {
        Some(n) => n,
        None => return Ok(5),
    };
    let name = name.as_str();
    if let Some(c) = reject_bad_name(name) {
        return Ok(c);
    }
    let _lock = match store.lock() {
        Ok(g) => g,
        Err(crate::store::LockError::Busy) => {
            eprintln!(
                "swapdex: another swapdex is busy (a switch, or a `swapdex login` waiting \
                 for a sign-in). Finish or close it, then retry."
            );
            return Ok(4);
        }
        Err(crate::store::LockError::Unwritable(e)) => {
            eprintln!(
                "swapdex: the store is not writable ({e}) - check permissions/mount of \
                 the store directory"
            );
            return Ok(4);
        }
    };
    // A typo must be ONE line, not four "left unchanged" notes implying the
    // profile exists but lacks those tools.
    if !store.list().iter().any(|p| p.name == name) {
        eprintln!("swapdex: no profile named '{name}'");
        return Ok(5);
    }
    let mut matched = 0; // profile had a snapshot for this tool
    let mut changed = 0; // an actual switch was written
    let mut failed: Vec<&str> = Vec::new(); // tools whose switch errored

    // Snapshot running processes once (best-effort) so we can warn if a switch
    // pulls the login out from under a live session. Skipped on a dry-run.
    // Skip the scan on a dry-run, and under SWAPDEX_ROOT: an isolated root's
    // credentials are not the ones any running session uses, so the warning
    // would be a false positive there.
    let running = if dry_run || std::env::var_os("SWAPDEX_ROOT").is_some() {
        Vec::new()
    } else {
        crate::proc::running_process_names()
    };
    // Pre-switch guard for Claude: swapping the login slot while a `claude`
    // session is using THAT slot both clobbers the incoming login AND revokes
    // the outgoing account's just-saved snapshot on the session's next token
    // refresh (Claude's refresh tokens rotate - the saved copy dies). Compute
    // the verdict once (a process scan); enforced per-tool below unless --force.
    // Skipped on a dry-run and under SWAPDEX_ROOT (no real sessions in play).
    let claude_guard = if dry_run {
        crate::proc::GuardVerdict::Clear
    } else if std::env::var_os("SWAPDEX_ROOT").is_some() {
        // Sandbox: never scan real processes (they are not the ones an isolated
        // root's credentials belong to). A test hook - honored ONLY here - can
        // inject a verdict to exercise the enforcement path.
        match std::env::var("SWAPDEX_TEST_CLAUDE_GUARD").ok().as_deref() {
            Some("same-slot") => crate::proc::GuardVerdict::SameSlot,
            Some("unknown") => crate::proc::GuardVerdict::Unknown,
            _ => crate::proc::GuardVerdict::Clear,
        }
    } else {
        crate::proc::claude_switch_guard(
            std::env::var("CLAUDE_SECURESTORAGE_CONFIG_DIR")
                .ok()
                .as_deref(),
            std::env::var("CLAUDE_CONFIG_DIR").ok().as_deref(),
            &crate::proc::running_claude_procs(),
        )
    };
    // One shared timestamp for every tool this invocation switches, so a later
    // bare `restore` can identify exactly this switch's tool set.
    let switch_ts = now_secs();
    let switch_inv = now_nanos();
    for adapter in selected_adapters(sel) {
        let tool = adapter.name();
        // A Keychain-mode Claude install (macOS) cannot be switched yet. In
        // the default both-tools case SKIP it with a note so Codex still
        // switches; the adapter's own refusal stays for an explicit --tool.
        if !is_explicit(sel) && macos_keychain_note(paths, tool).is_some() {
            println!(
                "{tool}: skipped - the login lives in the macOS Keychain \
                 (github.com/youdie006/swapdex/issues/1); other tools continue"
            );
            continue;
        }
        let target = match store.load(name, tool)? {
            Some(s) => s,
            None => {
                if is_explicit(sel) {
                    eprintln!("swapdex: profile '{name}' has no {tool} login");
                    return Ok(5);
                }
                // Not an error in the default case, but if the user IS logged
                // into this tool, say so - a silent partial switch reads as a
                // full one and leaves the old account active unnoticed.
                if adapter.present(paths) {
                    println!("{tool}: profile '{name}' has no {tool} login - left unchanged");
                }
                continue;
            }
        };
        matched += 1;
        // Already-active is a no-op success. Ignore EMPTY ids: two accounts with
        // no account_id must never compare equal, or the switch would be skipped
        // and the WRONG account silently kept active. An UNREADABLE live file is
        // treated as unknown (not an abort): `use <good-profile>` is exactly the
        // command that can replace a corrupt login.
        let live = adapter.identity(paths).ok().flatten();
        let live_id = live
            .as_ref()
            .map(|i| i.account_id.clone())
            .filter(|s| !s.is_empty());
        let target_id = profile_account_id(&store, name, tool).filter(|s| !s.is_empty());
        if live_id.is_some() && live_id == target_id {
            println!("{tool}: '{name}' is already active");
            // Still a sync point: the live login IS this profile's account
            // and its tokens may have rotated since the last save. No backup
            // and no timeline event - nothing is switching.
            if !dry_run {
                if let (Ok(snap), Some(id)) = (adapter.capture(paths), &live_id) {
                    for pname in matching_profile_names(&store, tool, id) {
                        store.save(&pname, &snap)?;
                    }
                }
            }
            continue;
        }
        warn_if_expired(&target, tool);
        if dry_run {
            match profile_detail(&store, name, tool).and_then(|(email, _, _)| email) {
                Some(email) => println!("would switch {tool} -> {name} ({email})"),
                None => println!("would switch {tool} -> {name}"),
            }
            continue;
        }
        // Pre-switch guard (Claude only): refuse to swap the slot while a claude
        // session is using it, or when a running session's slot is unknown
        // (fail closed). Doing so would clobber the incoming login and, on the
        // session's next refresh, revoke the outgoing account's snapshot ->
        // a later switch-back logs it out. `--force` overrides.
        if tool == "claude-code" && !force {
            match claude_guard {
                crate::proc::GuardVerdict::SameSlot => {
                    eprintln!(
                        "swapdex: {tool}: a Claude session is running on THIS login slot. \
                         Switching now would log that account out on its next token refresh \
                         (the refresh token rotates and the saved copy is revoked). Quit that \
                         `claude` and retry, or `swapdex use {name} --tool claude --force` to \
                         switch anyway."
                    );
                    failed.push(tool);
                    continue;
                }
                crate::proc::GuardVerdict::Unknown => {
                    eprintln!(
                        "swapdex: {tool}: a Claude session is running but swapdex could not read \
                         which login slot it uses, so it can't rule out that switching would log \
                         it out. Quit `claude` and retry, or `--force` to switch anyway."
                    );
                    failed.push(tool);
                    continue;
                }
                crate::proc::GuardVerdict::Clear => {}
            }
        }
        // Pre-switch rotation-logout guard for the NON-slotted tools (codex,
        // gemini, antigravity), the running-session analog of Claude's guard.
        // They all rotate their OAuth token on refresh, and swapdex swaps their
        // shared credential files - so switching while the tool runs lets that
        // session's next refresh revoke the account being switched, logging it
        // out (e.g. a `codex` MCP server used from Claude). Claude is slot-
        // isolated and guarded above. Detection is by process name (no slot);
        // --force overrides.
        if matches!(tool, "codex" | "gemini" | "antigravity")
            && !force
            && tool_session_running(tool, &running, dry_run)
        {
            eprintln!(
                "swapdex: {tool}: a running {tool} session was detected. {tool} rotates its \
                 OAuth token on refresh, so switching now can log that account out on the \
                 session's next refresh. Quit it and retry, or `swapdex use {name} --tool \
                 {} --force` to switch anyway.",
                pretty_tool_flag(tool)
            );
            failed.push(tool);
            continue;
        }
        // Exclude a concurrent `login` mid-sign-in on THIS tool: it holds the
        // per-tool credential lock across its interactive wait (while the store
        // lock is free), so switching now would race its sign-out/capture. Skip
        // this tool, keep switching the others. Held for the rest of this tool's
        // credential work.
        let _cred_lock = match store.lock_tool(tool) {
            Ok(g) => g,
            Err(_) => {
                eprintln!(
                    "swapdex: {tool}: a `swapdex login` is signing this tool in right now; \
                     skipped. Retry after it finishes."
                );
                failed.push(tool);
                continue;
            }
        };
        // Safe order (A6): back up the CURRENT live login first (atomic + fsync
        // inside write_secret); if the backup fails, `?` aborts BEFORE we touch
        // the live login. An unreadable live file only skips its own backup -
        // there is nothing usable to save.
        if adapter.present(paths) {
            match adapter.capture(paths) {
                Ok(live_snap) => {
                    store.backup(&live_snap)?;
                    // Refresh tokens ROTATE while an account is in use, so a
                    // profile snapshot goes stale the moment you work on that
                    // account. Write the live capture (the freshest known
                    // tokens) back into every profile holding this account -
                    // otherwise switching back later restores a refresh token
                    // the provider may have already revoked.
                    if let Some(id) = &live_id {
                        for pname in matching_profile_names(&store, tool, id) {
                            store.save(&pname, &live_snap)?;
                        }
                        if matched_profile_name(&store, tool, id).is_none() {
                            let who = live
                                .as_ref()
                                .map(identity_line)
                                .unwrap_or_else(|| "current".into());
                            eprintln!(
                                "swapdex: note - the outgoing {tool} login ({who}) is not \
                                 saved as a profile; only the last 2 backups keep it. \
                                 `swapdex restore` undoes this switch; `swapdex add <name>` \
                                 would keep it for good."
                            );
                        }
                    }
                }
                Err(e) if live.is_some() => {
                    // identity() SUCCEEDED but capture() failed: the login is
                    // valid and recoverable, only a sibling file is corrupt (a
                    // hand-edited ~/.claude.json, or a Gemini
                    // google_accounts.json). Applying now would OVERWRITE a
                    // recoverable login with NO backup - a lost login. Refuse
                    // for this tool (the others still switch) and point at the
                    // repair.
                    eprintln!(
                        "swapdex: {tool}: the current login is present but could not be backed \
                         up ({e:#}) - refusing to overwrite it without a backup. Repair the file \
                         named above (or re-login), then retry."
                    );
                    failed.push(tool);
                    continue;
                }
                Err(e) => eprintln!(
                    // identity() ALSO failed: the live login is genuinely
                    // broken (its primary credential is unparseable), so there
                    // is nothing recoverable to preserve - switching in a good
                    // profile IS the fix. Proceed, warning about the skipped
                    // backup.
                    "swapdex: note - the current {tool} login could not be read ({e:#}); \
                     switching without a backup of it"
                ),
            }
        }
        if let Err(e) = adapter.apply(paths, &target) {
            // Do NOT abort the whole multi-tool switch: the other tools can
            // still switch; a summary at the end says what failed.
            eprintln!(
                "swapdex: {tool}: switch failed - {:#}\n  (if the error is about the \
                 SNAPSHOT: log in to that account and re-save with `swapdex add {name} \
                 --tool {} --update`)",
                e,
                pretty_tool_flag(tool)
            );
            failed.push(tool);
            continue;
        }
        store.append_timeline_inv(tool, name, "use", switch_ts, switch_inv)?;
        if let Some(id) = adapter.identity(paths).ok().flatten() {
            println!("switched {tool} -> {}", identity_line(&id));
        }
        if crate::proc::tool_running(tool, &running) {
            eprintln!(
                "swapdex: note - a {tool} session looks like it's running. Restart it \
                 to use '{name}'; a live session can overwrite the switched login on \
                 its next token refresh."
            );
        }
        changed += 1;
    }
    if matched == 0 {
        eprintln!("swapdex: no profile named '{name}'");
        return Ok(5);
    }
    // Only when a login was actually written - not for a no-op or a dry-run.
    if changed > 0 {
        println!("(takes effect on your next message)");
    }
    if !failed.is_empty() {
        eprintln!(
            "swapdex: {} tool(s) failed to switch ({}); the tools above did switch - \
             `swapdex restore` undoes this switch entirely",
            failed.len(),
            failed.join(", ")
        );
        return Ok(1);
    }
    if open {
        if let Some(adapter) = selected_adapters(sel).into_iter().next() {
            let tool = adapter.name();
            println!("opening {}...", pretty_tool(tool));
            return Err(exec_tool(tool, open_dir));
        }
    }
    Ok(0)
}

/// `restore` - put back the login that was live before the last switch. `use`
/// backs up the outgoing login before every switch; this is the command that
/// brings a backup back, so a bad switch is a one-command recovery even when
/// the outgoing account was never saved as a profile. It backs up the current
/// login first, so running `restore` twice toggles between the two.
pub fn restore(paths: &Paths, sel: Option<ToolSel>, dry_run: bool) -> Result<i32> {
    crate::atomic::ensure_not_root()?;
    let store = Store::open(paths)?;
    let _lock = match store.lock() {
        Ok(g) => g,
        Err(crate::store::LockError::Busy) => {
            eprintln!(
                "swapdex: another swapdex is busy (a switch, or a `swapdex login` waiting \
                 for a sign-in). Finish or close it, then retry."
            );
            return Ok(4);
        }
        Err(crate::store::LockError::Unwritable(e)) => {
            eprintln!(
                "swapdex: the store is not writable ({e}) - check permissions/mount of \
                 the store directory"
            );
            return Ok(4);
        }
    };
    // Skip the scan on a dry-run, and under SWAPDEX_ROOT: an isolated root's
    // credentials are not the ones any running session uses, so the warning
    // would be a false positive there.
    let running = if dry_run || std::env::var_os("SWAPDEX_ROOT").is_some() {
        Vec::new()
    } else {
        crate::proc::running_process_names()
    };
    // Bare `restore` means "undo the LAST SWITCH" - scope it to the tool(s)
    // that switch touched, or a codex-only undo would also rewind claude-code
    // to some older, unrelated backup.
    let last_switch = last_switch_tools(paths);
    let restore_ts = now_secs();
    let restore_inv = now_nanos();
    let mut found = 0; // a backup existed for this tool
    let mut changed = 0; // an actual restore was written
    for adapter in selected_adapters(sel) {
        let tool = adapter.name();
        if !is_explicit(sel) {
            if let Some(tools) = &last_switch {
                if !tools.iter().any(|t| t == tool) {
                    continue;
                }
            }
            // Keychain-mode Claude (macOS): skip with a note, keep restoring
            // the other tool (mirror of the `use` skip).
            if macos_keychain_note(paths, tool).is_some() {
                println!(
                    "{tool}: skipped - the login lives in the macOS Keychain \
                     (github.com/youdie006/swapdex/issues/1); other tools continue"
                );
                continue;
            }
        }
        let Some((stamp, target)) = store.load_backup(tool)? else {
            if is_explicit(sel) {
                eprintln!("swapdex: no backup for {tool} (a backup is taken on every `use`)");
                return Ok(5);
            }
            continue;
        };
        found += 1;
        // Restoring the already-live account is a no-op success. An unreadable
        // live file is treated as unknown, not an abort - restore is the
        // disaster-recovery command.
        let live_id = adapter
            .identity(paths)
            .ok()
            .flatten()
            .map(|i| i.account_id)
            .filter(|s| !s.is_empty());
        let backup_id = snapshot_account_id(&target, tool).filter(|s| !s.is_empty());
        if live_id.is_some() && live_id == backup_id {
            println!("{tool}: the newest backup is already the active login");
            continue;
        }
        let age = age_line(stamp);
        if dry_run {
            println!("would restore {tool} from the backup taken {age}");
            continue;
        }
        // Same per-tool credential lock as `use`: a `login` mid-sign-in on this
        // tool holds it across its interactive wait, so restoring now would race
        // its sign-out/capture. Skip this tool, keep restoring the others.
        let _cred_lock = match store.lock_tool(tool) {
            Ok(g) => g,
            Err(_) => {
                eprintln!(
                    "swapdex: {tool}: a `swapdex login` is signing this tool in right now; \
                     skipped. Retry after it finishes."
                );
                continue;
            }
        };
        // Capture the CURRENT login first, but do NOT back it up yet: if
        // apply(target) fails, backing it up now would make it the NEWEST backup,
        // and a retry would see it as "already active" - stranding the very
        // backup we were asked to restore. Promote it only after apply succeeds.
        let live_snap = if adapter.present(paths) {
            match adapter.capture(paths) {
                Ok(s) => Some(s),
                Err(e) => {
                    eprintln!(
                        "swapdex: note - the current {tool} login could not be read ({e:#}); \
                         restoring without a backup of it"
                    );
                    None
                }
            }
        } else {
            None
        };
        adapter.apply(paths, &target)?;
        // apply(target) succeeded: NOW it is safe to record the outgoing login as
        // a backup (so `restore` toggles back) and refresh its profile(s) with
        // its freshest tokens - the same rotation invariant as `use`.
        if let Some(live_snap) = &live_snap {
            store.backup(live_snap)?;
            if let Some(id) = &live_id {
                for pname in matching_profile_names(&store, tool, id) {
                    store.save(&pname, live_snap)?;
                }
            }
        }
        // Attribute the timeline event to the restored account's profile name
        // when one matches, or `sessions` would blame "(backup)" forever after.
        let restored = adapter.identity(paths).ok().flatten();
        let event_name = restored
            .as_ref()
            .and_then(|id| matched_profile_name(&store, tool, &id.account_id))
            .unwrap_or_else(|| "(backup)".into());
        store.append_timeline_inv(tool, &event_name, "restore", restore_ts, restore_inv)?;
        match restored {
            Some(id) => println!("restored {tool} -> {} (backup {age})", identity_line(&id)),
            None => println!("restored {tool} from the backup taken {age}"),
        }
        if crate::proc::tool_running(tool, &running) {
            eprintln!(
                "swapdex: note - a {tool} session looks like it's running. Restart it \
                 to pick up the restored login."
            );
        }
        changed += 1;
    }
    if found == 0 {
        eprintln!("swapdex: no backup to restore (a backup is taken on every `use`)");
        return Ok(5);
    }
    if changed > 0 {
        println!("(takes effect on your next message)");
    }
    Ok(0)
}

/// Resolve `use`'s NAME argument. `-` means "the profile I was on before":
/// with exactly two profiles it is simply the other one; otherwise the most
/// recent timeline switch to a profile that is not currently active. A unique
/// prefix expands (`use w` -> work); an ambiguous one refuses and lists the
/// candidates rather than guessing (switching is a write). `Ok(None)` means
/// "already reported, exit 5".
fn resolve_use_name(
    store: &Store,
    paths: &Paths,
    raw: &str,
    sel: Option<ToolSel>,
) -> Result<Option<String>> {
    // An empty name (an unset shell variable) must fall through to the
    // invalid-name rejection: every string starts with "", so prefix matching
    // would otherwise "uniquely" match a single-profile store and switch.
    if raw.is_empty() {
        return Ok(Some(raw.to_string()));
    }
    let profiles: Vec<String> = store.list().into_iter().map(|p| p.name).collect();
    if raw == "-" {
        // Scope "previous" to the selected tool(s): `use - --tool codex` asks
        // about codex history, not claude's.
        let mut act: Vec<String> = active_by_tool(store, paths)
            .into_iter()
            .filter(|(t, _)| sel.map(|s| s.wants(t)).unwrap_or(true))
            .map(|(_, n)| n)
            .collect();
        act.sort();
        act.dedup();
        // The overwhelmingly common case: two profiles, one active.
        if profiles.len() == 2 && act.len() == 1 {
            if let Some(other) = profiles.iter().find(|p| **p != act[0]) {
                eprintln!("swapdex: '-' -> '{other}'");
                return Ok(Some(other.clone()));
            }
        }
        // Otherwise: the most recent switch to a profile that is neither
        // active now nor the destination of the newest switch (when the live
        // identity is unreadable, that newest destination IS the current
        // profile - excluding it keeps '-' from re-picking where you already
        // are).
        if let Some(prev) = last_switch_name_excluding(paths, &act, &profiles, sel) {
            eprintln!("swapdex: '-' -> '{prev}'");
            return Ok(Some(prev));
        }
        if act.len() > 1 {
            eprintln!(
                "swapdex: both profiles are active ({}) - '-' is ambiguous here; \
                 say which: swapdex use <{}>",
                act.join(", "),
                profiles.join("|")
            );
        } else {
            eprintln!(
                "swapdex: can't tell which profile '-' means yet. \
                 Pick one: swapdex use <{}>",
                profiles.join("|")
            );
        }
        return Ok(None);
    }
    if profiles.iter().any(|p| p == raw) {
        return Ok(Some(raw.to_string()));
    }
    let cands: Vec<&String> = profiles.iter().filter(|p| p.starts_with(raw)).collect();
    match cands.len() {
        1 => {
            let n = cands[0].clone();
            eprintln!("swapdex: '{raw}' matched profile '{n}'");
            Ok(Some(n))
        }
        // No prefix match: fall through so the normal "no profile" error runs.
        0 => Ok(Some(raw.to_string())),
        _ => {
            eprintln!(
                "swapdex: '{raw}' is ambiguous: {}",
                cands
                    .iter()
                    .map(|s| s.as_str())
                    .collect::<Vec<_>>()
                    .join(", ")
            );
            Ok(None)
        }
    }
}

/// The most recent `use`/`restore` timeline entry naming a profile that still
/// exists and is not in `exclude` - i.e. "the profile you were on before".
/// The destination of the NEWEST switch is also excluded (it is where you are
/// now, even when the live identity cannot be read), and `sel` scopes which
/// tools' events count.
fn last_switch_name_excluding(
    paths: &Paths,
    exclude: &[String],
    profiles: &[String],
    sel: Option<ToolSel>,
) -> Option<String> {
    let text = std::fs::read_to_string(paths.store_dir().join("timeline.jsonl")).ok()?;
    let mut events: Vec<(i64, String)> = Vec::new();
    for line in text.lines() {
        let Ok(v) = serde_json::from_str::<Value>(line) else {
            continue;
        };
        if !matches!(v["action"].as_str(), Some("use") | Some("restore")) {
            continue;
        }
        if let Some(tool) = v["tool"].as_str() {
            if !sel.map(|s| s.wants(tool)).unwrap_or(true) {
                continue;
            }
        }
        let (Some(ts), Some(name)) = (v["ts"].as_i64(), v["account"].as_str()) else {
            continue;
        };
        events.push((ts, name.to_string()));
    }
    // Where the newest switch went = where you are now; never "toggle" there.
    let newest = events
        .iter()
        .max_by_key(|(ts, _)| *ts)
        .map(|(_, n)| n.clone());
    let mut best: Option<(i64, String)> = None;
    for (ts, name) in events {
        if exclude.contains(&name)
            || newest.as_deref() == Some(name.as_str())
            || !profiles.contains(&name)
        {
            continue;
        }
        if best.as_ref().map(|(t, _)| ts >= *t).unwrap_or(true) {
            best = Some((ts, name.to_string()));
        }
    }
    best.map(|(_, n)| n)
}

/// The tool(s) the most recent switch (`use` or `restore`) touched, from the
/// timeline. Every tool of one invocation is written with the SAME ts
/// (append_timeline_at), so strict ts equality identifies the invocation.
/// None when no switch is on record - the caller falls back to every tool.
fn last_switch_tools(paths: &Paths) -> Option<Vec<String>> {
    let path = paths.store_dir().join("timeline.jsonl");
    let text = std::fs::read_to_string(path).ok()?;
    let mut events: Vec<(i64, String, String)> = Vec::new();
    for line in text.lines() {
        let Ok(v) = serde_json::from_str::<Value>(line) else {
            continue;
        };
        if !matches!(v["action"].as_str(), Some("use") | Some("restore")) {
            continue;
        }
        if let (Some(ts), Some(tool)) = (v["ts"].as_i64(), v["tool"].as_str()) {
            let inv = v["inv"].as_str().unwrap_or("").to_string();
            events.push((ts, inv, tool.to_string()));
        }
    }
    // Group by the last event's INVOCATION id when it has one - whole-second
    // ts equality collides when two separate invocations run inside one
    // second. Legacy events (no inv) fall back to ts grouping.
    let (last_ts, last_inv) = events
        .iter()
        .map(|(ts, inv, _)| (*ts, inv.clone()))
        .next_back()?;
    let mut tools: Vec<String> = events
        .into_iter()
        .filter(|(ts, inv, _)| {
            if last_inv.is_empty() {
                *ts == last_ts && inv.is_empty()
            } else {
                *inv == last_inv
            }
        })
        .map(|(_, _, tool)| tool)
        .collect();
    tools.sort();
    tools.dedup();
    Some(tools)
}

/// "3m ago" / "2h ago" from a unix-nanos backup stamp.
fn age_line(stamp_nanos: u128) -> String {
    let now = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_nanos())
        .unwrap_or(0);
    let secs = (now.saturating_sub(stamp_nanos) / 1_000_000_000) as u64;
    if secs < 60 {
        format!("{secs}s ago")
    } else if secs < 3600 {
        format!("{}m ago", secs / 60)
    } else if secs < 86400 {
        format!("{}h ago", secs / 3600)
    } else {
        format!("{}d ago", secs / 86400)
    }
}

/// A saved snapshot ages out even before its access token expires, because the
/// refresh token can rotate; flag one that has not been refreshed in a while.
const STALE_DAYS: i64 = 30;

/// Identity extracted from a STORED snapshot (no live read, no secrets):
/// (email, tier, marker). marker is "stale" (a login snapshot older than
/// STALE_DAYS whose refresh token may
/// have rotated, so re-run `add --update`), else None.
fn profile_detail(
    store: &Store,
    name: &str,
    tool: &str,
) -> Option<(Option<String>, Option<String>, Option<&'static str>)> {
    let snap = store.load(name, tool).ok()??;
    // From here the snapshot EXISTS: a missing part or unparseable blob is an
    // UNREADABLE snapshot (surfaced as a marker), not silently "no data" - a
    // corrupt profile must be visible in `ls` before `use` trips over it.
    let unreadable = (None, None, Some("unreadable"));
    match tool {
        "claude-code" => {
            let (Some(cred_part), Some(oauth_part)) =
                (snap.part("credentials"), snap.part("oauth_account"))
            else {
                return Some(unreadable);
            };
            let (Ok(creds), Ok(oauth)) = (
                serde_json::from_slice::<Value>(cred_part.expose()),
                serde_json::from_slice::<Value>(oauth_part.expose()),
            ) else {
                return Some(unreadable);
            };
            // Claude access tokens live ~1h and Claude Code refreshes them
            // silently with the refresh token, so "expired" the moment the
            // access token lapses is pure noise (this was the constant
            // "expired" spam). Only flag a snapshot whose access token is
            // ANCIENT (>30 days) - by then the refresh token itself may be
            // revoked. Same rule as Codex / Gemini / Antigravity.
            let marker = creds["claudeAiOauth"]["expiresAt"]
                .as_i64()
                .filter(|ms| now_ms() - ms > STALE_DAYS * 86400 * 1000)
                .map(|_| "stale");
            Some((
                oauth["emailAddress"].as_str().map(String::from),
                creds["claudeAiOauth"]["subscriptionType"]
                    .as_str()
                    .map(String::from),
                marker,
            ))
        }
        "codex" => {
            let Some(auth_part) = snap.part("auth") else {
                return Some(unreadable);
            };
            let Ok(auth) = serde_json::from_slice::<Value>(auth_part.expose()) else {
                return Some(unreadable);
            };
            let email = crate::adapters::codex::decode_email_from_id_token(
                auth["tokens"]["id_token"].as_str(),
            );
            let marker = auth["last_refresh"]
                .as_str()
                .and_then(crate::session_link::rfc3339_to_secs)
                .filter(|&secs| now_ms() / 1000 - secs > STALE_DAYS * 86400)
                .map(|_| "stale");
            Some((email, auth["auth_mode"].as_str().map(String::from), marker))
        }
        "gemini" => {
            let oauth: Value = serde_json::from_slice(snap.part("oauth")?.expose()).ok()?;
            let email = snap
                .part("accounts")
                .and_then(|a| serde_json::from_slice::<Value>(a.expose()).ok())
                .and_then(|v| v["active"].as_str().map(String::from))
                .or_else(|| crate::adapters::gemini_jwt_claim(oauth["id_token"].as_str(), "email"));
            // Gemini access tokens live ~1h and the CLI refreshes them
            // silently, so "expired right now" is noise. Meaningful signal:
            // a snapshot whose expiry is ANCIENT was refreshed long ago and
            // its refresh token may be revoked - same idea as codex's stale.
            let marker = oauth["expiry_date"]
                .as_i64()
                .filter(|ms| now_ms() - ms > STALE_DAYS * 86400 * 1000)
                .map(|_| "stale");
            Some((email, None, marker))
        }
        "antigravity" => {
            let v: Value = serde_json::from_slice(snap.part("token")?.expose()).ok()?;
            // A snapshot whose token expiry is ancient was refreshed long ago;
            // its refresh token may be revoked - same idea as codex's stale.
            let marker = v["token"]["expiry"]
                .as_str()
                .and_then(crate::session_link::rfc3339_to_secs)
                .filter(|&secs| now_ms() / 1000 - secs > STALE_DAYS * 86400)
                .map(|_| "stale");
            Some((None, v["auth_method"].as_str().map(String::from), marker))
        }
        _ => None,
    }
}

/// Summarize a profile across ALL its tools (not just the first): a marker if
/// ANY tool is stale/expired, and the first non-empty email/tier. `p.tools` is
/// alphabetical, so inspecting only the first would always be "claude-code" and
/// hide Codex entirely.
fn profile_summary(
    store: &Store,
    name: &str,
    tools: &[String],
) -> (Option<String>, Option<String>, Option<&'static str>) {
    let mut email = None;
    let mut tier = None;
    let mut marker = None;
    // Adapter order (Claude first), NOT the store's alphabetical order:
    // antigravity sorts first alphabetically and its auth_method ("consumer")
    // would mask claude's real plan tier ("max") on multi-tool profiles.
    for a in adapters::all() {
        let t = a.name();
        if !tools.iter().any(|x| x == t) {
            continue;
        }
        if let Some((e, ti, m)) = profile_detail(store, name, t) {
            email = email.or(e);
            tier = tier.or(ti);
            marker = marker.or(m);
        }
    }
    (email, tier, marker)
}

/// Which profile is the LIVE account for each tool (from live identity, A2).
/// A mixed state (claude on profile X, codex on profile Y) is representable.
pub(crate) fn active_by_tool(store: &Store, paths: &Paths) -> Vec<(&'static str, String)> {
    adapters::all()
        .iter()
        .filter_map(|a| {
            a.identity(paths)
                .ok()
                .flatten()
                .and_then(|id| matched_profile_name(store, a.name(), &id.account_id))
                .map(|name| (a.name(), name))
        })
        .collect()
}

/// Pad-or-truncate to `w` DISPLAY columns (CJK chars occupy two; counting
/// chars would shear the table); a longer value ends in one '…'.
fn fit(s: &str, w: usize) -> String {
    use unicode_width::{UnicodeWidthChar, UnicodeWidthStr};
    let n = UnicodeWidthStr::width(s);
    if n <= w {
        let mut out = String::from(s);
        out.extend(std::iter::repeat_n(' ', w - n));
        return out;
    }
    let mut out = String::new();
    let mut used = 0usize;
    for c in s.chars() {
        let cw = UnicodeWidthChar::width(c).unwrap_or(0);
        if used + cw > w.saturating_sub(1) {
            break;
        }
        out.push(c);
        used += cw;
    }
    out.push('…');
    // Pad if the truncation landed a column short (a wide char didn't fit).
    out.extend(std::iter::repeat_n(' ', w.saturating_sub(used + 1)));
    out
}

/// The account column: email if known, else just the tier (never a stray
/// leading-space " [tier]").
fn identity_column(email: Option<String>, tier: Option<String>) -> String {
    match (email.filter(|e| !e.is_empty()), tier) {
        (Some(e), Some(t)) => format!("{e} [{t}]"),
        (Some(e), None) => e,
        (None, Some(t)) => format!("[{t}]"),
        (None, None) => String::new(),
    }
}

pub fn ls(paths: &Paths, json: bool, names: bool) -> Result<i32> {
    let store = Store::open(paths)?;
    if names {
        // Bare names, one per line (store.list() is sorted) - for scripts and
        // the profile-name tab-completion snippet in the docs.
        for p in store.list() {
            println!("{}", p.name);
        }
        return Ok(0);
    }
    let active = active_by_tool(&store, paths);
    let active_tools_for = |name: &str| -> Vec<&'static str> {
        active
            .iter()
            .filter(|(_, n)| n == name)
            .map(|(t, _)| *t)
            .collect()
    };

    let profiles = store.list();
    if json {
        let rows: Vec<Value> = profiles
            .iter()
            .map(|p| {
                let (email, tier, marker) = profile_summary(&store, &p.name, &p.tools);
                serde_json::json!({
                    "name": p.name,
                    "tools": p.tools,
                    "active_tools": active_tools_for(&p.name),
                    "email": email,
                    "tier": tier,
                    "warning": marker,
                })
            })
            .collect();
        println!("{}", serde_json::to_string(&rows)?);
        return Ok(0);
    }
    if profiles.is_empty() {
        println!("No accounts saved yet.");
        println!("  guided setup:  swapdex setup");
        println!("  or add one:    swapdex login <name>");
        return Ok(0);
    }
    // Two-pass so columns fit the actual content (with a sane cap).
    struct Row {
        name: String,
        ident: String,
        tools: String,
        warn: Option<&'static str>,
        active: bool,
    }
    let rows: Vec<Row> = profiles
        .iter()
        .map(|p| {
            let (email, tier, marker) = profile_summary(&store, &p.name, &p.tools);
            let at = active_tools_for(&p.name);
            let tools = p
                .tools
                .iter()
                .map(|t| {
                    if at.contains(&t.as_str()) {
                        format!("{t}*")
                    } else {
                        t.clone()
                    }
                })
                .collect::<Vec<_>>()
                .join(", ");
            Row {
                name: p.name.clone(),
                ident: identity_column(email, tier),
                tools,
                warn: marker,
                active: !at.is_empty(),
            }
        })
        .collect();
    // Widths in CHARS (not bytes - non-ASCII names must not shear the table),
    // and content longer than the cap is truncated with '…' so one long row
    // cannot un-align every other. Full values stay available in `ls --json`.
    let name_w = rows
        .iter()
        .map(|r| unicode_width::UnicodeWidthStr::width(r.name.as_str()))
        .max()
        .unwrap_or(4)
        .clamp(4, 24);
    let ident_w = rows
        .iter()
        .map(|r| unicode_width::UnicodeWidthStr::width(r.ident.as_str()))
        .max()
        .unwrap_or(0)
        .clamp(0, 40);
    let mut saw_refreshable = false;
    let mut saw_unreadable = false;
    for r in &rows {
        let mark = if r.active { "* " } else { "  " };
        let warn = r.warn.map(|m| format!("  ({m})")).unwrap_or_default();
        saw_unreadable |= r.warn == Some("unreadable");
        saw_refreshable |= matches!(r.warn, Some("expired") | Some("stale"));
        println!(
            "{mark}{} {} [{}]{warn}",
            fit(&r.name, name_w),
            fit(&r.ident, ident_w),
            r.tools
        );
    }
    if saw_refreshable {
        println!(
            "  (expired/stale: re-run `swapdex add --update <name>` while logged in to refresh)"
        );
    }
    if saw_unreadable {
        println!(
            "  (unreadable: the saved snapshot is corrupt - log in to that account and \
             re-save it with `swapdex add <name> --update`)"
        );
    }
    if active
        .iter()
        .map(|(_, n)| n)
        .collect::<std::collections::HashSet<_>>()
        .len()
        > 1
    {
        println!("  (* marks the active account per tool)");
    }
    Ok(0)
}

/// One compact line for shell prompts / statuslines: `claude:work codex:personal`.
/// The value per tool is the matched profile name, falling back to the email.
/// None when nothing is logged in (or nothing is readable).
pub fn short_line(paths: &Paths) -> Option<String> {
    let store = Store::open(paths).ok()?;
    let parts: Vec<String> = adapters::all()
        .iter()
        .filter_map(|a| {
            let id = a.identity(paths).ok().flatten()?;
            let tool = match a.name() {
                "claude-code" => "claude",
                t => t,
            };
            let who = matched_profile_name(&store, a.name(), &id.account_id)
                .or(id.email)
                .unwrap_or_else(|| "?".into());
            Some(format!("{tool}:{who}"))
        })
        .collect();
    if parts.is_empty() {
        None
    } else {
        Some(parts.join(" "))
    }
}

pub fn status(paths: &Paths, json: bool, short: bool) -> Result<i32> {
    if short {
        println!("{}", short_line(paths).unwrap_or_default());
        return Ok(0);
    }
    let store = Store::open(paths)?;
    if json {
        let rows: Vec<Value> = adapters::all()
            .iter()
            .map(|adapter| {
                let tool = adapter.name();
                // Stable shape: every key present on every row, null when
                // unknown, so `jq .[].email` never needs guards.
                match adapter.identity(paths) {
                    Err(_) => serde_json::json!({
                        "tool": tool, "logged_in": false, "unreadable": true,
                        "email": null, "tier": null, "profile": null, "expired": null,
                    }),
                    Ok(None) => serde_json::json!({
                        "tool": tool, "logged_in": false, "unreadable": false,
                        "email": null, "tier": null, "profile": null, "expired": null,
                    }),
                    Ok(Some(id)) => serde_json::json!({
                        "tool": tool,
                        "logged_in": true,
                        "unreadable": false,
                        "email": id.email,
                        "tier": id.tier,
                        "profile": matched_profile_name(&store, tool, &id.account_id),
                        "expired": id.expires_at.map(|ms| ms < now_ms()),
                    }),
                }
            })
            .collect();
        println!("{}", serde_json::to_string(&rows)?);
        return Ok(0);
    }
    for adapter in adapters::all() {
        let tool = adapter.name();
        match adapter.identity(paths) {
            Err(_) => println!(
                "{tool}: login file unreadable - `swapdex use <profile>` can replace it \
                 (or log in again in the tool)"
            ),
            Ok(None) => match macos_keychain_note(paths, tool) {
                Some(note) => println!("{tool}: not manageable - {note}"),
                None => println!("{tool}: not logged in"),
            },
            Ok(Some(id)) => {
                let name = matched_profile_name(&store, tool, &id.account_id);
                let saved = match &name {
                    Some(n) => format!("profile '{n}'"),
                    None => "not saved - run `swapdex add <name>`".to_string(),
                };
                let exp = expiry_note(id.expires_at);
                println!("{tool}: {} ({saved}){exp}", identity_line(&id));
            }
        }
    }
    // A1: warn about the world-readable .claude.json (holds account PII).
    if let Ok(meta) = std::fs::metadata(paths.claude_config_json()) {
        use std::os::unix::fs::PermissionsExt;
        if meta.permissions().mode() & 0o077 != 0 {
            println!(
                "note: {} is group/world-readable (holds your account email/org); `chmod 600` it",
                crate::util::redact_path(&paths.claude_config_json().display().to_string())
            );
        }
    }
    // Ecosystem: best-effort session count grouped by account (session_link).
    if let Some(line) = crate::session_link::status_line(paths) {
        println!("{line}");
    }
    Ok(0)
}

/// `proxy` - run proxy mode in the foreground. Claude Code pointed at it
/// (`ANTHROPIC_BASE_URL`) gets its account chosen per request, so a RUNNING
/// conversation can change accounts without a restart or a resume.
#[allow(clippy::too_many_arguments)]
pub fn proxy(
    paths: &Paths,
    port: u16,
    account: Option<String>,
    sel: Option<ToolSel>,
    auto: bool,
    no_auto: bool,
    ensure: bool,
    threshold: Option<f64>,
) -> Result<i32> {
    if ensure {
        return proxy_ensure(paths, port, slot_tool(sel));
    }
    // Precedence: an explicit flag for this run, else the saved setting.
    let auto = if auto {
        true
    } else if no_auto {
        false
    } else {
        crate::settings::load(paths).auto()
    };
    // A threshold means "step off before the wall", which needs one usage read per
    // account; opt-in, so the proxy originates no traffic unless asked. The flag
    // is for one run; the setting is what the shim-started proxy sees.
    let cfg = crate::settings::load(paths);
    let threshold = threshold
        .map(|t| t.clamp(0.05, 1.0))
        .or_else(|| cfg.threshold());
    let opts = crate::proxy::Opts {
        port,
        account,
        tool: slot_tool(sel).to_string(),
        auto,
        threshold,
    };
    crate::proxy::serve(paths, &opts)?;
    Ok(0)
}

/// The port `swapdex proxy` listens on unless told otherwise. Codex's proxy
/// takes the next one, so both tools' shims can start their own.
pub const DEFAULT_PROXY_PORT: u16 = 8787;

/// `proxy --ensure` - print the port of a live proxy, starting one in the
/// background if there is none. This is what lets a plain `claude` (through the
/// shim) get proxy mode without the user running or remembering anything. Exits
/// non-zero and prints nothing when a proxy cannot be had, so the shim simply
/// runs Claude directly.
fn proxy_ensure(paths: &Paths, port: u16, tool: &str) -> Result<i32> {
    // Two proxies cannot share a port. Codex takes the next one, so the shim for
    // either tool can start its own without asking the user to pick.
    let mut port = if tool == "codex" && port == DEFAULT_PROXY_PORT {
        port + 1
    } else {
        port
    };
    if let Some((pid, running, build)) = crate::proxy::running_proxy_for(paths, tool) {
        if build == crate::proxy::build_id() {
            println!("{running}");
            return Ok(0);
        }
        // A proxy from an older build is still answering: updating swapdex does
        // not update what is already running, so a fix can be installed, verified,
        // and still not be what serves the next request. Replace it on the SAME
        // port, because sessions already point at that port and would otherwise
        // be left talking to nothing.
        unsafe { libc::kill(pid, libc::SIGTERM) };
        for _ in 0..40 {
            if crate::proxy::running_proxy_for(paths, tool).is_none() {
                break;
            }
            std::thread::sleep(std::time::Duration::from_millis(50));
        }
        port = running;
    }
    // Proxy mode is only useful with slot accounts; without one there is nothing
    // to serve and starting a proxy would just add a moving part.
    if crate::slots::Slots::open_for(paths, tool)
        .map(|s| s.list().is_empty())
        .unwrap_or(true)
    {
        return Ok(1);
    }
    let Ok(exe) = std::env::current_exe() else {
        return Ok(1);
    };
    let mut cmd = std::process::Command::new(exe);
    cmd.arg("proxy")
        .arg("--port")
        .arg(port.to_string())
        .arg("--tool")
        .arg(tool)
        .stdin(std::process::Stdio::null())
        .stdout(std::process::Stdio::null())
        .stderr(std::process::Stdio::null());
    // Detach: the proxy must outlive this short-lived helper and the shell that
    // started it, and must never take the terminal (it would fight `claude` for
    // stdin) or die with the session.
    #[cfg(unix)]
    {
        use std::os::unix::process::CommandExt;
        unsafe {
            cmd.pre_exec(|| {
                libc::setsid();
                Ok(())
            });
        }
    }
    if cmd.spawn().is_err() {
        return Ok(1);
    }
    // Wait briefly for it to announce itself; a proxy that cannot bind must not
    // hang the launch of Claude.
    for _ in 0..40 {
        if let Some((_, p, _)) = crate::proxy::running_proxy_for(paths, tool) {
            println!("{p}");
            return Ok(0);
        }
        std::thread::sleep(std::time::Duration::from_millis(50));
    }
    Ok(1)
}

/// The instructions both assistants get. Kept deliberately small: run one swapdex
/// command and report what happened, so switching accounts does not mean leaving
/// the conversation for another terminal.
/// The switcher's instructions, written for ONE tool. A switcher offered inside
/// Claude that lists Codex accounts (or switches one) is answering a question
/// nobody asked - each assistant should only ever see, and only ever move, its
/// own accounts.
fn slash_body(tool: &str, host: &str) -> String {
    format!(
        "**If arguments were given**, run `swapdex use $ARGUMENTS --tool {tool}`, then \
         report the result in one line.\n\
         \n\
         **If not**, do not make the user recall account names:\n\
         \n\
         1. Run `swapdex ls` and keep ONLY the accounts tagged `{tool}` - this is {host}, \
         so accounts for other tools are not offered and never switched.\n\
         2. Ask the user to choose one with the AskUserQuestion tool, so they can pick with \
         the arrow keys. One option per account, labelled with the account name, with its \
         email and current state as the description. Put the active one first and say it is \
         active. If there are more accounts than the tool allows, offer the ones not \
         currently active and let the rest come from free text.\n\
         3. Run `swapdex serve <the account they chose> --tool {tool}` and report the \
         result in one line. `serve` is the right verb here: it changes which account \
         pays for the turns and leaves this conversation exactly where it is. `use` \
         would move the store the conversation lives in, which is never what someone \
         asking mid-conversation means.\n\
         \n\
         Report what swapdex printed and nothing beyond it. Its last line says whether \
         anything running actually moved: with a proxy the next turn of THIS session is \
         served by the new account, and without one the change reaches only the next \
         launch while this conversation keeps the account it began with. Do not promise \
         the stronger of the two - a switch announced as live when it was not is worse \
         than no switch, because the work continues on the account the user thinks they \
         left. If the output says the shim is not taking effect, say so and stop.\n"
    )
}

/// `slash` - install the Claude Code slash command, so an account switch can be
/// typed into the conversation instead of another terminal.
/// The Claude Code form: a command file with the frontmatter its picker reads.
fn claude_command_body() -> String {
    format!(
        "---\ndescription: Switch the Claude account serving this session (swapdex)\n---\n\n{}",
        slash_body("claude-code", "Claude Code")
    )
}

/// The Codex form: a skill, with the frontmatter Codex reads.
fn codex_skill_body() -> String {
    format!(
        "---\nname: swap\ndescription: >-\n  Switch the Codex account serving this session \
         (swapdex). Use when the user asks to change accounts, says an account is out of \
         quota, or types /swap.\n---\n\n{}",
        slash_body("codex", "Codex")
    )
}

/// `threshold [<fraction>|off]` - read or set the point at which the proxy steps
/// off an account. A setting rather than a flag because the proxy the shim starts
/// takes no flags, and that is the one doing the work day to day.
pub fn threshold(paths: &Paths, value: Option<&str>) -> Result<i32> {
    let mut cfg = crate::settings::load(paths);
    let Some(value) = value else {
        match cfg.threshold() {
            Some(t) => println!(
                "stepping off an account at {:.0}% used",
                (t * 100.0).round()
            ),
            None => println!(
                "no threshold - the proxy waits for an account to refuse a turn \
                 (`swapdex threshold 0.9` steps off earlier)"
            ),
        }
        return Ok(0);
    };
    let v = value.trim();
    if v.eq_ignore_ascii_case("off") || v.eq_ignore_ascii_case("none") {
        cfg.proxy_threshold = None;
        crate::settings::save(paths, &cfg)?;
        println!("threshold off - the proxy waits for a refusal before moving");
        return Ok(0);
    }
    // Accept "0.9" and "90%"/"90" alike: both are how people say this.
    let parsed =
        v.trim_end_matches('%')
            .parse::<f64>()
            .ok()
            .map(|n| if n > 1.0 { n / 100.0 } else { n });
    let Some(t) = parsed.filter(|t| *t > 0.0 && *t <= 1.0) else {
        eprintln!(
            "swapdex: expected a fraction like 0.9, a percentage like 90%, or `off` - got '{v}'"
        );
        return Ok(2);
    };
    cfg.proxy_threshold = Some(t);
    crate::settings::save(paths, &cfg)?;
    let eff = cfg.threshold().unwrap_or(t);
    println!(
        "stepping off an account at {:.0}% used - it hands the session on before \
         being refused",
        (eff * 100.0).round()
    );
    Ok(0)
}

/// `slash` - install the in-conversation switcher for both assistants, so an
/// account change can be typed where you already are rather than in another
/// terminal. Claude Code reads `~/.claude/commands`, Codex reads `~/.codex/skills`.
pub fn install_slash(paths: &Paths) -> Result<i32> {
    let _ = paths; // these dirs belong to the assistants, not swapdex's store
    let Some(home) = dirs::home_dir() else {
        eprintln!("swapdex: cannot find your home directory");
        return Ok(1);
    };
    let mut installed = 0;

    let claude_dir = home.join(".claude").join("commands");
    match std::fs::create_dir_all(&claude_dir)
        .and_then(|()| std::fs::write(claude_dir.join("swap.md"), claude_command_body()))
    {
        Ok(()) => {
            println!(
                "Claude Code: /swap  ({})",
                crate::util::redact_path(&claude_dir.join("swap.md").display().to_string())
            );
            installed += 1;
        }
        Err(e) => eprintln!("swapdex: could not install the Claude command: {e}"),
    }

    let codex_dir = home.join(".codex").join("skills").join("swap");
    match std::fs::create_dir_all(&codex_dir)
        .and_then(|()| std::fs::write(codex_dir.join("SKILL.md"), codex_skill_body()))
    {
        Ok(()) => {
            println!(
                "Codex:       /swap  ({})",
                crate::util::redact_path(&codex_dir.join("SKILL.md").display().to_string())
            );
            installed += 1;
        }
        Err(e) => eprintln!("swapdex: could not install the Codex skill: {e}"),
    }

    if installed == 0 {
        return Ok(1);
    }
    println!("  type `/swap` to pick an account, or `/swap <name>` to go straight there");
    println!("  (a plain `!swapdex use <account>` works too, without installing anything)");
    Ok(0)
}

/// `auto [on|off]` - read or set auto-continue: whether proxy mode may hand a
/// spent session to another account by itself. Kept as its own setting rather
/// than a flag you must remember, since the whole point is not having to think
/// about accounts.
pub fn auto(paths: &Paths, state: Option<&str>) -> Result<i32> {
    let mut s = crate::settings::load(paths);
    let Some(state) = state else {
        println!("auto-continue is {}", if s.auto() { "on" } else { "off" });
        return Ok(0);
    };
    let on = match state.trim().to_ascii_lowercase().as_str() {
        "on" | "true" | "yes" | "1" => true,
        "off" | "false" | "no" | "0" => false,
        other => {
            eprintln!("swapdex: expected `on` or `off`, got '{other}'");
            return Ok(2);
        }
    };
    s.proxy_auto = Some(on);
    crate::settings::save(paths, &s)?;
    println!(
        "auto-continue {}{}",
        if on { "on" } else { "off" },
        if on {
            " - a spent account hands the running session to another one"
        } else {
            " - the proxy stays on the account you chose"
        }
    );
    Ok(0)
}

/// `ui` - a numbered interactive picker: see every profile (active marked from
/// the live login), type a number, switch. Plain Enter cancels. Deliberately
/// stdin-only (no raw-mode/TUI crate pulls a socket library into the graph),
/// and the switch itself goes through the exact same `use` path - a human
/// picking a number IS the explicit `swapdex use <name>`.
pub fn ui(paths: &Paths) -> Result<i32> {
    use std::io::IsTerminal;
    let real_tty = std::io::stdin().is_terminal() && std::io::stdout().is_terminal();
    let tty = real_tty || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
    if !tty {
        eprintln!("swapdex: `ui` is interactive and needs a terminal (try `swapdex use <name>`)");
        return Ok(2);
    }
    // A real terminal gets the full-screen picker; the pipe-driven path (tests,
    // SWAPDEX_ASSUME_TTY) keeps the plain numbered prompt below. TERM=dumb /
    // empty (Emacs shell, some CI) cannot render ANSI - crossterm never checks
    // TERM, so we do.
    let dumb = std::env::var("TERM")
        .map(|t| t.is_empty() || t == "dumb")
        .unwrap_or(true);
    if real_tty && !dumb {
        return ui_tui(paths);
    }
    let store = Store::open(paths)?;
    let profiles = store.list();
    if profiles.is_empty() {
        println!("No accounts saved yet.");
        println!("  guided setup:  swapdex setup");
        return Ok(0);
    }
    let active = active_by_tool(&store, paths);
    let color = crate::util::color_enabled();
    println!();
    for (i, p) in profiles.iter().enumerate() {
        let (email, tier, marker) = profile_summary(&store, &p.name, &p.tools);
        let at: Vec<&str> = active
            .iter()
            .filter(|(_, n)| n == &p.name)
            .map(|(t, _)| *t)
            .collect();
        let star = if at.is_empty() { "  " } else { "* " };
        let ident = identity_column(email, tier);
        let warn = marker.map(|m| format!("  ({m})")).unwrap_or_default();
        let line = format!(
            "  {}) {star}{} {} [{}]{warn}",
            i + 1,
            fit(&p.name, 16),
            fit(&ident, 32),
            p.tools.join(", ")
        );
        if color && !at.is_empty() {
            println!("\x1b[1m{line}\x1b[0m");
        } else {
            println!("{line}");
        }
    }
    if let Some(line) = crate::session_link::status_line(paths) {
        println!("\n  {line}");
    }
    println!();
    loop {
        let Some(ans) = prompt(
            &format!("switch to [1-{}] (Enter cancels): ", profiles.len()),
            "",
        ) else {
            println!("cancelled - nothing switched.");
            return Ok(0);
        };
        if ans.is_empty() || ans.eq_ignore_ascii_case("q") {
            println!("cancelled - nothing switched.");
            return Ok(0);
        }
        match ans.parse::<usize>() {
            Ok(n) if (1..=profiles.len()).contains(&n) => {
                let name = profiles[n - 1].name.clone();
                println!();
                // Timeline state BEFORE the switch below appends its own
                // event - otherwise the first-ever switch would skip the
                // fallback written exactly for it.
                let first_time = crate::session_link::read_timeline(paths).is_empty();
                let rc = use_account(paths, &name, None, false, false)?;
                if rc == 0 {
                    ui_session_hints(paths, &name, first_time)?;
                }
                return Ok(rc);
            }
            _ => {
                println!(
                    "  pick a number between 1 and {} (Enter cancels)",
                    profiles.len()
                );
            }
        }
    }
}

/// One session row for the post-switch menu, whatever the source.
pub(crate) enum MenuSession {
    Wiki(crate::session_link::RecentSession),
    Native(crate::native_sessions::NativeSession),
}

impl MenuSession {
    pub(crate) fn describe(&self) -> (String, i64, String, String) {
        match self {
            MenuSession::Wiki(s) => (
                s.id.chars().take(6).collect(),
                s.started,
                s.tool.clone(),
                s.title.clone(),
            ),
            MenuSession::Native(s) => (
                s.id.chars().take(6).collect(),
                s.started,
                s.tool.to_string(),
                s.title.clone(),
            ),
        }
    }
}

/// Recent sessions for the just-switched profile - sessionwiki when present
/// (cross-tool, richer), the tools' own on-disk stores otherwise. Never
/// requires sessionwiki (real-use feedback).
pub(crate) fn recent_menu_sessions(
    paths: &Paths,
    name: &str,
    first_time: bool,
    n: usize,
) -> (Vec<MenuSession>, String) {
    // sessionwiki path (attributed, then honest any-account fallback).
    if let Some(r) = crate::session_link::recent_sessions_for(paths, name, n) {
        if !r.is_empty() {
            return (
                r.into_iter().map(MenuSession::Wiki).collect(),
                format!("recent sessions on '{name}' (sessionwiki):"),
            );
        }
        // No sessions attributed to this account: still show recent ones so
        // the menu is useful (you can resume any). Attribution is best-effort;
        // an empty menu is worse than a broad one.
        if let Some(any) = crate::session_link::recent_sessions_any(n) {
            if !any.is_empty() {
                let label = if first_time {
                    "recent sessions (any account - attribution starts with your first switch):"
                } else {
                    "recent sessions (any account):"
                };
                return (
                    any.into_iter().map(MenuSession::Wiki).collect(),
                    label.to_string(),
                );
            }
        }
        // sessionwiki is present but returned NOTHING (installed yet never
        // `sessionwiki sync`ed, or a genuinely empty index). Do NOT stop here -
        // fall through to the native reader so the real on-disk sessions still
        // show, instead of a blank menu that hides sessions the user can see.
    }
    // Native path: straight from ~/.claude and ~/.codex.
    let events = crate::session_link::read_timeline(paths);
    let all = crate::native_sessions::recent(paths, n * 4);
    let mine: Vec<crate::native_sessions::NativeSession> = all
        .iter()
        .filter(|s| {
            crate::session_link::attribute(&events, s.tool, s.started).as_deref() == Some(name)
        })
        .map(|s| crate::native_sessions::NativeSession {
            tool: s.tool,
            id: s.id.clone(),
            title: s.title.clone(),
            cwd: s.cwd.clone(),
            started: s.started,
        })
        .take(n)
        .collect();
    if !mine.is_empty() {
        return (
            mine.into_iter().map(MenuSession::Native).collect(),
            format!("recent sessions on '{name}':"),
        );
    }
    let any: Vec<MenuSession> = all.into_iter().take(n).map(MenuSession::Native).collect();
    if !any.is_empty() {
        let label = if first_time {
            "recent sessions (any account - attribution starts with your first switch):"
        } else {
            "recent sessions (any account):"
        };
        return (any, label.to_string());
    }
    (Vec::new(), String::new())
}

/// Exec the resume for a picked menu session (never returns on success).
fn exec_menu_resume(s: &MenuSession) -> anyhow::Error {
    match s {
        MenuSession::Wiki(w) => {
            println!("opening session {} via sessionwiki...", w.id);
            exec_sessionwiki_resume(&w.id)
        }
        MenuSession::Native(nat) => {
            println!("resuming {} session {}...", pretty_tool(nat.tool), nat.id);
            crate::native_sessions::exec_resume(nat)
        }
    }
}

/// Post-switch continuity: recent sessions of the picked account + the
/// numbered resume handoff. Shared by the numbered picker and the TUI.
fn ui_session_hints(paths: &Paths, name: &str, first_time: bool) -> Result<()> {
    // `first_time` is captured by the CALLER before the switch writes its own
    // timeline event.
    let (recent, label) = recent_menu_sessions(paths, name, first_time, 3);
    // Offer "open a NEW X" only for tools THIS profile actually holds: launching
    // a tool that was NOT switched would open the user's unrelated live account
    // (the plain-picker twin of the TUI's new_conv_for filtering).
    let ptools = profile_tools(paths, name);
    let choices: Vec<(&str, &str, &str)> = [
        ("c", "claude-code", "claude"),
        ("x", "codex", "codex"),
        ("g", "gemini", "gemini"),
        ("a", "antigravity", "agy"),
    ]
    .into_iter()
    .filter(|(_, tool, _)| ptools.iter().any(|t| t == tool))
    .collect();
    let new_hint = if choices.is_empty() {
        String::new()
    } else {
        let keys = choices
            .iter()
            .map(|(k, _, p)| format!("{k} new {p}"))
            .collect::<Vec<_>>()
            .join(", ");
        format!(", {keys}")
    };
    let pick = |ans: &str| -> Option<&'static str> {
        launch_letter(ans).filter(|t| choices.iter().any(|(_, ct, _)| ct == t))
    };
    if !recent.is_empty() {
        println!("\n{label}");
        for (i, s) in recent.iter().enumerate() {
            let (id6, started, tool, title) = s.describe();
            let age = age_line((started.max(0) as u128) * 1_000_000_000);
            let line = format!(
                "  {}) {id6}  {:>7}  {}  {}",
                i + 1,
                age,
                fit(&format!("[{tool}]"), 13),
                fit(&title, 44)
            );
            println!("{}", line.trim_end());
        }
        if let Some(ans) = prompt(
            &format!(
                "open: [1-{}] resume that session{new_hint}, Enter skips: ",
                recent.len()
            ),
            "",
        ) {
            if let Ok(k) = ans.parse::<usize>() {
                if (1..=recent.len()).contains(&k) {
                    return Err(exec_menu_resume(&recent[k - 1]));
                }
            }
            if let Some(tool) = pick(&ans) {
                return Err(launch_in_folder(tool));
            }
        }
    } else if !choices.is_empty() {
        if let Some(ans) = prompt(&format!("open now?{new_hint} (Enter skips): "), "") {
            if let Some(tool) = pick(&ans) {
                return Err(launch_in_folder(tool));
            }
        }
    }
    Ok(())
}

/// The tools a saved profile holds (empty if the profile is unknown).
fn profile_tools(paths: &Paths, name: &str) -> Vec<String> {
    Store::open(paths)
        .ok()
        .and_then(|s| {
            s.list()
                .into_iter()
                .find(|p| p.name == name)
                .map(|p| p.tools)
        })
        .unwrap_or_default()
}

/// Ask for the project folder (conversations are per-directory), then exec.
/// Enter keeps the current directory.
fn launch_in_folder(tool: &str) -> anyhow::Error {
    let dir = prompt("folder to open in [current dir]: ", "")
        .filter(|d| !d.is_empty())
        .map(|d| {
            if d == "~" {
                if let Some(home) = dirs::home_dir() {
                    return home;
                }
            }
            if let Some(rest) = d.strip_prefix("~/") {
                if let Some(home) = dirs::home_dir() {
                    return home.join(rest);
                }
            }
            std::path::PathBuf::from(d)
        });
    if let Some(d) = &dir {
        if !d.is_dir() {
            return anyhow::anyhow!("not a directory: {}", d.display());
        }
    }
    println!("opening {}...", pretty_tool(tool));
    exec_tool(tool, dir.as_deref())
}

/// c/x/g/a -> the tool a post-switch launch letter means.
fn launch_letter(ans: &str) -> Option<&'static str> {
    match ans.to_ascii_lowercase().as_str() {
        "c" => Some("claude-code"),
        "x" => Some("codex"),
        "g" => Some("gemini"),
        "a" => Some("antigravity"),
        _ => None,
    }
}

/// The persistent full-screen ui: one alternate-screen session, everything
/// inside it. Switch/restore run this same binary as a subprocess (output
/// condensed into the status line - no second switching implementation);
/// opening a conversation is the one action that leaves.
fn ui_tui(paths: &Paths) -> Result<i32> {
    struct Ctx<'a> {
        paths: &'a Paths,
        last_sessions: Vec<MenuSession>,
        /// Timeline emptiness CAPTURED BEFORE the last switch wrote its own
        /// events - the only correct "first time" signal (audit).
        pre_switch_first: bool,
    }
    fn run_self(args: &[&str]) -> (bool, String) {
        let exe = match std::env::current_exe() {
            Ok(e) => e,
            Err(e) => return (false, format!("cannot find own binary: {e}")),
        };
        match Command::new(exe)
            .args(args)
            .stdin(std::process::Stdio::null())
            .output()
        {
            Ok(out) => {
                let mut text = String::from_utf8_lossy(&out.stdout).into_owned();
                text.push_str(&String::from_utf8_lossy(&out.stderr));
                let mut msg = text
                    .lines()
                    .filter(|l| !l.trim().is_empty())
                    .collect::<Vec<_>>()
                    .join("  |  ");
                if msg.chars().count() > 160 {
                    msg = msg.chars().take(159).collect::<String>() + "…";
                }
                (out.status.success(), msg)
            }
            Err(e) => (false, format!("failed: {e}")),
        }
    }
    /// Read every account's usage. A free function so the dashboard can run it
    /// on a thread: doing it on the loop froze the screen for seconds.
    fn read_quota_usage(paths: &Paths) -> Vec<(String, crate::tui::Usage)> {
        let Ok(exe) = std::env::current_exe() else {
            return Vec::new();
        };
        let Ok(out) = Command::new(exe)
            .arg("quota")
            .arg("--json")
            .stdin(std::process::Stdio::null())
            .output()
        else {
            return Vec::new();
        };
        let Ok(v) = serde_json::from_slice::<serde_json::Value>(&out.stdout) else {
            return Vec::new();
        };
        // Accept an array of account objects or {"accounts": [...]}.
        let arr = v
            .as_array()
            .cloned()
            .or_else(|| v.get("accounts").and_then(|a| a.as_array()).cloned())
            .unwrap_or_default();
        let mut claude: Vec<(String, crate::tui::Usage)> = arr
            .iter()
            .filter_map(|acc| {
                // `name` may carry an " (active)" marker; strip it to match Row.name.
                let name = acc
                    .get("name")?
                    .as_str()?
                    .trim_end_matches(" (active)")
                    .to_string();
                let win = |key: &str| -> (Option<f64>, Option<i64>) {
                    let w = acc.get(key);
                    (
                        w.and_then(|w| w.get("used_pct")).and_then(|v| v.as_f64()),
                        w.and_then(|w| w.get("resets_at")).and_then(|v| v.as_i64()),
                    )
                };
                let (five_h, five_h_reset) = win("five_hour");
                let (seven_d, seven_d_reset) = win("seven_day");
                // No numbers is still worth a row: empty tracks alone cannot
                // say whether the account was never asked, could not answer,
                // or has nothing left, and that ambiguity is exactly what
                // makes a healthy account look broken. Carry the reason.
                let note = match acc.get("status").and_then(|s| s.as_str()) {
                    Some("ok") | None => None,
                    Some("throttled") => Some("endpoint busy - retrying".to_string()),
                    Some("expired") => Some("login expired".to_string()),
                    Some("offline") => acc
                        .get("detail")
                        .and_then(|d| d.as_str())
                        // The long-form fix belongs in `swapdex quota`; the
                        // row has one column, so keep the first clause.
                        .map(|d| d.split(" - ").next().unwrap_or(d).to_string()),
                    Some(other) => Some(other.to_string()),
                };
                if five_h.is_none() && seven_d.is_none() && note.is_none() {
                    return None;
                }
                Some((
                    name,
                    crate::tui::Usage {
                        five_h,
                        five_h_reset,
                        seven_d,
                        seven_d_reset,
                        // A live read has no age to disclose.
                        observed_at: None,
                        note,
                    },
                ))
            })
            .collect();
        // Fill the gaps from what was read before. The usage endpoint
        // rate-limits when several accounts are asked in a row, and an account
        // that could not be read this minute is not an account with no quota -
        // blanking it looks exactly like a broken one. The reading is recorded
        // by `quota` itself, where it is taken; a run that got nothing has
        // nothing to record and must not overwrite what it failed to refresh.
        for (name, e) in crate::quota_cache::load(paths) {
            // An account read THIS refresh keeps its live numbers. One that
            // only carries a reason - busy, expired - takes the remembered
            // numbers instead: an old figure beats an empty track, as long as
            // it is shown with its age.
            if let Some((_, u)) = claude
                .iter_mut()
                .find(|(n, u)| *n == name && u.five_h.is_none() && u.seven_d.is_none())
            {
                u.five_h = e.five_h;
                u.five_h_reset = e.five_h_reset;
                u.seven_d = e.seven_d;
                u.seven_d_reset = e.seven_d_reset;
                u.observed_at = Some(e.at);
                // The age now carries the caveat. Keeping "endpoint busy"
                // beside numbers that are right there reads as a complaint
                // about figures the user can already see.
                u.note = None;
                continue;
            }
            if claude.iter().any(|(n, _)| *n == name) {
                continue;
            }
            claude.push((
                name,
                crate::tui::Usage {
                    five_h: e.five_h,
                    five_h_reset: e.five_h_reset,
                    seven_d: e.seven_d,
                    seven_d_reset: e.seven_d_reset,
                    // Shown with its age, so a remembered number is never
                    // mistaken for a live one.
                    observed_at: Some(e.at),
                    note: None,
                },
            ));
        }
        // Codex reports its own windows into its session transcripts, so its
        // usage costs a local file read - no network, unlike Claude's. The
        // transcript does not name the account, so it belongs to whichever
        // Codex account is active; the others get no bar rather than a guess.
        if let Ok(store) = Store::open(paths) {
            let active = active_by_tool(&store, paths)
                .into_iter()
                .find(|(tool, _)| *tool == "codex")
                .map(|(_, name)| name);
            if let Some(name) = active {
                if let Some(l) = crate::codex_limits::latest(paths, now_secs(), 7 * 86_400) {
                    let mut u = crate::tui::Usage {
                        observed_at: l.observed_at,
                        ..Default::default()
                    };
                    // Place each window by its LENGTH, not by the API's
                    // primary/secondary labels: a ~5h window is the session
                    // one, anything longer is the weekly column.
                    for w in [l.short, l.long].into_iter().flatten() {
                        if w.window_minutes <= 600 {
                            u.five_h = Some(w.used_pct);
                            u.five_h_reset = w.resets_at;
                        } else {
                            u.seven_d = Some(w.used_pct);
                            u.seven_d_reset = w.resets_at;
                        }
                    }
                    claude.push((name, u));
                }
            }
        }
        claude
    }
    impl crate::tui::TuiCtx for Ctx<'_> {
        fn rows(&mut self) -> Vec<crate::tui::Row> {
            let Ok(store) = Store::open(self.paths) else {
                return Vec::new();
            };
            let active = active_by_tool(&store, self.paths);
            let cfg = crate::settings::load(self.paths);
            // A Vec, not a HashMap: the rows are rendered in this order, and a
            // HashMap iterates differently every run - the list visibly reshuffled
            // itself on each refresh, so a row could move out from under the
            // cursor between pressing a key and reading the result.
            let slot_dirs: Vec<(String, std::path::PathBuf)> =
                crate::slots::Slots::open(self.paths)
                    .map(|s| {
                        s.list()
                            .into_iter()
                            .map(|r| (r.name, r.config_dir))
                            .collect()
                    })
                    .unwrap_or_default();
            // Which account is actually taking turns. With a proxy running that is
            // the account SERVING them, not the one the pointer names: after a
            // rotation those differ, and marking a spent account "active" next to
            // the word "spent" is a contradiction the user has to decode.
            let pointer = crate::slots::Slots::open(self.paths)
                .ok()
                .and_then(|s| s.default_dir());
            let serving = crate::proxy::serving_account(self.paths);
            let slot_dir_of = |name: &str| {
                slot_dirs
                    .iter()
                    .find(|(n, _)| n == name)
                    .map(|(_, d)| d.clone())
            };
            // Codex switches by pointer now too, so the same authority applies:
            // once a pointer exists it decides which Codex account is active. The
            // live login does not move when a pointer does, and consulting it
            // anyway marked two Codex accounts active at once.
            let codex_slots: Vec<(String, std::path::PathBuf)> =
                crate::slots::Slots::open_for(self.paths, "codex")
                    .map(|s| {
                        s.list()
                            .into_iter()
                            .map(|r| (r.name, r.config_dir))
                            .collect()
                    })
                    .unwrap_or_default();
            let codex_pointer = crate::slots::Slots::open_for(self.paths, "codex")
                .ok()
                .and_then(|s| s.default_dir());
            let codex_dir_of = |name: &str| {
                codex_slots
                    .iter()
                    .find(|(n, _)| n == name)
                    .map(|(_, d)| d.clone())
            };
            let list: Vec<crate::tui::Row> = store
                .list()
                .iter()
                .map(|p| {
                    let (email, tier, marker) = profile_summary(&store, &p.name, &p.tools);
                    let at: Vec<&str> = active
                        .iter()
                        .filter(|(_, n)| n == &p.name)
                        .map(|(t, _)| *t)
                        .collect();
                    // A profile that ALSO has a slot switches by pointer, so its
                    // active marker has to follow the pointer too - the live login
                    // does not move, and the marker would sit still after a switch.
                    // Exactly one Claude account is active, and there is an order
                    // of authority for which: the proxy actually serving turns,
                    // else the default pointer (the slot model's answer), else the
                    // live login. Consulting the live login WHILE a pointer exists
                    // marked two accounts active at once - the pointed-at one, and
                    // whatever happened to be signed into the bare config.
                    // Codex is a different tool and keeps its own answer.
                    let is_claude = p.tools.iter().any(|t| t == "claude-code");
                    let is_codex = p.tools.iter().any(|t| t == "codex");
                    let by_pointer = match (&serving, &pointer, is_claude) {
                        (Some(s), _, true) => Some(s == &p.name),
                        (None, Some(ptr), true) => {
                            Some(slot_dir_of(&p.name).as_deref() == Some(ptr.as_path()))
                        }
                        _ => match (&codex_pointer, is_codex) {
                            (Some(ptr), true) => {
                                Some(codex_dir_of(&p.name).as_deref() == Some(ptr.as_path()))
                            }
                            _ => None,
                        },
                    };
                    crate::tui::Row {
                        is_slot: slot_dir_of(&p.name).is_some(),
                        disabled: cfg.is_disabled(&p.name),
                        // A slot with no readable token cannot serve a turn; say so
                        // rather than letting it look ready and fail later.
                        needs_login: slot_dir_of(&p.name)
                            .is_some_and(|d| crate::proxy::creds::slot_token(&d).is_none()),
                        name: p.name.clone(),
                        ident: identity_column(email, tier),
                        tools: p
                            .tools
                            .iter()
                            .map(|t| {
                                if at.contains(&t.as_str()) {
                                    format!("{t}*")
                                } else {
                                    t.clone()
                                }
                            })
                            .collect::<Vec<_>>()
                            .join(", "),
                        active: by_pointer.unwrap_or(!at.is_empty()),
                        warn: marker,
                        also: Vec::new(),
                        stale: slot_dir_of(&p.name)
                            .is_some_and(|d| crate::proxy::creds::slot_token_expired(&d, now_ms())),
                    }
                })
                .collect::<Vec<_>>();
            // Slot accounts too. They are what proxy mode rotates between, so a
            // list without them manages everything except what actually serves the
            // turns. A slot counts as ACTIVE when the default pointer names it:
            // switching a slot moves that pointer and never touches a live login,
            // so judging it by the live login would leave the marker stuck where
            // it was.
            let mut list = list;
            // Codex accounts live in slots too now, and a dashboard that omits
            // them manages half the accounts while showing the other half's
            // superseded copy-model profiles beside them.
            for (name, dir) in &codex_slots {
                let r = crate::slots::SlotRecord {
                    name: name.clone(),
                    id: String::new(),
                    config_dir: dir.clone(),
                    adopted: false,
                    tool: "codex".into(),
                };
                list.push(crate::tui::Row {
                    is_slot: true,
                    disabled: cfg.is_disabled(&r.name),
                    needs_login: crate::proxy::codex::slot_auth(&r.config_dir).is_none(),
                    name: r.name.clone(),
                    // Codex records the signed-in address inside its id_token; the
                    // account id is what it authenticates with, and it is what
                    // distinguishes two rows when both are signed in.
                    ident: identity_column(codex_slot_email(&r.config_dir), None),
                    tools: "codex".into(),
                    active: codex_pointer.as_deref() == Some(r.config_dir.as_path()),
                    warn: None,
                    also: Vec::new(),
                    stale: false,
                });
            }
            for (name, dir) in &slot_dirs {
                if list.iter().any(|r| &r.name == name) {
                    continue;
                }
                list.push(crate::tui::Row {
                    is_slot: true,
                    disabled: cfg.is_disabled(name),
                    needs_login: crate::proxy::creds::slot_token(dir).is_none(),
                    name: name.clone(),
                    ident: identity_column(crate::proxy::creds::slot_email(dir), None),
                    tools: "claude-code".into(),
                    active: match &serving {
                        Some(s) => s == name,
                        None => pointer.as_deref() == Some(dir.as_path()),
                    },
                    warn: None,
                    also: Vec::new(),
                    stale: crate::proxy::creds::slot_token_expired(dir, now_ms()),
                });
            }
            // One row per account (a snapshot and a slot for the same login are
            // one account), then grouped by tool so Claude and Codex read as two
            // sections rather than one mixed list.
            crate::tui::group_sorted(crate::tui::dedupe_by_identity(list))
        }
        fn switch(&mut self, name: &str) -> (bool, String) {
            self.pre_switch_first = crate::session_link::read_timeline(self.paths).is_empty();
            // Switch only the tool this account belongs to. A bare `use` moves
            // every tool the profile covers, so switching a Codex-only account
            // reported "profile has no claude-code login" - true, irrelevant, and
            // indistinguishable from something being wrong.
            let tool = Store::open(self.paths)
                .ok()
                .and_then(|st| st.list().into_iter().find(|p| p.name == name))
                .and_then(|p| {
                    ["claude-code", "codex", "gemini", "antigravity"]
                        .into_iter()
                        .find(|t| p.tools.iter().any(|pt| pt == t))
                });
            match tool {
                // Enter means "let this account serve me" - not "move where my
                // conversations live". Moving the store is what `use` does, and
                // having the most natural key do it split a history in two every
                // time somebody changed accounts, which is the opposite of the
                // point of the tool.
                Some(t) => run_self(&["serve", name, "--tool", t]),
                // A slot account has no store profile, so the registry that holds
                // it says which tool it is. Guessing Claude here switched nothing
                // when the row was a Codex account.
                None => {
                    let t = ["claude-code", "codex"]
                        .into_iter()
                        .find(|t| {
                            crate::slots::Slots::open_for(self.paths, t)
                                .map(|s| s.get(name).is_some())
                                .unwrap_or(false)
                        })
                        .unwrap_or("claude-code");
                    run_self(&["serve", name, "--tool", t])
                }
            }
        }
        fn toggle_rotation(&mut self, name: &str) -> String {
            let mut cfg = crate::settings::load(self.paths);
            let paused = cfg.toggle_disabled(name);
            match crate::settings::save(self.paths, &cfg) {
                Ok(()) if paused => {
                    format!("{name} paused - the proxy will not pick it (Enter still switches)")
                }
                Ok(()) => format!("{name} back in rotation"),
                Err(e) => format!("could not save that: {e}"),
            }
        }
        fn delete(&mut self, name: &str) -> String {
            // Delegate to the command every other caller uses. Deleting here only
            // ever touched the STORE, and every account in this list is a slot -
            // so it answered "no profile named X" for exactly the accounts the
            // dashboard is made of. Renaming had the same fault and was fixed
            // without me looking at its neighbour.
            run_self(&["rm", name, "--yes"]).1
        }
        fn rename(&mut self, old: &str, new: &str) -> (bool, String) {
            // Delegate to the command every other caller uses. Renaming here only
            // ever touched the STORE, and every account in this list is a slot -
            // so renaming from the dashboard failed with "no profile named X" on
            // exactly the accounts the dashboard is made of.
            run_self(&["rename", old, new])
        }
        fn sign_in(&mut self, name: &str) -> (bool, String) {
            // The account list holds both tools, so the registry that has this
            // name decides which login to open.
            let tool = ["claude-code", "codex"]
                .into_iter()
                .find(|t| {
                    crate::slots::Slots::open_for(self.paths, t)
                        .map(|s| s.get(name).is_some())
                        .unwrap_or(false)
                })
                .unwrap_or("claude-code");
            sign_in_child(self.paths, name, tool)
        }
        fn save_current(&mut self, name: &str) -> (bool, String) {
            // `add <name>` captures the CURRENT live logins (all tools) - no
            // sign-out, no interactive spawn - so it is safe to run in-loop.
            run_self(&["add", name])
        }
        fn doctor(&mut self) -> Vec<String> {
            let exe = match std::env::current_exe() {
                Ok(e) => e,
                Err(e) => return vec![format!("cannot find own binary: {e}")],
            };
            match Command::new(exe)
                .arg("doctor")
                .stdin(std::process::Stdio::null())
                .output()
            {
                Ok(out) => {
                    let mut text = String::from_utf8_lossy(&out.stdout).into_owned();
                    text.push_str(&String::from_utf8_lossy(&out.stderr));
                    text.lines().map(|l| l.to_string()).collect()
                }
                Err(e) => vec![format!("doctor failed: {e}")],
            }
        }
        fn usage(&mut self) -> Vec<String> {
            let exe = match std::env::current_exe() {
                Ok(e) => e,
                Err(e) => return vec![format!("cannot find own binary: {e}")],
            };
            match Command::new(exe)
                .arg("usage")
                .stdin(std::process::Stdio::null())
                .output()
            {
                Ok(out) => {
                    let text = String::from_utf8_lossy(&out.stdout);
                    let mut lines: Vec<String> = text.lines().map(|l| l.to_string()).collect();
                    lines.push(String::new());
                    lines.push(
                        "swapdex is local: this is tokens USED here, not remaining quota."
                            .to_string(),
                    );
                    lines
                }
                Err(e) => vec![format!("usage failed: {e}")],
            }
        }
        fn quota(&mut self) -> Vec<String> {
            let exe = match std::env::current_exe() {
                Ok(e) => e,
                Err(e) => return vec![format!("cannot find own binary: {e}")],
            };
            match Command::new(exe)
                .arg("quota")
                .stdin(std::process::Stdio::null())
                .output()
            {
                Ok(out) => {
                    // stderr too (like doctor): a failed quota must show its
                    // error in the panel, not render blank.
                    let mut text = String::from_utf8_lossy(&out.stdout).into_owned();
                    text.push_str(&String::from_utf8_lossy(&out.stderr));
                    text.lines().map(|l| l.to_string()).collect()
                }
                Err(e) => vec![format!("quota failed: {e}")],
            }
        }
        fn cached_quota(&mut self) -> Vec<(String, crate::tui::Usage)> {
            crate::quota_cache::load(self.paths)
                .into_iter()
                .map(|(name, e)| {
                    (
                        name,
                        crate::tui::Usage {
                            five_h: e.five_h,
                            five_h_reset: e.five_h_reset,
                            seven_d: e.seven_d,
                            seven_d_reset: e.seven_d_reset,
                            // Shown with its age: a remembered number that looked
                            // live would be worse than no number at all.
                            observed_at: Some(e.at),
                            note: None,
                        },
                    )
                })
                .collect()
        }
        fn quota_pct(&mut self) -> Vec<(String, crate::tui::Usage)> {
            read_quota_usage(self.paths)
        }
        /// Start a reading and hand back the channel it arrives on. The read is
        /// several network round trips with backoff; on the loop it froze the
        /// dashboard with no keys and no cursor, which reads as a broken tool.
        fn quota_pct_async(
            &mut self,
        ) -> std::sync::mpsc::Receiver<Vec<(String, crate::tui::Usage)>> {
            let (tx, rx) = std::sync::mpsc::channel();
            let paths = self.paths.clone();
            std::thread::spawn(move || {
                let _ = tx.send(read_quota_usage(&paths));
            });
            rx
        }
        fn proxy_running(&mut self) -> bool {
            crate::proxy::running_port(self.paths).is_some()
        }
        fn sessionwiki_present(&mut self) -> bool {
            command_exists("sessionwiki")
        }
        fn live_tools(&mut self) -> Vec<String> {
            adapters::all()
                .iter()
                .filter(|a| a.present(self.paths))
                .map(|a| pretty_tool(a.name()).to_string())
                .collect()
        }
        fn sessions(
            &mut self,
            name: &str,
        ) -> (String, Vec<crate::tui::SessionEntry>, Vec<&'static str>) {
            let first_time = self.pre_switch_first;
            let (sessions, label) = recent_menu_sessions(self.paths, name, first_time, 5);
            // The profile's saved tools drive which "open a NEW <tool>" entries
            // the menu offers (a Claude-only account shouldn't offer Codex).
            let tools: Vec<&'static str> = Store::open(self.paths)
                .ok()
                .and_then(|st| st.list().into_iter().find(|p| p.name == name))
                .map(|p| {
                    ["claude-code", "codex", "gemini", "antigravity"]
                        .into_iter()
                        .filter(|t| p.tools.iter().any(|x| x == t))
                        .collect()
                })
                .unwrap_or_default();
            let entries = sessions
                .iter()
                .map(|s| {
                    let (id6, started, tool, title) = s.describe();
                    let age = age_line((started.max(0) as u128) * 1_000_000_000);
                    crate::tui::SessionEntry {
                        line: format!(
                            "{id6}  {:>7}  {}  {}",
                            age,
                            fit(&format!("[{tool}]"), 13),
                            fit(&title, 44)
                        )
                        .trim_end()
                        .to_string(),
                    }
                })
                .collect();
            self.last_sessions = sessions;
            let label = if label.is_empty() {
                format!("open a conversation on '{name}'")
            } else {
                label.trim_end_matches(':').to_string()
            };
            (label, entries, tools)
        }
    }

    let mut ctx = Ctx {
        paths,
        last_sessions: Vec::new(),
        pre_switch_first: crate::session_link::read_timeline(paths).is_empty(),
    };
    loop {
        // An empty store is fine now: the TUI draws an onboarding welcome
        // (offers to save the accounts you're already logged into). Only fall
        // back to text if there is truly nothing to do AND nothing to save.
        // Slots count as accounts. Checking only the store and the live logins
        // meant a slot-only install - which is every install now - could not open
        // its own dashboard until something happened to be signed in, and the
        // dashboard is where you go to sign in.
        let has_slots = ["claude-code", "codex"].iter().any(|t| {
            crate::slots::Slots::open_for(paths, t)
                .map(|s| !s.list().is_empty())
                .unwrap_or(false)
        });
        if Store::open(paths)?.list().is_empty()
            && !has_slots
            && adapters::all().iter().all(|a| !a.present(paths))
        {
            println!("No accounts saved yet, and you're not logged into any tool.");
            println!(
                "  sign in to Claude Code / Codex / Gemini / Antigravity, then run `swapdex`."
            );
            return Ok(0);
        }
        match crate::tui::run(&mut ctx)? {
            crate::tui::Outcome::Quit => return Ok(0),
            crate::tui::Outcome::OpenSession(i) => {
                let Some(sess) = ctx.last_sessions.get(i) else {
                    return Ok(0);
                };
                return Err(exec_menu_resume(sess));
            }
            crate::tui::Outcome::NewConv { tool, dir } => {
                println!("opening {}...", pretty_tool(tool));
                return Err(exec_tool(tool, dir.as_deref()));
            }

            crate::tui::Outcome::AddAccount(tool) => {
                let sel = match tool {
                    "claude-code" => Some(ToolSel::Claude),
                    "codex" => Some(ToolSel::Codex),
                    "gemini" => Some(ToolSel::Gemini),
                    _ => Some(ToolSel::Antigravity),
                };
                let who = adapters::by_name(tool)
                    .and_then(|a| a.identity(paths).ok().flatten())
                    .and_then(|id| id.email)
                    .unwrap_or_else(|| "account".into());
                let store = Store::open(paths)?;
                let Some(name) = ask_name(
                    &store,
                    &format!("name for the new account [{}]: ", suggest_name(&who)),
                    &suggest_name(&who),
                ) else {
                    continue;
                };
                drop(store);
                let rc = login(paths, &name, sel)?;
                if rc != 0 {
                    return Ok(rc);
                }
                println!("(press Enter to go back to the picker)");
                let _ = prompt("", "");
            }
        }
    }
}

/// Replace this process with the official tool - the "switch and land in a
/// conversation" handoff. Only returns on exec failure.
fn exec_tool(tool: &str, dir: Option<&std::path::Path>) -> anyhow::Error {
    use std::os::unix::process::CommandExt;
    let bin = match tool {
        "claude-code" => "claude",
        "codex" => "codex",
        "gemini" => "gemini",
        "antigravity" => "agy",
        other => return anyhow::anyhow!("unknown tool '{other}'"),
    };
    let mut cmd = Command::new(bin);
    if let Some(d) = dir {
        cmd.current_dir(d);
    }
    let err = cmd.exec();
    anyhow::anyhow!("could not launch `{bin}`: {err}")
}

/// Replace this process with `sessionwiki resume <id>` - a one-shot handoff to
/// the official reopen flow (sessionwiki launches the session's own tool).
/// exec(2) only returns on failure, so this returns the error to propagate.
fn exec_sessionwiki_resume(id: &str) -> anyhow::Error {
    use std::os::unix::process::CommandExt;
    let err = Command::new("sessionwiki")
        .args(["resume", "--no-sync", "--", id])
        .exec();
    anyhow::anyhow!("could not launch `sessionwiki resume {id}`: {err}")
}

/// Turn the macOS Keychain reality into a doctor verdict. `None` = nothing to
/// report (no Claude item found: not logged in, or a locked/headless keychain).
/// `computed` is the item swapdex's own env derives (bare when no env) - the
/// one a `claude` launched from this same shell would read.
///
/// The contract: swapdex manages the profile of the environment it runs in.
/// Other Claude items are OTHER profiles (CLAUDE_CONFIG_DIR aliases) or
/// leftovers - swapdex never touches them, and this verdict says so.
fn keychain_verdict(
    found: &[String],
    target: Option<&str>,
    computed: &str,
) -> Option<(bool, String)> {
    if found.is_empty() {
        return None;
    }
    let list = found
        .iter()
        .map(|s| format!("'{s}'"))
        .collect::<Vec<_>>()
        .join(", ");
    let Some(t) = target else {
        // The derived item does not exist and several items are present:
        // refusing to guess is the safe behavior, and this is the remedy.
        return Some((
            false,
            format!(
                "this environment's profile item ('{computed}') does not exist; the items \
                 present ({list}) belong to other CLAUDE_CONFIG_DIR profiles, and swapdex \
                 refuses to guess between them. Run swapdex with the profile's \
                 CLAUDE_CONFIG_DIR, or log in once with plain `claude` to create '{computed}'."
            ),
        ));
    };
    if !found.iter().any(|s| s == t) {
        // Defensive: the two keychain reads disagreed (item vanished between).
        return Some((
            false,
            format!(
                "swapdex resolves '{t}' but the Keychain currently shows {list} - re-run \
                 `swapdex doctor`; if this persists, launch swapdex with the same \
                 CLAUDE_CONFIG_DIR you launch `claude` with."
            ),
        ));
    }
    if t != computed {
        // Single-item fallback: swapdex's env derives a missing item, so it
        // manages the only login that exists. Working alias-only setup.
        return Some((
            true,
            format!(
                "this environment derives '{computed}' (not present); managing the only \
                 Claude login, '{t}' - if your `claude` runs with a CLAUDE_CONFIG_DIR, \
                 launch swapdex with the same one"
            ),
        ));
    }
    let msg = if found.len() > 1 {
        format!(
            "managing this environment's profile ('{t}'); {} other Claude item(s) belong to \
             other CLAUDE_CONFIG_DIR profiles (or are leftovers) - swapdex never touches them",
            found.len() - 1
        )
    } else {
        format!("managing this environment's profile ('{t}')")
    };
    Some((true, msg))
}

/// `doctor` - local-only health check with a remedy per finding. Exit 0 when
/// healthy, 9 when any problem was found (scripts can gate on it). Checks the
/// store, every saved snapshot, both live logins, backups, and the CLIs on
/// PATH - and never touches the network.
pub fn doctor(paths: &Paths) -> Result<i32> {
    use std::os::unix::fs::PermissionsExt;
    // Stat BEFORE Store::open, which self-heals the mode to 0700 - otherwise
    // the permission check below could never observe a problem.
    let pre_mode = std::fs::metadata(paths.store_dir())
        .ok()
        .map(|m| m.permissions().mode() & 0o777);
    let store = Store::open(paths)?;
    let mut problems = 0u32;
    let color = crate::util::color_enabled();
    let mut report = |label: &str, ok: bool, msg: String| {
        let verdict = match (ok, color) {
            (true, true) => "\x1b[32mok\x1b[0m".to_string(),
            (false, true) => "\x1b[31mproblem\x1b[0m".to_string(),
            (true, false) => "ok".to_string(),
            (false, false) => "problem".to_string(),
        };
        println!("{label:<13} {verdict} - {msg}");
        if !ok {
            problems += 1;
        }
    };

    // Store directory. Store::open already tightened it to 0700; report what
    // it FOUND (pre_mode), or "ok" would paper over a store that sat
    // group-readable until this very run.
    let sd = paths.store_dir();
    let profiles = store.list();
    let count = format!(
        "{} profile{}",
        profiles.len(),
        if profiles.len() == 1 { "" } else { "s" }
    );
    match (pre_mode, std::fs::metadata(&sd)) {
        (Some(m), Ok(now)) if m & 0o077 != 0 && now.permissions().mode() & 0o077 == 0 => report(
            "store",
            true,
            format!("was mode {m:03o} - tightened to 0700 just now; {count}"),
        ),
        (_, Ok(now)) if now.permissions().mode() & 0o077 != 0 => report(
            "store",
            false,
            format!(
                "directory is group/world-accessible; run `chmod 700 {}`",
                crate::util::redact_path(&sd.display().to_string())
            ),
        ),
        (_, Ok(_)) => report("store", true, format!("0700, {count}")),
        (_, Err(e)) => report("store", false, format!("cannot stat store dir: {e}")),
    }

    // Live logins per tool.
    for adapter in adapters::all() {
        let tool = adapter.name();
        match adapter.identity(paths) {
            Ok(Some(id)) => {
                let saved = matched_profile_name(&store, tool, &id.account_id)
                    .map(|n| format!("profile '{n}'"))
                    .unwrap_or_else(|| "not saved - `swapdex add <name>` keeps it".into());
                report(
                    tool,
                    true,
                    format!("live login {} ({saved})", identity_line(&id)),
                );
            }
            Ok(None) => match macos_keychain_note(paths, tool) {
                Some(note) => report(tool, true, format!("not manageable - {note}")),
                None => report(tool, true, "not logged in".into()),
            },
            Err(_) => report(
                tool,
                false,
                "live login file unreadable; `swapdex use <profile>` can replace it, \
                 or log in again in the tool"
                    .into(),
            ),
        }
    }

    // macOS: swapdex swaps Claude's login INSIDE the Keychain, so a mismatch
    // between the item Claude reads and the one swapdex writes is the classic
    // "I switched but the old account is still active". Read-only; no-op off
    // macOS (Claude is file-based there).
    if let Some(diag) = crate::adapters::claude::keychain_diagnostic() {
        if let Some((ok, msg)) =
            keychain_verdict(&diag.found, diag.target.as_deref(), &diag.computed)
        {
            report("keychain", ok, msg);
        }
        if let Some(dir) = &diag.config_dir {
            report(
                "config-dir",
                true,
                format!(
                    "CLAUDE_CONFIG_DIR={} (swapdex must see the same value)",
                    crate::util::redact_path(dir)
                ),
            );
        }
    }

    // Permanent slots (the no-copy model): the slots, the default account the
    // claude shim follows, and whether the shim is installed.
    if let Ok(slots) = crate::slots::Slots::open(paths) {
        let list = slots.list();
        if !list.is_empty() {
            report("slots", true, format!("{} account(s)", list.len()));
            match slots.default_dir() {
                Some(dir) => {
                    let name = list
                        .iter()
                        .find(|r| r.config_dir == dir)
                        .map(|r| r.name.as_str())
                        .unwrap_or("(unknown)");
                    report("default", true, format!("plain `claude` -> '{name}'"));
                }
                None => report(
                    "default",
                    true,
                    "no default account set - `swapdex use <name>`".into(),
                ),
            }
            // Conversations live inside the store they were started in, so
            // pointing `claude` at an account also decides which conversations
            // `-c` and `-r` can offer. When the default store holds work and is
            // not a registered account, that work becomes unreachable from a
            // plain `claude` with nothing to explain it - and swapdex is what
            // redirected it, so swapdex is what has to say so.
            {
                let bare = paths.claude_dir().to_path_buf();
                let registered = crate::slots::Slots::open_for(paths, "claude-code")
                    .map(|s| s.list().iter().any(|r| r.config_dir == bare))
                    .unwrap_or(false);
                let held = std::fs::read_dir(bare.join("projects"))
                    .map(|rd| rd.flatten().count())
                    .unwrap_or(0);
                if !registered && held > 0 {
                    report(
                        "default store",
                        false,
                        format!(
                            "~/.claude holds {held} project(s) of conversations but is not a \
                             swapdex account, so a plain `claude -r` cannot reach them while \
                             another account is active - register it to switch back: \
                             `swapdex adopt personal {}`",
                            crate::util::redact_path(&bare.display().to_string())
                        ),
                    );
                }
            }
            // A name above another account's numbers is worse than no name: it
            // is not "missing information", it is wrong information, and every
            // figure on that row belongs to somebody else.
            {
                let mixed: Vec<String> = crate::slots::Slots::open_for(paths, "claude-code")
                    .map(|s| s.list())
                    .unwrap_or_default()
                    .into_iter()
                    .filter_map(|r| {
                        crate::proxy::creds::identity_contradicts_login(&r.config_dir)
                            .map(|why| format!("'{}' is {why}", r.name))
                    })
                    .collect();
                for line in &mixed {
                    report(
                        "account identity",
                        false,
                        format!("{line} - sign in again to make them agree"),
                    );
                }
            }
            // A slot named after a tool cannot be refused after the fact, but it
            // can be named: it reads as that tool's home and points elsewhere.
            {
                let colliding: Vec<String> = crate::slots::Slots::open_for(paths, "claude-code")
                    .map(|s| s.list())
                    .unwrap_or_default()
                    .into_iter()
                    .chain(
                        crate::slots::Slots::open_for(paths, "codex")
                            .map(|s| s.list())
                            .unwrap_or_default(),
                    )
                    .filter(|r| crate::slots::name_reads_as_a_tool_home(&r.name))
                    .map(|r| r.name)
                    .collect();
                if !colliding.is_empty() {
                    report(
                        "account names",
                        false,
                        format!(
                            "account '{}' reads as the tool's own home directory but points \
                             somewhere else - rename it so the two are not confused: \
                             `swapdex rename {} <name>` (the folder and login are untouched)",
                            colliding.join("', '"),
                            colliding[0]
                        ),
                    );
                }
            }
            // Shim ENGAGEMENT, not mere existence: an installed shim that PATH
            // never reaches looks set up while a plain `claude` still runs
            // bare - `swapdex use` flips the pointer and nothing reads it.
            let shim_file = crate::shim::shim_path(paths);
            let (shim_ok, shim_msg) = if !shim_file.exists() {
                (
                    true,
                    "claude shim not installed - run `swapdex shim` so a plain \
                     `claude` follows `swapdex use`"
                        .to_string(),
                )
            } else {
                let shim_dir = shim_file.parent().unwrap_or(&shim_file).display();
                match crate::shim::resolved_claude() {
                    Some((_, true)) => (
                        true,
                        "claude shim active - plain `claude` follows `swapdex use`".to_string(),
                    ),
                    Some((found, false)) => (
                        false,
                        format!(
                            "claude shim installed but NOT taking effect - plain `claude` \
                             runs {} instead; add the shim first on PATH: \
                             export PATH=\"{shim_dir}:$PATH\"",
                            found.display()
                        ),
                    ),
                    None => (
                        false,
                        format!(
                            "claude shim installed but PATH has no `claude` at all - \
                             add it: export PATH=\"{shim_dir}:$PATH\""
                        ),
                    ),
                }
            };
            report("shim", shim_ok, shim_msg);
            // Per-slot login health (read-only). Flag only a slot with NO
            // login yet, or one whose token sat unrefreshed past STALE_DAYS
            // (by then the refresh token itself may be revoked). Routine
            // access-token expiry (hours) is NOT flagged - Claude silently
            // refreshes it on the next run (same no-spam rule as
            // profile_detail).
            use crate::adapters::claude::SlotLogin;
            for r in &list {
                let key = format!("slot:{}", r.name);
                match crate::adapters::claude::slot_login(&r.config_dir) {
                    SlotLogin::Absent => report(
                        &key,
                        true,
                        format!("no login yet - `swapdex run {}` once signs it in", r.name),
                    ),
                    SlotLogin::Present(Some(ts)) if now_ms() - ts > STALE_DAYS * 86_400_000 => {
                        let days = (now_ms() - ts) / 86_400_000;
                        report(
                            &key,
                            true,
                            format!(
                                "login idle ~{days}d - `swapdex run {}` once refreshes \
                                 it (re-login if it asks)",
                                r.name
                            ),
                        );
                    }
                    // Fresh, or present-but-undeterminable: stay quiet - doctor
                    // flags only what it can determine.
                    SlotLogin::Present(_) => {}
                }
            }
        }
    }

    // Live credential files hold refresh tokens - flag loose modes on ALL of
    // them, not just .claude.json (the store already self-tightens; the live
    // files are each tool's own, so we can only warn).
    for f in [
        paths.claude_credentials(),
        paths.codex_auth(),
        paths.gemini_oauth(),
        paths.antigravity_token(),
    ] {
        if let Ok(meta) = std::fs::metadata(&f) {
            use std::os::unix::fs::PermissionsExt;
            if meta.permissions().mode() & 0o077 != 0 {
                report(
                    "perms",
                    false,
                    format!(
                        "{} is group/world-readable (holds tokens); run `chmod 600` on it",
                        crate::util::redact_path(&f.display().to_string())
                    ),
                );
            }
        }
    }
    // A corrupt live .claude.json breaks every claude switch with an error
    // users misread as a snapshot problem - diagnose it here by name.
    if paths.claude_config_json().exists() {
        if let Ok(bytes) = std::fs::read(paths.claude_config_json()) {
            if serde_json::from_slice::<Value>(&bytes).is_err() {
                report(
                    "claude-config",
                    false,
                    format!(
                        "{} is not valid JSON - claude switches will fail until it is \
                         repaired or removed (removing loses local settings like \
                         project trust)",
                        crate::util::redact_path(&paths.claude_config_json().display().to_string())
                    ),
                );
            }
        }
    }
    // .claude.json permissions (holds account PII).
    if let Ok(meta) = std::fs::metadata(paths.claude_config_json()) {
        if meta.permissions().mode() & 0o077 != 0 {
            report(
                "claude-config",
                false,
                format!(
                    "{} is group/world-readable; run `chmod 600` on it",
                    crate::util::redact_path(&paths.claude_config_json().display().to_string())
                ),
            );
        }
    }

    // Every saved snapshot must parse.
    for p in &profiles {
        for tool in &p.tools {
            match profile_detail(&store, &p.name, tool) {
                Some((_, _, Some("unreadable"))) => report(
                    &format!("profile:{}", p.name),
                    false,
                    format!(
                        "{tool} snapshot unreadable; log in to that account and run \
                         `swapdex add {} --tool {tool} --update`",
                        p.name
                    ),
                ),
                // The precondition matters: `add --update` snapshots whatever
                // is LIVE, so without "log in to that account first" the
                // remedy would overwrite this profile with the wrong account.
                Some((_, _, Some(m))) => report(
                    &format!("profile:{}", p.name),
                    true,
                    format!(
                        "{tool} snapshot {m} - log in to that account and run \
                         `swapdex add {} --tool {tool} --update`",
                        p.name
                    ),
                ),
                _ => {}
            }
        }
    }

    // Backups: newest intact per tool (load_backup already skips torn ones).
    let mut kept = Vec::new();
    for tool in ["claude-code", "codex", "gemini", "antigravity"] {
        if let Ok(Some((stamp, _))) = store.load_backup(tool) {
            kept.push(format!("{tool} (newest {})", age_line(stamp)));
        }
    }
    if kept.is_empty() {
        report(
            "backups",
            true,
            "none yet (one is taken on every `use`; `swapdex restore` brings it back)".into(),
        );
    } else {
        report("backups", true, format!("intact - {}", kept.join(", ")));
    }

    // CLIs on PATH - informational (a codex-only user is not "broken").
    let mut found = Vec::new();
    for cli in ["claude", "codex", "gemini", "agy"] {
        if command_exists(cli) {
            found.push(cli);
        }
    }
    report(
        "tools",
        true,
        if found.is_empty() {
            "none of `claude`, `codex`, `gemini`, `agy` found on PATH".into()
        } else {
            format!("on PATH: {}", found.join(", "))
        },
    );

    if problems > 0 {
        println!(
            "\n{problems} problem{} found - each line above ends with its fix.",
            if problems == 1 { "" } else { "s" }
        );
        return Ok(9);
    }
    println!("\neverything looks healthy.");
    Ok(0)
}

pub fn rm(paths: &Paths, name: &str, yes: bool) -> Result<i32> {
    if let Some(c) = reject_bad_name(name) {
        return Ok(c);
    }
    let store = Store::open(paths)?;
    // A slot account is not a saved snapshot: removing it means "stop managing
    // this account", and the directory holding its login is left untouched, so
    // the account itself is never lost.
    // Both tools keep accounts here. Looking only in Claude's registry meant a
    // Codex account could not be removed at all, and the dashboard - which lists
    // both - reported "no account named X" for something it was showing.
    let slot_tool = ["claude-code", "codex"].into_iter().find(|t| {
        crate::slots::Slots::open_for(paths, t)
            .map(|s| s.get(name).is_some())
            .unwrap_or(false)
    });
    let is_slot = slot_tool.is_some();
    let is_profile = store.list().iter().any(|p| p.name == name);
    if !is_slot && !is_profile {
        eprintln!("swapdex: no account named '{name}'");
        return Ok(5);
    }
    if is_slot {
        if !yes {
            use std::io::IsTerminal;
            let tty =
                std::io::stdin().is_terminal() || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
            if !tty {
                eprintln!(
                    "swapdex: `rm {name}` unregisters that account (its login and folder \
                     stay). Re-run with --yes to confirm."
                );
                return Ok(7);
            }
            if !yes_no(
                &format!(
                    "stop managing account '{name}'? Its login and folder stay, so \
                     `swapdex adopt` can bring it back. [y/N]: "
                ),
                false,
            ) {
                println!("kept '{name}'.");
                return Ok(0);
            }
        }
        let mut slots = crate::slots::Slots::open_for(paths, slot_tool.unwrap_or("claude-code"))?;
        let dir = slots.get(name).map(|r| r.config_dir);
        slots.remove(name)?;
        println!("stopped managing '{name}'.");
        if let Some(d) = dir {
            println!(
                "  its login is untouched at {}",
                crate::util::redact_path(&d.display().to_string())
            );
        }
        // A profile of the same name is a separate thing; leave it alone.
        return Ok(0);
    }
    if !yes {
        // On a terminal, just ask; --yes stays for scripts (and remains the
        // only path when stdin is not a tty, exit 7 as documented).
        use std::io::IsTerminal;
        let tty =
            std::io::stdin().is_terminal() || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
        if !tty {
            eprintln!(
                "swapdex: `rm {name}` deletes the saved profile. Re-run with --yes to confirm."
            );
            return Ok(7);
        }
        if !yes_no(
            &format!("delete saved profile '{name}'? The live login stays. [y/N]: "),
            false,
        ) {
            println!("kept '{name}'.");
            return Ok(0);
        }
    }
    let _lock = match store.lock() {
        Ok(g) => g,
        Err(crate::store::LockError::Busy) => {
            eprintln!(
                "swapdex: another swapdex is busy (a switch, or a `swapdex login` waiting \
                 for a sign-in). Finish or close it, then retry."
            );
            return Ok(4);
        }
        Err(crate::store::LockError::Unwritable(e)) => {
            eprintln!(
                "swapdex: the store is not writable ({e}) - check permissions/mount of \
                 the store directory"
            );
            return Ok(4);
        }
    };
    if !store.remove(name)? {
        eprintln!("swapdex: no profile named '{name}'");
        return Ok(5);
    }
    println!("removed profile '{name}' (any live login it matched keeps running, now unsaved)");
    Ok(0)
}

pub fn rename(paths: &Paths, old: &str, new: &str) -> Result<i32> {
    if let Some(c) = reject_bad_name(old) {
        return Ok(c);
    }
    if let Some(c) = reject_bad_name(new).or_else(|| reject_reserved_name(new)) {
        return Ok(c);
    }
    // A slot account renames by mapping only: its directory (and so its Keychain
    // item, and so its login) must not move.
    if let Ok(mut slots) = crate::slots::Slots::open(paths) {
        if slots.get(old).is_some() {
            return match slots.rename(old, new) {
                Ok(true) => {
                    println!("renamed account '{old}' to '{new}'");
                    Ok(0)
                }
                Ok(false) => {
                    eprintln!("swapdex: no account named '{old}'");
                    Ok(5)
                }
                Err(e) => {
                    eprintln!("swapdex: {e}");
                    Ok(6)
                }
            };
        }
    }
    let store = Store::open(paths)?;
    // Take the switch lock like every other store mutation, and make the
    // collision a first-class "already exists" (6) rather than a hard error -
    // a script must be able to tell "pick another name" from "disk broke".
    let _lock = match store.lock() {
        Ok(g) => g,
        Err(crate::store::LockError::Busy) => {
            eprintln!(
                "swapdex: another swapdex is busy (a switch, or a `swapdex login` waiting \
                 for a sign-in). Finish or close it, then retry."
            );
            return Ok(4);
        }
        Err(crate::store::LockError::Unwritable(e)) => {
            eprintln!(
                "swapdex: the store is not writable ({e}) - check permissions/mount of \
                 the store directory"
            );
            return Ok(4);
        }
    };
    // Source must be a REAL profile (ghost dirs with no known tools are
    // hidden from ls - acting on them here would contradict it)...
    if !store.list().iter().any(|p| p.name == old) {
        eprintln!("swapdex: no profile named '{old}'");
        return Ok(5);
    }
    // ...while the TARGET collision checks the directory itself: colliding
    // with a hidden ghost dir must still be a clean "exists" (6), not a
    // hard error from the rename syscall.
    if store.profile_dir_exists(new) {
        eprintln!("swapdex: a profile named '{new}' already exists");
        return Ok(6);
    }
    if store.rename(old, new)? {
        println!("renamed profile '{old}' -> '{new}'");
        Ok(0)
    } else {
        eprintln!("swapdex: no profile named '{old}'");
        Ok(5)
    }
}

/// Onboarding in one step: run a tool's login flow, then save the result as a
/// named profile. Codex has a driveable CLI login; Claude Code signs in inside
/// the app, so for it swapdex guides the two-step manual path.
/// Repoint the default account at slot `name` (the `claude` shim follows this).
/// No credential is moved. Called by `use_account` when the name is a slot.
/// What a slot switch actually did, said plainly.
///
/// Moving the pointer is not the same as moving a conversation. Without a proxy
/// the change reaches the NEXT launch and nothing that is already running, and
/// reporting it as "this account now serves you" was simply false - the session
/// carried on with the old account while the line said otherwise.
pub fn switch_outcome_line(tool: &str, name: &str, proxy_running: bool) -> String {
    let bin = tool_binary(tool);
    if proxy_running {
        format!("{name} serves this session from the next turn ({bin} proxy is running)")
    } else {
        let flag = if tool == "codex" { " --tool codex" } else { "" };
        let mut out = format!("default {bin} account -> {name}\n");
        out.push_str(&format!(
            "  this applies to the NEXT {bin} you start; a session already open keeps the account it began with\n"
        ));
        out.push_str(&format!(
            "  to move one that is already running: swapdex proxy{flag}\n"
        ));
        // The surprise that costs people the most time: conversations live inside
        // the store they were started in, so a switch changes which ones -c and
        // -r can see. They are not gone, they are in the other account.
        out.push_str(
            "  note: past conversations stay with the account they were started in - \
             `swapdex whereis` finds one",
        );
        out
    }
}

fn use_slot_default(paths: &Paths, name: &str, tool: &str, dry_run: bool) -> Result<i32> {
    let bin = tool_binary(tool);
    if dry_run {
        println!("would set the default {bin} account -> {name}");
        return Ok(0);
    }
    let slots = crate::slots::Slots::open_for(paths, tool)?;
    slots.set_default(name)?;
    let proxy = crate::proxy::running_proxy_for(paths, tool).is_some();
    println!("{}", switch_outcome_line(tool, name, proxy));
    // First-time nudge: without the shim, a plain launch won't follow this.
    if !crate::shim::shim_path_for(paths, tool).exists() {
        println!(
            "  tip: run `swapdex shim` once so a plain `{bin}` follows your switches\n\
             \x20      (or launch directly with `swapdex run {name}`)"
        );
    }
    Ok(0)
}

/// Install the `claude` shim so a plain `claude` launches in the default
/// account's slot. Prints the one PATH line the user needs.
pub fn install_shim(paths: &Paths) -> Result<i32> {
    let (shim, shim_dir) = crate::shim::install(paths)?;
    println!("installed the claude shim at {}", shim.display());
    // Codex switches by pointer too, so a plain `codex` needs the same wrapper.
    // Not having Codex installed is not a failure - there is simply nothing to
    // wrap - so it is reported either way and never aborts the claude shim.
    match crate::shim::install_codex(paths)? {
        Some(p) => println!("installed the codex shim at {}", p.display()),
        None => println!("  (no `codex` on PATH - skipped its shim)"),
    }
    // Put it on PATH ourselves. Leaving that to the user is how the shim ends up
    // installed but never reached: `swapdex use` then flips a pointer nothing
    // reads, and the switch appears to work while changing nothing.
    match crate::shim::ensure_on_path(&shim_dir)? {
        crate::shim::PathSetup::AlreadyThere => {
            println!("  it is already on your PATH - a plain `claude` goes through it");
        }
        crate::shim::PathSetup::Added(profile) => {
            println!(
                "  added it to {} - open a new terminal (or `source` that file) and a plain \
                 `claude` goes through it",
                crate::util::redact_path(&profile.display().to_string())
            );
        }
        crate::shim::PathSetup::Manual => {
            println!(
                "  add this to your shell profile so it wins over the real claude:\n\
                 \x20     export PATH=\"{}:$PATH\"",
                shim_dir.display()
            );
        }
    }
    Ok(0)
}

/// A [Y/n] prompt defaulting to yes. Non-interactive (no TTY) returns false so
/// onboarding never blocks a script - it prints guidance instead.
fn ask_yes(question: &str) -> bool {
    use std::io::IsTerminal;
    let tty = std::io::stdin().is_terminal() || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
    if !tty {
        return false;
    }
    matches!(
        prompt(&format!("{question} [Y/n]"), "y").as_deref(),
        Some("y") | Some("Y") | Some("")
    )
}

/// The marker written once onboarding has been shown, so a bare `swapdex` does
/// not re-run the guided flow on every launch.
fn onboarded_marker(paths: &Paths) -> std::path::PathBuf {
    paths.store_dir().join("onboarded")
}

/// True when a bare `swapdex` should auto-run guided onboarding: it has not been
/// shown before, AND there is something to set up (existing `~/.claude-*` dirs to
/// register, or legacy copy-model Claude profiles to migrate). A brand-new user
/// with nothing to migrate is left to the normal banner/hints.
pub fn needs_onboarding(paths: &Paths) -> bool {
    if onboarded_marker(paths).exists() {
        return false;
    }
    let Ok(slots) = crate::slots::Slots::open(paths) else {
        return false;
    };
    let has_unregistered = paths
        .discover_claude_config_dirs()
        .iter()
        .any(|d| !slots.list().iter().any(|r| &r.config_dir == d));
    if has_unregistered {
        return true;
    }
    if let Ok(store) = Store::open(paths) {
        return store
            .list()
            .iter()
            .any(|p| p.tools.iter().any(|t| t == "claude-code") && slots.get(&p.name).is_none());
    }
    false
}

/// Guided first-run: detect what the user already has and walk them to a safe
/// slot setup, one [Y/n] at a time. Explains the win, hides the machinery.
pub fn onboard(paths: &Paths) -> Result<i32> {
    println!("swapdex gives each account its own space, so switching never logs you out.\n");

    // State 3: existing ~/.claude-* dirs the user runs by hand, not yet registered.
    let slots_now = crate::slots::Slots::open(paths)?;
    let unregistered: Vec<std::path::PathBuf> = paths
        .discover_claude_config_dirs()
        .into_iter()
        .filter(|d| !slots_now.list().iter().any(|r| &r.config_dir == d))
        .collect();
    if !unregistered.is_empty() {
        println!("Found Claude config dirs you already use:");
        for d in &unregistered {
            println!("  {}", d.display());
        }
        if ask_yes("Register them as swapdex accounts?") {
            let mut s = crate::slots::Slots::open(paths)?;
            for d in &unregistered {
                let name = d
                    .file_name()
                    .and_then(|n| n.to_str())
                    .map(|n| n.trim_start_matches(".claude-").to_string())
                    .filter(|n| !n.is_empty())
                    .unwrap_or_else(|| "account".into());
                match s.adopt(&name, d) {
                    Ok(r) => println!("  registered '{}'", r.name),
                    Err(e) => eprintln!("  skipped {}: {e}", d.display()),
                }
            }
        }
        println!();
    }

    // State 2: legacy copy-model Claude profiles without a slot.
    if let Ok(store) = Store::open(paths) {
        let s = crate::slots::Slots::open(paths)?;
        let legacy = store
            .list()
            .into_iter()
            .filter(|p| p.tools.iter().any(|t| t == "claude-code") && s.get(&p.name).is_none())
            .count();
        if legacy > 0 {
            println!(
                "You have {legacy} saved Claude profile(s) on the old copy-switch model \
                 (the one that could log you out)."
            );
            if ask_yes("Give each its own space now?") {
                migrate(paths)?;
                println!();
            }
        }
    }

    // Casual convenience: make a plain `claude` follow `swapdex use`.
    if !crate::shim::shim_path(paths).exists()
        && ask_yes("Make a plain `claude` follow `swapdex use`? (installs a small shim)")
    {
        install_shim(paths)?;
        println!();
    }

    // Mark it shown so a bare `swapdex` does not re-run this every launch.
    let _ = std::fs::create_dir_all(paths.store_dir());
    let _ = std::fs::write(onboarded_marker(paths), b"1");

    // Wrap up.
    if crate::slots::Slots::open(paths)?.list().is_empty() {
        println!("No accounts yet. Log into Claude, then run: swapdex run <name>");
    } else {
        println!("You're set. `swapdex ui` shows your accounts and switches between them.");
    }
    Ok(0)
}

/// Create permanent slots for the legacy copy-model Claude profiles so they can
/// be used via `run`/`use` with no credential copying. Does NOT import a token
/// (a slot's login is created by a fresh sign-in - swapdex never writes a
/// credential); it prints the accounts to log into once.
pub fn migrate(paths: &Paths) -> Result<i32> {
    let store = Store::open(paths)?;
    let mut slots = crate::slots::Slots::open(paths)?;
    let mut created = Vec::new();
    for p in store.list() {
        if !p.tools.iter().any(|t| t == "claude-code") {
            continue;
        }
        if slots.get(&p.name).is_some() {
            continue;
        }
        // A profile named after the tool would become a slot named after the
        // tool, which reads as the tool's own home and is not. This is where
        // that collision was minted, so this is where it stops.
        let taken: Vec<String> = slots.list().into_iter().map(|r| r.name).collect();
        let name = if crate::slots::name_reads_as_a_tool_home(&p.name) {
            let safe = crate::slots::suggest_non_colliding(&p.name, &taken);
            println!(
                "  '{}' would read as the tool's own home, so the account is named '{safe}'",
                p.name
            );
            safe
        } else {
            p.name.clone()
        };
        if let Ok(rec) = slots.create(&name) {
            crate::slots::link_shared_config(&rec.config_dir, paths.claude_dir(), "claude-code");
            created.push(name);
        }
    }
    if created.is_empty() {
        println!("Nothing to migrate - every Claude account already has its own space.");
        return Ok(0);
    }
    println!(
        "Created slots for: {}. Each account now has its own space - the surprise\n\
         logouts when switching are gone.",
        created.join(", ")
    );
    println!("  Log into each once (creates its own login):");
    for n in &created {
        println!("    swapdex run {n}");
    }
    if !crate::shim::shim_path(paths).exists() {
        println!("  Then `swapdex shim` so a plain `claude` follows `swapdex use`.");
    }
    Ok(0)
}

/// Share MCP servers across slots. Each Claude slot keeps its own `.claude.json`
/// (which mixes the per-account `oauthAccount` with the shareable `mcpServers`),
/// so MCP config cannot simply be symlinked like `settings.json`. This copies the
/// `mcpServers` block from the bare `~/.claude.json` into every slot's own
/// `.claude.json`, preserving each slot's account identity and other keys. Run it
/// after logging into your slots (a slot has no `.claude.json` until first login).
pub fn sync_mcp(paths: &Paths) -> Result<i32> {
    let src_path = paths.claude_config_json();
    let src: Value = if src_path.exists() {
        serde_json::from_slice(&crate::atomic::read_regular(&src_path)?).unwrap_or(Value::Null)
    } else {
        Value::Null
    };
    let mcp = src
        .get("mcpServers")
        .cloned()
        .unwrap_or_else(|| serde_json::json!({}));
    let n = mcp.as_object().map(|o| o.len()).unwrap_or(0);
    if n == 0 {
        println!("No MCP servers in ~/.claude.json to share.");
        return Ok(0);
    }
    let slots = crate::slots::Slots::open(paths)?;
    let mut synced = 0;
    let mut pending = 0;
    for r in slots.list() {
        let target = r.config_dir.join(".claude.json");
        if !target.exists() {
            pending += 1;
            continue;
        }
        let mut cfg: Value =
            serde_json::from_slice(&crate::atomic::read_regular(&target)?).unwrap_or(Value::Null);
        let Some(obj) = cfg.as_object_mut() else {
            continue;
        };
        obj.insert("mcpServers".into(), mcp.clone());
        crate::atomic::write_secret(&target, &serde_json::to_vec(&cfg)?)?;
        synced += 1;
    }
    println!("shared {n} MCP server(s) into {synced} account(s).");
    if pending > 0 {
        println!(
            "  {pending} account(s) have no login yet - sign them in from `swapdex ui` (the `l` key)."
        );
    }
    Ok(0)
}

/// Register an existing `CLAUDE_CONFIG_DIR` directory as a slot, in place.
pub fn adopt_slot(
    paths: &Paths,
    name: &str,
    dir: &std::path::Path,
    sel: Option<ToolSel>,
) -> Result<i32> {
    let tool = slot_tool(sel);
    let mut slots = crate::slots::Slots::open_for(paths, tool)?;
    let rec = slots.adopt(name, dir)?;
    println!(
        "registered '{}' ({tool}) -> {}",
        rec.name,
        rec.config_dir.display()
    );
    Ok(0)
}

/// Launch Claude in `<name>`'s permanent slot (create the slot on first use).
/// swapdex never writes the credential here - the tool's own login does, into
/// the slot's own `CLAUDE_CONFIG_DIR`. `exec` replaces this process, so this
/// only returns on failure.
pub fn run_account(
    paths: &Paths,
    name: &str,
    sel: Option<ToolSel>,
    no_launch: bool,
    args: &[String],
) -> Result<i32> {
    use std::os::unix::process::CommandExt;
    let tool = slot_tool(sel);
    let Some(home_var) = crate::slots::home_var(tool) else {
        eprintln!(
            "swapdex: {tool} has no per-account home to launch into - only claude and codex do"
        );
        return Ok(2);
    };
    let mut slots = crate::slots::Slots::open_for(paths, tool)?;
    let rec = match slots.get(name) {
        Some(r) => r,
        None => {
            let r = slots.create(name)?;
            crate::slots::link_shared_config(&r.config_dir, &shared_source(paths, tool), tool);
            r
        }
    };
    if no_launch {
        println!("account '{name}' is ready ({tool})");
        println!(
            "  its home: {}",
            crate::util::redact_path(&rec.config_dir.display().to_string())
        );
        return Ok(0);
    }
    let bin = tool_binary(tool);
    if !command_exists(bin) {
        eprintln!("swapdex: `{bin}` isn't on your PATH. Install it, then retry.");
        return Ok(3);
    }
    let mut cmd = std::process::Command::new(bin);
    cmd.args(args).env(home_var, &rec.config_dir);
    // This is the path a sign-in takes, and signing in must reach the vendor
    // directly. An inherited proxy address both breaks the OAuth code exchange
    // and answers with whichever account the proxy already holds - so a fresh
    // slot appears to be signed in as somebody else, or its prompt takes no
    // input at all. A slot launched here serves itself, so the proxy has nothing
    // to add either way.
    for var in ["ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY"] {
        cmd.env_remove(var);
    }
    let err = cmd.exec();
    Err(anyhow::anyhow!("failed to launch {bin}: {err}"))
}

/// Sign an account in and come BACK.
///
/// `run_account` replaces this process, which is right for `swapdex run` from a
/// shell and wrong for the dashboard: signing in one account tore the dashboard
/// down, so adding several meant relaunching it between each. Here the tool is a
/// child process that owns the terminal while it runs, and when it exits the
/// caller is still alive to redraw.
pub(crate) fn sign_in_child(paths: &Paths, name: &str, tool: &str) -> (bool, String) {
    let Some(home_var) = crate::slots::home_var(tool) else {
        return (
            false,
            format!("{tool} has no per-account home to sign into"),
        );
    };
    let mut slots = match crate::slots::Slots::open_for(paths, tool) {
        Ok(s) => s,
        Err(e) => return (false, format!("cannot open the account list: {e}")),
    };
    let rec = match slots.get(name) {
        Some(r) => r,
        None => match slots.create(name) {
            Ok(r) => {
                crate::slots::link_shared_config(&r.config_dir, &shared_source(paths, tool), tool);
                r
            }
            Err(e) => return (false, format!("could not make a space for '{name}': {e}")),
        },
    };
    let bin = tool_binary(tool);
    if !command_exists(bin) {
        return (false, format!("`{bin}` isn't on your PATH"));
    }
    // Signing in must reach the vendor directly - an inherited proxy address both
    // breaks the OAuth exchange and answers with whichever account the proxy
    // already holds, so a fresh space would look signed in as someone else.
    let mut cmd = Command::new(bin);
    cmd.env(home_var, &rec.config_dir);
    for var in ["ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY"] {
        cmd.env_remove(var);
    }
    match cmd.status() {
        Ok(_) => {
            // Whether the sign-in succeeded is the credential's story, not the
            // exit code's: the tool exits 0 when the user simply quits it.
            let signed_in = match tool {
                "codex" => crate::proxy::codex::slot_auth(&rec.config_dir).is_some(),
                _ => crate::proxy::creds::slot_token(&rec.config_dir).is_some(),
            };
            if signed_in {
                (true, format!("'{name}' is signed in"))
            } else {
                (
                    false,
                    format!("'{name}' still has no login - run it again and complete the sign-in"),
                )
            }
        }
        Err(e) => (false, format!("could not start {bin}: {e}")),
    }
}

/// The tool a slot command means. Slots exist for the two tools that can be
/// pointed at a per-account home; anything else is the caller's error to report.
pub(crate) fn slot_tool(sel: Option<ToolSel>) -> &'static str {
    match sel {
        Some(ToolSel::Codex) => "codex",
        Some(ToolSel::Gemini) => "gemini",
        Some(ToolSel::Antigravity) => "antigravity",
        // Claude is the default: it is what slots were built for, and every
        // existing `swapdex run <name>` must keep meaning the same thing.
        _ => "claude-code",
    }
}

fn tool_binary(tool: &str) -> &'static str {
    match tool {
        "codex" => "codex",
        _ => "claude",
    }
}

/// The bare config dir a new slot borrows its shared, account-agnostic files
/// from.
fn shared_source(paths: &Paths, tool: &str) -> std::path::PathBuf {
    match tool {
        "codex" => paths.codex_dir().to_path_buf(),
        _ => paths.claude_dir().to_path_buf(),
    }
}

/// `swapdex whereis [project]` - which account's store holds a conversation.
///
/// Switching accounts also switches which conversations `claude -c` and
/// `claude -r` can see, because Claude keeps them inside the config dir it was
/// launched with. Nothing is lost, but "no conversation found" reads exactly
/// like it was, so this says where the conversation actually is and how to
/// reopen it from any account.
pub fn whereis(paths: &Paths, project: Option<&str>) -> Result<i32> {
    // Both tools: a conversation is lost the same way in either, and someone
    // looking for theirs does not know which store to ask about.
    let mut found = crate::whereis::find(paths, project, 15);
    found.extend(crate::whereis::find_codex(paths, project, 15));
    found.sort_by_key(|f| std::cmp::Reverse(f.modified));
    found.truncate(15);
    if found.is_empty() {
        match project {
            Some(p) => println!("No conversation under a path matching '{p}', in any account."),
            None => println!("No conversations found in any account's store yet."),
        }
        return Ok(0);
    }
    println!("conversations, newest first - the account column is whose store holds it\n");
    let width = found
        .iter()
        .map(|f| f.account.chars().count())
        .max()
        .unwrap_or(8);
    for f in &found {
        println!(
            "  {:<width$} {:>8}  {}",
            f.account,
            // age_line takes the moment itself, not how long ago it was.
            age_line(f.modified as u128 * 1_000_000_000),
            f.project,
        );
        println!("    {}", f.resume_command());
    }
    println!(
        "\nnaming the config dir is what makes these work from any account - the shim\n\
         only fills that variable in when it is unset, so an explicit one always wins."
    );
    Ok(0)
}

/// `swapdex resume [project]` - reopen a conversation without first working out
/// which account owns it.
///
/// The stores cannot be merged: Claude writes a conversation into whichever
/// config dir it was launched with, and that separation is the same property
/// that stopped accounts logging each other out. What CAN be merged is the
/// looking - so this searches every account, picks the newest match, and
/// launches Claude against the store that actually holds it.
pub fn resume(paths: &Paths, project: Option<&str>) -> Result<i32> {
    use std::os::unix::process::CommandExt;
    // No argument means "this project", which is the common case and saves the
    // user having to spell out a path they are already standing in.
    let cwd = std::env::current_dir().ok();
    let filter = project
        .map(str::to_string)
        .or_else(|| cwd.as_ref().map(|d| d.display().to_string()));
    let found = crate::whereis::find(paths, filter.as_deref(), 5);
    let Some(top) = found.first() else {
        match project {
            Some(p) => {
                eprintln!("swapdex: no conversation under a path matching '{p}', in any account")
            }
            None => eprintln!(
                "swapdex: no conversation for this directory in any account - \
                 `swapdex whereis` lists what there is"
            ),
        }
        return Ok(5);
    };
    println!(
        "resuming in '{}' ({})",
        top.account,
        crate::util::redact_path(&top.config_dir.display().to_string())
    );
    if found.len() > 1 {
        // Say that a choice was made, and how to make a different one.
        println!(
            "  (newest of {} here - `swapdex whereis` lists the rest)",
            found.len()
        );
    }
    if !command_exists("claude") {
        eprintln!("swapdex: `claude` isn't on your PATH. Install it, then retry.");
        return Ok(3);
    }
    // Naming the store explicitly is what makes this work from any account: the
    // shim only fills that variable in when it is unset.
    let err = std::process::Command::new("claude")
        .arg("-r")
        .arg(&top.session_id)
        .env("CLAUDE_CONFIG_DIR", &top.config_dir)
        .exec();
    Err(anyhow::anyhow!("failed to launch claude: {err}"))
}

/// `swapdex serve [name]` - hand turns to an account without moving where new
/// sessions start.
///
/// This is the operation the whole tool exists for: one place where all your
/// conversations live, and accounts swapped underneath it as they run out. It is
/// what a credential-copying switcher gets for free by only ever having one
/// store - and what swapdex had to separate deliberately, because isolating
/// accounts is also what isolates their conversations.
pub fn serve(paths: &Paths, name: Option<&str>, off: bool, sel: Option<ToolSel>) -> Result<i32> {
    let tool = slot_tool(sel);
    let bin = tool_binary(tool);
    let slots = crate::slots::Slots::open_for(paths, tool)?;
    if off {
        slots.clear_serving()?;
        println!("each session pays for itself again ({bin})");
        return Ok(0);
    }
    let Some(name) = name else {
        match slots.serving_dir() {
            Some(dir) => {
                let who = slots
                    .list()
                    .into_iter()
                    .find(|r| r.config_dir == dir)
                    .map(|r| r.name)
                    .unwrap_or_else(|| "(unknown)".into());
                println!("turns are served by '{who}' ({bin})");
            }
            None => println!(
                "no account is directing turns ({bin}) - each session pays for itself\n                   `swapdex serve <name>` hands them to one without moving your conversations"
            ),
        }
        return Ok(0);
    };
    if slots.get(name).is_none() {
        eprintln!("swapdex: no account named '{name}' - `swapdex ui` lists them");
        return Ok(5);
    }
    slots.set_serving(name)?;
    // Start the proxy this needs. Directing turns with nothing to carry them is
    // a setting that quietly does nothing, and telling someone to run a second
    // command to make the first one take effect is the same as not doing it.
    if crate::proxy::running_proxy_for(paths, tool).is_none() {
        let _ = proxy_ensure(paths, DEFAULT_PROXY_PORT, tool);
    }
    let live = crate::proxy::running_proxy_for(paths, tool).is_some();
    println!("turns -> {name}");
    if live {
        println!("  the session you have open moves from its next turn");
    } else {
        println!(
            "  but nothing is carrying them yet - `swapdex proxy{}` in another terminal",
            if tool == "codex" { " --tool codex" } else { "" }
        );
    }
    println!(
        "  your conversations stay where they are - this changed who pays, not where you work"
    );
    Ok(0)
}

/// `swapdex refresh [name]` - renew a lapsed access token so the account stays
/// usable without signing in again.
///
/// An access token lives about an hour; an account idle longer than that is not
/// broken, it just needs renewing, and only its own refresh token can do it.
pub fn refresh(paths: &Paths, name: Option<&str>) -> Result<i32> {
    let slots = crate::slots::Slots::open_for(paths, "claude-code")?;
    let list: Vec<_> = match name {
        Some(n) => match slots.get(n) {
            Some(r) => vec![r],
            None => {
                eprintln!("swapdex: no account named '{n}' - `swapdex ui` lists them");
                return Ok(5);
            }
        },
        None => slots.list(),
    };
    if list.is_empty() {
        println!("No Claude accounts to renew.");
        return Ok(0);
    }
    let now = now_ms();
    let mut renewed = 0;
    for r in &list {
        if !crate::proxy::creds::slot_token_expired(&r.config_dir, now) {
            println!("  {} is already current", r.name);
            continue;
        }
        match crate::refresh::refresh_slot(&r.config_dir, now) {
            Ok(()) => {
                println!("  {} renewed", r.name);
                renewed += 1;
            }
            Err(why) => println!("  {}", why.remedy(&r.name)),
        }
    }
    if renewed > 0 {
        println!("\n{renewed} account(s) renewed - no sign-in needed.");
    }
    Ok(0)
}

/// List the permanent slots (name + the config dir each launches into).
pub fn list_slots(paths: &Paths) -> Result<i32> {
    // Both tools, each under its own heading. Listing only Claude's hid half the
    // accounts from the command whose whole job is to show them.
    let mut any = false;
    for tool in ["claude-code", "codex"] {
        let list = crate::slots::Slots::open_for(paths, tool)?.list();
        if list.is_empty() {
            continue;
        }
        let pointer = crate::slots::Slots::open_for(paths, tool)?.default_dir();
        println!("{tool}:");
        for r in list {
            // The default is what a plain launch of that tool will use, which is
            // the one thing a list of directories cannot otherwise show.
            let mark = if pointer.as_deref() == Some(r.config_dir.as_path()) {
                "*"
            } else {
                " "
            };
            println!("{mark} {}  {}", r.name, r.config_dir.display());
        }
        any = true;
    }
    if !any {
        println!("No accounts yet. Run `swapdex onboard` to set them up,");
        println!("  or launch one directly: swapdex run <name>");
        return Ok(0);
    }
    println!("  (* is the account a plain launch uses)");
    Ok(0)
}

pub fn login(paths: &Paths, name: &str, sel: Option<ToolSel>) -> Result<i32> {
    crate::atomic::ensure_not_root()?;
    if let Some(c) = reject_bad_name(name).or_else(|| reject_reserved_name(name)) {
        return Ok(c);
    }
    let tool = match sel {
        Some(ToolSel::Claude) => "claude-code",
        Some(ToolSel::Codex) => "codex",
        Some(ToolSel::Gemini) => "gemini",
        Some(ToolSel::Antigravity) => "antigravity",
        _ => {
            // Never guess which tool the user means (real-use feedback: the
            // old codex-if-installed default kept asking about the wrong
            // tool). On a terminal, ask; otherwise require --tool.
            use std::io::IsTerminal;
            let tty =
                std::io::stdin().is_terminal() || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
            if !tty {
                eprintln!("swapdex: say which tool: swapdex login {name} --tool <claude|codex|gemini|antigravity>");
                return Ok(2);
            }
            println!("Which tool do you want to log '{name}' into?");
            println!("  1) Claude Code   2) Codex   3) Gemini CLI   4) Antigravity");
            loop {
                match prompt("pick [1-4] (Enter cancels): ", "").as_deref() {
                    Some("1") => break "claude-code",
                    Some("2") => break "codex",
                    Some("3") => break "gemini",
                    Some("4") => break "antigravity",
                    Some("") | None => {
                        println!("cancelled.");
                        return Ok(0);
                    }
                    _ => println!("pick a number between 1 and 4 (Enter cancels)"),
                }
            }
        }
    };

    // One flow for all four tools from here on.
    let bin = match tool {
        "claude-code" => "claude",
        "codex" => "codex",
        "gemini" => "gemini",
        _ => "agy",
    };
    if !command_exists(bin) {
        // stderr + exit 3: `login x && ...` in a script must not proceed as
        // if a login was saved.
        eprintln!("swapdex: `{bin}` isn't on your PATH. Install it, then retry.");
        return Ok(3);
    }
    let adapter = adapters::by_name(tool).expect("known tool");
    let flag = pretty_tool_flag(tool);

    let Some(cur) = adapter.identity(paths).ok().flatten() else {
        // Not logged in at all: run the tool's own sign-in, then capture.
        // (codex has a real `login` subcommand; the others sign in on first
        // run of the app itself.)
        println!(
            "Opening {} to sign in. Complete the login{}",
            pretty_tool(tool),
            if tool == "codex" {
                " in your browser.".to_string()
            } else {
                ", then exit it.".to_string()
            }
        );
        spawn_tool_login(bin, tool)?;
        if adapter.identity(paths).ok().flatten().is_none() {
            eprintln!(
                "swapdex: no {} login was completed - nothing saved.",
                pretty_tool(tool)
            );
            return Ok(8);
        }
        println!();
        // update=true so re-running `login <name>` refreshes an existing profile.
        return add(paths, Some(name), sel_for_tool(tool), true);
    };

    // Already logged in - the user wants to ADD a different account. Do the
    // whole thing: save the current login, sign out locally, run the tool's
    // sign-in, capture the new account. The original login is stashed in the
    // store and restored on any failure, so this can never lose an account.
    use std::io::IsTerminal;
    let tty = std::io::stdin().is_terminal() || std::env::var_os("SWAPDEX_ASSUME_TTY").is_some();
    if !tty {
        // Scripts get guidance - this flow is interactive.
        println!(
            "You're already logged into {} ({}).",
            pretty_tool(tool),
            identity_line(&cur)
        );
        println!("  save the current account:  swapdex add {name} --tool {flag}");
        println!(
            "  add a DIFFERENT account:   swapdex login {name} --tool {flag}  (on a terminal)"
        );
        // Exit 3, not 0: `login x && use x` in a script must not proceed as
        // if a login was saved (nothing was).
        return Ok(3);
    }
    println!("Currently logged in as {}.", identity_line(&cur));
    if !yes_no(
        &format!(
            "Sign in to a DIFFERENT account as '{name}'? swapdex will save the \
             current login, sign you out locally, and open {} for the \
             new sign-in. [Y/n]: ",
            pretty_tool(tool)
        ),
        true,
    ) {
        println!("cancelled - nothing changed.");
        return Ok(0);
    }
    let store = Store::open(paths)?;
    let lock1 = match store.lock() {
        Ok(g) => g,
        Err(crate::store::LockError::Busy) => {
            eprintln!(
                "swapdex: another swapdex is busy (a switch, or a `swapdex login` waiting \
                 for a sign-in). Finish or close it, then retry."
            );
            return Ok(4);
        }
        Err(crate::store::LockError::Unwritable(e)) => {
            eprintln!(
                "swapdex: the store is not writable ({e}) - check permissions/mount of \
                 the store directory"
            );
            return Ok(4);
        }
    };
    // Take the per-tool credential lock and HOLD it across the whole flow -
    // including the interactive sign-in, during which the store lock (lock1) is
    // released so unrelated ops proceed. This is what stops a concurrent
    // `swapdex use` on THIS tool from interleaving with our sign-out/sign-in and
    // pairing the wrong token with the new account. Held to end of function.
    let _tool_lock = match store.lock_tool(tool) {
        Ok(g) => g,
        Err(_) => {
            eprintln!(
                "swapdex: another swapdex is signing {tool} in/out right now. \
                 Finish or close it, then retry."
            );
            return Ok(4);
        }
    };
    // 1) The current login, saved twice over: a store backup (restore can
    //    always bring it back) plus a refresh of every profile holding it -
    //    and, if unmatched, an offer to keep it under a name.
    let stash = adapter.capture(paths)?;
    store.backup(&stash)?;
    for pname in matching_profile_names(&store, tool, &cur.account_id) {
        store.save(&pname, &stash)?;
    }
    if matched_profile_name(&store, tool, &cur.account_id).is_none() {
        // No email on disk (antigravity): suggest a plain name instead of a
        // sanitized display string like "GoogleaccountAntigravity".
        let suggestion = match &cur.email {
            Some(e) => suggest_name(e),
            None => "main".to_string(),
        };
        while let Some(keep) = ask_name(
            &store,
            &format!("name to keep the CURRENT account under [{suggestion}]: "),
            &suggestion,
        ) {
            if keep == name {
                // '{name}' is reserved for the NEW account - accepting it here
                // would let the new sign-in silently overwrite the current one.
                println!("'{name}' is the name for the NEW account - pick another.");
                continue;
            }
            store.save(&keep, &stash)?;
            println!("saved current login as '{keep}'.");
            break;
        }
    }
    // 2) Local sign-out, so the tool's own flow prompts a FRESH sign-in.
    sign_out_locally(paths, tool);
    // Verify the sign-out actually took. Two independent checks:
    // - identity: same account still resolvable (e.g. an aliased
    //   CLAUDE_CONFIG_DIR kept .claude.json's oauthAccount alive);
    // - present: a CREDENTIAL still lingers even with the identity gone
    //   (e.g. a second suffixed macOS Keychain item that keychain_delete's
    //   discovery did not target). Proceeding then is worse than the trust
    //   prompt: the eventual capture could pair the OLD token with the NEW
    //   account's identity - a profile that switches to the wrong login.
    // Either way: abort clearly and restore.
    let still_same = adapter
        .identity(paths)
        .ok()
        .flatten()
        .is_some_and(|still| still.account_id == cur.account_id);
    if still_same || adapter.present(paths) {
        adapter.apply(paths, &stash)?;
        drop(lock1);
        eprintln!(
            "swapdex: couldn't sign {} out of the current account ({}), so a new \
             account can't be added this way - your login is unchanged.",
            pretty_tool(tool),
            identity_line(&cur)
        );
        eprintln!("  {}", same_account_hint(tool));
        return Ok(0);
    }
    // RELEASE the store lock before the interactive sign-in: it can take
    // minutes (or be left open), and holding it would block every other
    // swapdex - rename, use, everything - with "another swapdex is
    // mid-switch". The stash is already safe in the store's backups.
    drop(lock1);
    // 3) Fresh sign-in inside the official app.
    println!(
        "Opening {} - sign in with the OTHER account{}",
        pretty_tool(tool),
        if tool == "codex" {
            " in your browser.".to_string()
        } else {
            ", then exit it.".to_string()
        }
    );
    // Proactive warning: the tool may re-use a cached browser session and log
    // you straight back into the SAME account without asking. Tell them how to
    // avoid it BEFORE it happens.
    println!("  tip: {}", same_account_hint(tool));
    let spawn = spawn_tool_login(bin, tool);
    // Re-take the STORE lock for the final store-global writes (timeline,
    // profile save). The per-tool credential lock above already excludes a
    // concurrent switch on THIS tool, so this only serializes with other-tool
    // ops - a bounded retry instead of the old single-shot best-effort that
    // could write the timeline unlocked. No other op holds the store lock for
    // long (only login has an interactive wait, and same-tool login is excluded
    // by the per-tool lock), so this settles in well under the bound; the None
    // fallback only avoids discarding the user's completed sign-in in the rare
    // case it truly can't be taken.
    let mut relock = store.lock().ok();
    for _ in 0..25 {
        if relock.is_some() {
            break;
        }
        std::thread::sleep(std::time::Duration::from_millis(120));
        relock = store.lock().ok();
    }
    let _lock = relock;
    // 4) Capture, or restore the stash on any failure.
    let new_id = adapter.identity(paths).ok().flatten();
    match (spawn, new_id) {
        (Ok(status), Some(new)) if !new.account_id.is_empty() => {
            if new.account_id == cur.account_id {
                // The tool re-used its browser session and signed BACK INTO
                // the same account - swapdex removed the local login, but it
                // cannot force the tool's OAuth to offer an account picker.
                // Do NOT save a duplicate profile under a new name; explain
                // how to actually reach the other account, and restore the
                // stash so the login is exactly as it was.
                adapter.apply(paths, &stash)?;
                eprintln!(
                    "swapdex: you were signed back into the SAME account ({}), so \
                     nothing was saved as '{name}'.",
                    identity_line(&new)
                );
                eprintln!("  {}", same_account_hint(tool));
                eprintln!(
                    "  (to just save THIS account under a name, use `swapdex add {name} \
                     --tool {}`.)",
                    pretty_tool_flag(tool)
                );
                return Ok(0);
            }
            // Same repoint rule as `add --update`: if '{name}' already has a
            // snapshot for this tool, changing what the name means must be
            // explicit. An UNREADABLE snapshot counts as "different" - corrupt
            // and absent must not be conflated, or the guard is bypassable.
            let has_tool_snapshot = store
                .list()
                .iter()
                .any(|p| p.name == name && p.tools.iter().any(|t| t == tool));
            let same_account = profile_account_id(&store, name, tool)
                .filter(|s| !s.is_empty())
                .as_deref()
                == Some(new.account_id.as_str());
            if has_tool_snapshot
                && !same_account
                && !yes_no(
                    &format!(
                        "profile '{name}' already holds a different (or unreadable) \
                         {tool} account. Repoint it to this new login? [y/N]: "
                    ),
                    false,
                )
            {
                // The user completed a REAL sign-in - never discard it
                // silently. Offer a different name; skipping restores the
                // stash and honestly says the new sign-in is gone.
                if let Some(rescue) = ask_name(
                    &store,
                    "save the NEW account under a different name instead (Enter discards it): ",
                    "",
                ) {
                    if rescue != name {
                        let snap = adapter.capture(paths)?;
                        store.save(&rescue, &snap)?;
                        println!(
                            "saved profile '{rescue}' ({}). '{name}' is untouched.",
                            identity_line(&new)
                        );
                        println!("switch back any time:  swapdex use <name>  (or `swapdex ui`)");
                        return Ok(0);
                    }
                }
                adapter.apply(paths, &stash)?;
                println!(
                    "the new sign-in was DISCARDED and your previous login restored - \
                     '{name}' is untouched. Re-run `swapdex login <other-name>` to \
                     redo it under another name."
                );
                return Ok(0);
            }
            let snap = adapter.capture(paths)?;
            store.save(name, &snap)?;
            println!("saved profile '{name}' ({}).", identity_line(&new));
            if tool == "antigravity" {
                // Honesty over silence: the token file stores no email or
                // account id, so the same-account check above can never fire
                // here and ls cannot show WHO this is.
                println!(
                    "note: Antigravity stores no account identity on disk - swapdex \
                     cannot confirm WHICH Google account this is; verify inside agy."
                );
            }
            if !status.success() {
                println!(
                    "note: {} exited with an error after signing in - if anything \
                     looks off, `swapdex restore --tool {flag}` undoes this.",
                    pretty_tool(tool)
                );
            }
            println!("switch back any time:  swapdex use <name>  (or `swapdex ui`)");
            Ok(0)
        }
        _ => {
            adapter.apply(paths, &stash)?;
            eprintln!(
                "swapdex: no new {} login was completed - your previous \
                 login ({}) was restored.",
                pretty_tool(tool),
                identity_line(&cur)
            );
            Ok(8)
        }
    }
}

/// The ToolSel a canonical tool name maps back to.
fn sel_for_tool(tool: &str) -> Option<ToolSel> {
    match tool {
        "claude-code" => Some(ToolSel::Claude),
        "codex" => Some(ToolSel::Codex),
        "gemini" => Some(ToolSel::Gemini),
        "antigravity" => Some(ToolSel::Antigravity),
        _ => None,
    }
}

/// Run the tool's own sign-in command, terminal inherited. codex has a real
/// `login` subcommand; the other three sign in on first run of the app.
/// Whether `codex login` should get `--device-auth` (the device-code flow):
/// on by DEFAULT, opt out with `SWAPDEX_CODEX_LOGIN=browser`. Codex's default
/// login is a localhost-redirect browser flow, which needs a browser that can
/// reach localhost on the SAME machine - it fails over SSH / on a headless box
/// (swapdex's common remote use). Pure so the policy is unit-tested.
fn codex_device_auth(opt_out_browser: bool) -> bool {
    !opt_out_browser
}

/// Read the opt-out from the environment: `SWAPDEX_CODEX_LOGIN=browser`.
fn codex_login_opts_out_of_device() -> bool {
    std::env::var("SWAPDEX_CODEX_LOGIN").is_ok_and(|v| v.eq_ignore_ascii_case("browser"))
}

fn spawn_tool_login(bin: &str, tool: &str) -> Result<std::process::ExitStatus> {
    // A shell Ctrl+C during the interactive sign-in hits the whole foreground
    // process group. With the default disposition it would kill swapdex before
    // the restore-stash branch runs - leaving the user locally signed out of
    // everything. A no-op HANDLER (not SIG_IGN: handlers reset to default
    // across exec, SIG_IGN would be inherited by the child) makes swapdex
    // ride it out; the child keeps normal Ctrl+C behavior.
    unsafe extern "C" fn ride_out(_: libc::c_int) {}
    #[allow(function_casts_as_integer)]
    let prev_int = unsafe { libc::signal(libc::SIGINT, ride_out as libc::sighandler_t) };
    #[allow(function_casts_as_integer)]
    let prev_quit = unsafe { libc::signal(libc::SIGQUIT, ride_out as libc::sighandler_t) };
    let mut cmd = Command::new(bin);
    match tool {
        // Codex has a `login` subcommand; Claude Code a proper `auth login`
        // that does JUST the OAuth sign-in (no workspace-trust / session
        // detour); Gemini / Antigravity sign in on first run of the app.
        "codex" => {
            cmd.arg("login");
            // Device-code flow by default so login works over SSH / headless
            // (opt out with SWAPDEX_CODEX_LOGIN=browser). A codex old enough to
            // lack the flag can opt out; current codex ships it.
            if codex_device_auth(codex_login_opts_out_of_device()) {
                cmd.arg("--device-auth");
            }
        }
        "claude-code" => {
            cmd.args(["auth", "login"]);
        }
        _ => {}
    }
    let status = cmd.status();
    unsafe {
        libc::signal(libc::SIGINT, prev_int);
        libc::signal(libc::SIGQUIT, prev_quit);
    }
    status.map_err(|e| anyhow::anyhow!("could not run {bin}: {e}"))
}

/// Remove the live credential files so the tool's next run prompts a fresh
/// sign-in. Claude keeps the rest of .claude.json (projects, settings) - only
/// the oauthAccount block goes.
fn sign_out_locally(paths: &Paths, tool: &str) {
    match tool {
        "claude-code" => {
            // Sign out LOCALLY only - deliberately NOT `claude auth logout`.
            // That command REVOKES the OAuth token server-side, which kills the
            // snapshot we captured one step earlier AND every saved profile
            // that shares this account - the "all my logins got signed out"
            // disaster. A safe switcher must never destroy a login it exists to
            // preserve. Clearing the local Keychain item + credential file is
            // enough for Claude to prompt a fresh sign-in for the NEW account,
            // and the stashed token stays valid so `restore` / switching back
            // still works. This matches what claude-swap and Symbioose do
            // (local `security delete`, never a server-revoking logout).
            std::fs::remove_file(paths.claude_credentials()).ok();
            crate::adapters::claude::keychain_delete();
            if let Ok(bytes) = std::fs::read(paths.claude_config_json()) {
                if let Ok(mut cfg) = serde_json::from_slice::<Value>(&bytes) {
                    if let Some(obj) = cfg.as_object_mut() {
                        obj.remove("oauthAccount");
                        if let Ok(out) = serde_json::to_vec(&cfg) {
                            let _ = crate::atomic::write_secret(&paths.claude_config_json(), &out);
                        }
                    }
                }
            }
        }
        "codex" => {
            std::fs::remove_file(paths.codex_auth()).ok();
        }
        "gemini" => {
            std::fs::remove_file(paths.gemini_oauth()).ok();
            std::fs::remove_file(paths.gemini_accounts()).ok();
        }
        _ => {
            std::fs::remove_file(paths.antigravity_token()).ok();
        }
    }
}

/// Ask a question and read a trimmed line; empty input yields `default`.
/// Ask on stdout, read a line. `None` means the input stream ENDED (Ctrl-D or
/// a closed pipe) - callers must stop asking, or the wizard would spin forever
/// re-prompting into a stream that can never answer.
fn prompt(question: &str, default: &str) -> Option<String> {
    use std::io::Write;
    print!("{question}");
    let _ = std::io::stdout().flush();
    let mut line = String::new();
    match std::io::stdin().read_line(&mut line) {
        Ok(0) | Err(_) => return None, // EOF or broken stream
        Ok(_) => {}
    }
    let t = line.trim();
    Some(if t.is_empty() {
        default.to_string()
    } else {
        t.to_string()
    })
}

/// A default profile name from an email/display (its local part, sanitized).
fn suggest_name(who: &str) -> String {
    let base = who.split('@').next().unwrap_or(who);
    let clean: String = base
        .chars()
        .filter(|c| c.is_alphanumeric() || *c == '-' || *c == '_')
        .collect();
    if crate::store::valid_profile_name(&clean) {
        clean
    } else {
        "account".to_string()
    }
}

/// A friendly tool label for prompts.
/// How to actually reach a DIFFERENT account when the tool keeps signing you
/// back into the same one from a cached browser session. swapdex removes the
/// local credential but cannot control the tool's own OAuth prompt.
fn same_account_hint(tool: &str) -> String {
    match tool {
        "claude-code" => "To add a different account: sign out at claude.ai in your browser \
             first (or use /logout then /login inside Claude Code and pick the other \
             account), then run this again."
            .to_string(),
        "codex" => "Codex re-used your ChatGPT browser session. Sign out at chatgpt.com \
             (or open the login in a different browser / private window), then run this \
             again."
            .to_string(),
        _ => "The tool re-used your signed-in Google account. Choose the OTHER account at \
             Google's account picker (or sign the first one out in your browser), then \
             run this again."
            .to_string(),
    }
}

fn pretty_tool(tool: &str) -> &str {
    match tool {
        "claude-code" => "Claude Code",
        "codex" => "Codex",
        "gemini" => "Gemini CLI",
        "antigravity" => "Antigravity",
        other => other,
    }
}

/// A yes/no prompt; empty input takes `default_yes`.
fn yes_no(question: &str, default_yes: bool) -> bool {
    // EOF answers "no": never take an irreversible step on a dead stream.
    let Some(a) = prompt(question, if default_yes { "y" } else { "n" }) else {
        return false;
    };
    matches!(a.to_ascii_lowercase().as_str(), "y" | "yes")
}

/// Ask for a profile name, re-prompting until it is valid (or the user skips).
/// An existing name asks whether to replace it. Returns None on skip.
fn ask_name(store: &Store, question: &str, default: &str) -> Option<String> {
    loop {
        let ans = prompt(question, default)?; // EOF -> skip, never loop
        if ans.eq_ignore_ascii_case("skip") || ans.is_empty() {
            return None;
        }
        if !crate::store::valid_profile_name(&ans) {
            println!("  '{ans}' can't be a name (1-64 bytes, not all spaces; no '/', '\\\\', leading '.', or control chars). Try again.");
            continue;
        }
        // ask_name only ever names a NEW profile, so reject the reserved "-"
        // here too - `valid_profile_name` intentionally allows it (legacy "-"
        // profiles must stay rm/rename-able), but CREATION must not, or setup
        // would mint a "-" that breaks `use -`. `add`/`rename` reject it via a
        // separate post-check; setup had none.
        if ans == "-" {
            println!(
                "  '-' is reserved (`swapdex use -` toggles to the previous profile). Try again."
            );
            continue;
        }
        if store.list().iter().any(|p| p.name == ans)
            && !yes_no(
                &format!("  '{ans}' already exists - replace it? [y/N]: "),
                false,
            )
        {
            continue;
        }
        return Some(ans);
    }
}

/// Guided first-run onboarding: save the accounts you're logged into, offer to
/// add more, and show how to switch. Interactive (needs a TTY).
pub fn setup(paths: &Paths) -> Result<i32> {
    use std::io::IsTerminal;
    crate::atomic::ensure_not_root()?;
    // SWAPDEX_ASSUME_TTY lets the test suite drive the prompts over a pipe.
    if !std::io::stdin().is_terminal() && std::env::var_os("SWAPDEX_ASSUME_TTY").is_none() {
        eprintln!(
            "swapdex setup is interactive - run it in a terminal, or use `swapdex login <name>`."
        );
        return Ok(1);
    }
    let store = Store::open(paths)?;
    println!(
        "swapdex keeps several Claude Code / Codex / Gemini / Antigravity logins and switches between them."
    );
    println!(
        "Let's save the accounts you use. Press Enter to accept a [default], Ctrl-C to quit.\n"
    );

    // 1) Save the accounts you're currently logged into.
    for adapter in adapters::all() {
        let tool = adapter.name();
        // A corrupt/unreadable login for ONE tool (e.g. a hand-edited
        // ~/.claude.json) must not abort the whole wizard before the other,
        // valid tools get saved. Treat an error like "not logged in": warn
        // and continue to the next tool.
        let id = match adapter.identity(paths) {
            Ok(Some(id)) => id,
            Ok(None) => {
                println!("{}: not logged in - skipping.\n", pretty_tool(tool));
                continue;
            }
            Err(e) => {
                println!(
                    "{}: login present but unreadable ({}) - skipping.\n",
                    pretty_tool(tool),
                    crate::util::redact_path(&format!("{e:#}"))
                );
                continue;
            }
        };
        if let Some(existing) = matched_profile_name(&store, tool, &id.account_id) {
            println!("{}: already saved as '{existing}'.\n", pretty_tool(tool));
            continue;
        }
        let who = id.email.clone().unwrap_or_else(|| id.display.clone());
        let default = suggest_name(&who);
        println!("{}: you're logged in as {who}.", pretty_tool(tool));
        // Attaching this tool to an existing profile of the same suggested
        // name is the NORMAL multi-tool case (`swapdex add <name>` semantics)
        // - never scare with "replace it?" for it, and never skip it.
        if let Some(p) = store.list().into_iter().find(|p| p.name == default) {
            if !p.tools.iter().any(|t| t == tool) {
                // One unreadable tool must not abort the whole wizard.
                match adapter.capture(paths) {
                    Ok(snap) => {
                        store.save(&default, &snap)?;
                        println!("  attached {} to '{default}'.\n", pretty_tool(tool));
                    }
                    Err(e) => {
                        eprintln!("  could not read this login ({e:#}) - skipped.\n");
                    }
                }
                continue;
            }
        }
        match ask_name(
            &store,
            &format!("  save it as [{default}] (Enter to accept, 'skip' to skip): "),
            &default,
        ) {
            Some(name) => match adapter.capture(paths) {
                Ok(snap) => {
                    store.save(&name, &snap)?;
                    println!("  saved as '{name}'.\n");
                }
                Err(e) => {
                    eprintln!("  could not read this login ({e:#}) - skipped.\n");
                }
            },
            None => println!("  skipped.\n"),
        }
    }

    // 2) Offer to add more accounts - ANY tool, through the same one-flow
    //    login (save current, sign out locally, fresh sign-in, capture).
    println!("You can keep several accounts per tool (e.g. work and personal).");
    loop {
        if !yes_no("  add another account now? [y/N]: ", false) {
            break;
        }
        println!("  which tool?  1) Claude Code   2) Codex   3) Gemini CLI   4) Antigravity");
        let sel = loop {
            match prompt("  pick [1-4] (Enter cancels): ", "").as_deref() {
                Some("1") => break Some(ToolSel::Claude),
                Some("2") => break Some(ToolSel::Codex),
                Some("3") => break Some(ToolSel::Gemini),
                Some("4") => break Some(ToolSel::Antigravity),
                Some("") | None => break None,
                _ => println!("  pick a number between 1 and 4 (Enter cancels)"),
            }
        };
        let Some(sel) = sel else {
            println!("  skipped.\n");
            continue;
        };
        let name = match ask_name(&store, "  name for it (e.g. personal): ", "") {
            Some(n) => n,
            None => {
                println!("  skipped.\n");
                continue;
            }
        };
        let _ = login(paths, &name, Some(sel))?;
        println!();
    }

    // 3) Summary.
    let names: Vec<String> = store.list().into_iter().map(|p| p.name).collect();
    println!();
    if names.is_empty() {
        println!(
            "No accounts saved yet. Log into Claude Code or Codex, then run `swapdex setup` again."
        );
    } else {
        println!("You're set - saved: {}.", names.join(", "));
        println!("  switch:   swapdex use <name>");
        println!("  see all:  swapdex ls");
        if names.len() > 1 {
            println!("Switching takes effect on your next message - no restart needed.");
        }
    }
    Ok(0)
}

fn now_ms() -> i64 {
    std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_millis() as i64)
        .unwrap_or(0)
}

fn now_secs() -> u64 {
    std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_secs())
        .unwrap_or(0)
}

pub fn usage(paths: &Paths, json: bool) -> Result<i32> {
    let rows = crate::usage::tool_usage(paths);
    if json {
        let out: Vec<Value> = rows
            .iter()
            .map(|r| {
                let accounts: serde_json::Map<String, Value> = r
                    .accounts
                    .iter()
                    .map(|(name, (t5, t7))| {
                        (
                            name.clone(),
                            serde_json::json!({"last_5h_tokens": t5, "last_7d_tokens": t7}),
                        )
                    })
                    .collect();
                serde_json::json!({
                    "tool": r.tool,
                    "last_5h": {"sessions": r.w5h.sessions, "tokens": r.w5h.tokens},
                    "last_7d": {"sessions": r.w7d.sessions, "tokens": r.w7d.tokens},
                    "accounts": accounts,
                })
            })
            .collect();
        println!("{}", serde_json::to_string(&out)?);
        return Ok(0);
    }
    if rows.iter().all(|r| r.w7d.sessions == 0) {
        println!("No recent session activity found (reads ~/.claude and ~/.codex, locally).");
        return Ok(0);
    }
    println!("Local usage - this machine, approximate (not the billed quota):");
    for r in &rows {
        if r.w7d.sessions == 0 {
            continue;
        }
        println!(
            "  {:<12} 5h: {:>7} tok / {} sess    7d: {:>8} tok / {} sess",
            r.tool,
            crate::usage::human(r.w5h.tokens),
            r.w5h.sessions,
            crate::usage::human(r.w7d.tokens),
            r.w7d.sessions,
        );
        // Per-account rows via the switch timeline; the untagged remainder is
        // whatever predates the first switch.
        for (name, (t5, t7)) in &r.accounts {
            println!(
                "    @{:<11} 5h: {:>7} tok           7d: {:>8} tok",
                name,
                crate::usage::human(*t5),
                crate::usage::human(*t7),
            );
        }
        let attributed7: u64 = r.accounts.values().map(|(_, t7)| *t7).sum();
        let rest = r.w7d.tokens.saturating_sub(attributed7);
        if !r.accounts.is_empty() && rest > 0 {
            println!(
                "    {:<12} 5h:                       7d: {:>8} tok (before your first switch)",
                "(untagged)",
                crate::usage::human(rest),
            );
        }
    }
    // Honesty for the two tools usage CANNOT cover: they keep no token
    // transcripts on disk, so a gemini/antigravity-heavy user must not read
    // the silence as "no usage".
    let uncovered: Vec<&str> = ["gemini", "antigravity"]
        .into_iter()
        .filter(|t| {
            adapters::by_name(t)
                .map(|a| a.present(paths))
                .unwrap_or(false)
        })
        .collect();
    if !uncovered.is_empty() {
        println!(
            "note: {} not shown - those CLIs keep no local token transcripts to read",
            uncovered.join(" and ")
        );
    }
    println!("(summed locally from session transcripts; accounts via the switch timeline)");
    Ok(0)
}

/// The address a Codex home is signed in as - a label for the row, read with the
/// same decoder the adapter uses, which keeps only the `email` claim.
fn codex_slot_email(dir: &std::path::Path) -> Option<String> {
    let bytes = std::fs::read(dir.join("auth.json")).ok()?;
    let v: Value = serde_json::from_slice(&bytes).ok()?;
    adapters::codex::decode_email_from_id_token(v["tokens"]["id_token"].as_str())
}

/// The config dir of the slot registered under `name`, if there is one.
fn slot_dir_named(paths: &Paths, name: &str) -> Option<std::path::PathBuf> {
    crate::slots::Slots::open(paths)
        .ok()?
        .list()
        .into_iter()
        .find(|r| r.name == name)
        .map(|r| r.config_dir)
}

/// `swapdex quota` - the one opt-in network command. Reads each Claude account's
/// REMAINING quota from Anthropic's usage endpoint (that account's own token,
/// read-only, zero message spend). The active account uses its live token; a
/// saved-but-inactive account uses its snapshot token, which may have expired
/// (swapdex does not refresh tokens - that is the switcher/rotator line). All
/// network rules live in src/quota.rs; this function only orchestrates + renders.
pub fn quota(paths: &Paths, json: bool) -> Result<i32> {
    use crate::quota::{self as q, Fetch};

    struct Row {
        /// Display label (may carry an "(active)" marker).
        label: String,
        /// The plain profile name - what `--json` reports and `use` hints take.
        name: String,
        email: Option<String>,
        token: Option<String>,
        active: bool,
        /// The saved token has already lapsed. Sending it earns a refusal that
        /// looks like the endpoint being busy, so it is never sent.
        expired: bool,
    }

    let live_id = adapters::claude::Claude.identity(paths).ok().flatten();
    let live_uuid = live_id
        .as_ref()
        .map(|a| a.account_id.clone())
        .filter(|s| !s.is_empty());
    let live_token = adapters::claude::live_credentials(paths)
        .as_deref()
        .and_then(q::token_from_credentials);

    let mut rows: Vec<Row> = Vec::new();
    let mut matched_live = false;
    if let Ok(store) = Store::open(paths) {
        for p in store.list() {
            if !p.tools.iter().any(|t| t == "claude-code") {
                continue;
            }
            let snap = store.load(&p.name, "claude-code").ok().flatten();
            let (mut email, mut uuid, mut token) = (None, None, None);
            let mut expired = false;
            if let Some(s) = &snap {
                if let Some(o) = s
                    .part("oauth_account")
                    .and_then(|o| serde_json::from_slice::<Value>(o.expose()).ok())
                {
                    email = o["emailAddress"].as_str().map(str::to_string);
                    uuid = o["accountUuid"].as_str().map(str::to_string);
                }
                token = s
                    .part("credentials")
                    .and_then(|c| q::token_from_credentials(c.expose()));
                expired = s
                    .part("credentials")
                    .is_some_and(|c| q::credentials_expired(c.expose(), now_ms()));
            }
            // A profile and a slot can carry the same name: the profile is the
            // old copied snapshot, the slot is where that account lives now.
            // Only one of the two is alive - the tool refreshes the slot's
            // credential in place, while nothing refreshes a copy - so the slot
            // answers for the account and the snapshot is not consulted at all.
            if let Some(dir) = slot_dir_named(paths, &p.name) {
                if let Some(t) = crate::proxy::creds::slot_token(&dir) {
                    token = Some(String::from_utf8_lossy(t.expose()).to_string());
                    expired = crate::proxy::creds::slot_token_expired(&dir, now_ms());
                    email = crate::proxy::creds::slot_email(&dir).or(email);
                    uuid = crate::proxy::creds::slot_account_uuid(&dir).or(uuid);
                }
            }
            let active = live_uuid.is_some() && uuid == live_uuid;
            matched_live |= active;
            rows.push(Row {
                label: if active {
                    format!("{} (active)", p.name)
                } else {
                    p.name.clone()
                },
                name: p.name.clone(),
                email: if active {
                    live_id.as_ref().and_then(|a| a.email.clone()).or(email)
                } else {
                    email
                },
                token: if active { live_token.clone() } else { token },
                active,
                // The live login is refreshed by Claude itself, so only a
                // SNAPSHOT can be stale.
                expired: expired && !active,
            });
        }
    }
    // Slot accounts too: they hold their own credential (that is the point of the
    // model), so a quota list without them omits exactly the accounts the proxy
    // rotates between. Their token is read from the slot, never copied.
    if let Ok(slots) = crate::slots::Slots::open(paths) {
        for r in slots.list() {
            if rows.iter().any(|x| x.name == r.name) {
                continue;
            }
            let token = crate::proxy::creds::slot_token(&r.config_dir)
                .map(|t| String::from_utf8_lossy(t.expose()).to_string());
            let uuid = crate::proxy::creds::slot_account_uuid(&r.config_dir);
            let active = live_uuid.is_some() && uuid == live_uuid;
            matched_live |= active;
            rows.push(Row {
                label: if active {
                    format!("{} (active)", r.name)
                } else {
                    r.name.clone()
                },
                name: r.name.clone(),
                email: crate::proxy::creds::slot_email(&r.config_dir),
                token,
                active,
                // A slot's token is renewable, so renew it rather than report it
                // dead - an account idle for an hour is not an account with a
                // problem, and it is usually the one with quota left.
                expired: {
                    if crate::proxy::creds::slot_token_expired(&r.config_dir, now_ms()) {
                        let _ = crate::refresh::refresh_slot(&r.config_dir, now_ms());
                    }
                    crate::proxy::creds::slot_token_expired(&r.config_dir, now_ms())
                },
            });
        }
    }
    // A live login that is not saved as any profile still deserves a line.
    if !matched_live && live_token.is_some() {
        rows.insert(
            0,
            Row {
                label: "(active login, not saved)".into(),
                name: "(active login, not saved)".into(),
                email: live_id.as_ref().and_then(|a| a.email.clone()),
                token: live_token.clone(),
                active: true,
                expired: false,
            },
        );
    }
    rows.sort_by_key(|r| !r.active);

    if rows.is_empty() {
        if json {
            println!("{}", serde_json::json!({"accounts": [], "offline": null}));
        } else {
            println!(
                "No Claude accounts found. Log in with `claude`, or `swapdex add` to save one."
            );
        }
        return Ok(0);
    }

    let now = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_secs() as i64)
        .unwrap_or(0);

    // Fetch each account. If the first attempt that actually leaves the machine
    // fails at the transport layer, we are almost certainly offline - stop
    // rather than fire every account's token at an unreachable endpoint.
    let mut results: Vec<(usize, Fetch)> = Vec::new();
    let mut to_fetch: Vec<(usize, String)> = Vec::new();
    let mut offline: Option<String> = None;
    for (i, r) in rows.iter().enumerate() {
        match &r.token {
            None => results.push((i, Fetch::Offline("no saved token".into()))),
            // Do not ask on behalf of a token that has already lapsed. The
            // endpoint refuses it the same way it refuses a burst, so the answer
            // would read as "busy, try again in a moment" - advice that can never
            // come true, and three retries per dead account that make the
            // endpoint busier for the accounts that CAN answer.
            Some(_) if r.expired => results.push((
                i,
                Fetch::Offline(
                    "saved token expired - snapshots go stale as refresh tokens rotate; \
                     `swapdex run <name>` gives this account a slot that stays fresh"
                        .into(),
                ),
            )),
            // An unusable token is a PER-ACCOUNT problem (corrupt snapshot),
            // not a transport failure - it must never masquerade as "the
            // network is down" and abort the whole run.
            Some(t) if !q::token_usable(t) => results.push((
                i,
                Fetch::Offline(
                    "saved token unusable (corrupt snapshot?) - `swapdex add <name> --update` \
                     re-saves it"
                        .into(),
                ),
            )),
            // Collected and read together below: one round trip per account in
            // sequence was most of the wait.
            Some(t) => to_fetch.push((i, t.clone())),
        }
    }
    if !to_fetch.is_empty() {
        let got = q::fetch_many(to_fetch);
        // If NOTHING reached the endpoint, this is the machine being offline
        // rather than a per-account problem, and saying so once beats saying it
        // per account.
        let any_reached = got.iter().any(|(_, f)| !matches!(f, Fetch::Offline(_)));
        if !any_reached {
            if let Some((_, Fetch::Offline(msg))) = got.first() {
                offline = Some(msg.clone());
            }
        }
        results.extend(got);
    }
    results.sort_by_key(|(i, _)| *i);

    // Remember what came back, here where the reading is actually taken - every
    // caller of this command then benefits, including the dashboard, which cannot
    // record a reading it never received.
    let remembered: Vec<(String, crate::quota_cache::Entry)> = results
        .iter()
        .filter_map(|(i, f)| match f {
            Fetch::Ok(qd) => Some((
                rows[*i].name.clone(),
                crate::quota_cache::Entry {
                    five_h: qd.five_hour.map(|w| w.used_pct),
                    five_h_reset: qd.five_hour.and_then(|w| w.resets_at),
                    seven_d: qd.seven_day.map(|w| w.used_pct),
                    seven_d_reset: qd.seven_day.and_then(|w| w.resets_at),
                    at: now,
                },
            )),
            _ => None,
        })
        .collect();
    crate::quota_cache::update(paths, &remembered);

    if json {
        let accounts: Vec<Value> = results
            .iter()
            .map(|(i, f)| {
                quota_json(
                    &rows[*i].name,
                    rows[*i].email.as_deref(),
                    rows[*i].active,
                    f,
                )
            })
            .collect();
        println!(
            "{}",
            serde_json::json!({"accounts": accounts, "offline": offline})
        );
        return Ok(0);
    }

    if let Some(msg) = offline {
        println!("swapdex quota: could not reach api.anthropic.com - {msg}");
        println!(
            "(quota is the only swapdex command that uses the network; everything else is local)"
        );
        return Ok(0);
    }

    println!("quota - remaining on your Claude accounts");
    println!("live from Anthropic's usage endpoint; opt-in network, spends 0 message quota.\n");
    for (i, f) in &results {
        let r = &rows[*i];
        match &r.email {
            Some(e) => println!("{}   {}", r.label, e),
            None => println!("{}", r.label),
        }
        match f {
            Fetch::Ok(qd) => {
                let mut any = false;
                if let Some(w) = qd.five_hour {
                    println!("  {}", win_line("5h", &w, now));
                    any = true;
                }
                if let Some(w) = qd.seven_day {
                    println!("  {}", win_line("7d", &w, now));
                    any = true;
                }
                for (label, w) in &qd.scoped {
                    println!("  {}", win_line(label, w, now));
                    any = true;
                }
                if !any {
                    println!(
                        "  (endpoint reported no windows - `swapdex quota --json` to inspect)"
                    );
                }
            }
            Fetch::Unauthorized => {
                if r.active {
                    println!("  active token rejected - run `claude` once to refresh, then retry");
                } else {
                    println!(
                        "  snapshot token expired - `swapdex use {}` to refresh, then `swapdex quota`",
                        r.name
                    );
                }
            }
            Fetch::Unexpected(code, _) => {
                println!(
                    "  unexpected response (HTTP {code}) - run `swapdex quota --json` to see it"
                );
            }
            Fetch::Offline(msg) => println!("  {msg}"),
            // The ENDPOINT was busy, not this account - saying "no data" here
            // would read as a problem with the account itself.
            Fetch::Throttled => println!(
                "  usage endpoint busy just now - the account is fine, try again in a moment"
            ),
        }
        println!();
    }
    println!("this is the only swapdex command that touches the network.");
    Ok(0)
}

/// Render one window as a remaining-percent bar with its reset countdown.
fn win_line(label: &str, w: &crate::quota::Window, now: i64) -> String {
    let rem = w.remaining_pct();
    let filled = ((rem / 100.0) * 10.0).round().clamp(0.0, 10.0) as usize;
    let bar: String = "\u{2593}".repeat(filled) + &"\u{2591}".repeat(10 - filled);
    let reset = match w.resets_at {
        Some(ts) => format!("   resets in {}", human_until(now, ts)),
        None => String::new(),
    };
    format!("{label:<9} {bar}  {rem:>3.0}% left{reset}")
}

/// A coarse "2h 14m" / "3d 4h" countdown to `ts` from `now` (unix seconds).
fn human_until(now: i64, ts: i64) -> String {
    let d = ts - now;
    if d <= 0 {
        return "now".into();
    }
    let (days, hrs, mins) = (d / 86400, (d % 86400) / 3600, (d % 3600) / 60);
    if days > 0 {
        format!("{days}d {hrs}h")
    } else if hrs > 0 {
        format!("{hrs}h {mins}m")
    } else {
        format!("{mins}m")
    }
}

/// One account's quota as JSON (for `swapdex quota --json`). An unexpected shape
/// carries the raw body so the exact endpoint schema is never lost.
fn quota_json(label: &str, email: Option<&str>, active: bool, f: &crate::quota::Fetch) -> Value {
    use crate::quota::{Fetch, Window};
    fn win(w: &Window) -> Value {
        serde_json::json!({
            "used_pct": (w.used_pct * 10.0).round() / 10.0,
            "remaining_pct": (w.remaining_pct() * 10.0).round() / 10.0,
            "resets_at": w.resets_at,
        })
    }
    let mut o = serde_json::json!({"name": label, "email": email, "active": active});
    let m = o.as_object_mut().expect("json object");
    match f {
        Fetch::Ok(q) => {
            m.insert("status".into(), Value::String("ok".into()));
            m.insert(
                "five_hour".into(),
                q.five_hour.as_ref().map(win).unwrap_or(Value::Null),
            );
            m.insert(
                "seven_day".into(),
                q.seven_day.as_ref().map(win).unwrap_or(Value::Null),
            );
            let scoped: Vec<Value> = q
                .scoped
                .iter()
                .map(|(n, w)| {
                    let mut wj = win(w);
                    wj.as_object_mut()
                        .unwrap()
                        .insert("label".into(), Value::String(n.clone()));
                    wj
                })
                .collect();
            m.insert("scoped".into(), Value::Array(scoped));
        }
        Fetch::Unauthorized => {
            m.insert("status".into(), Value::String("expired".into()));
        }
        Fetch::Unexpected(code, body) => {
            m.insert("status".into(), Value::String("unexpected".into()));
            m.insert("http".into(), Value::from(*code));
            m.insert("raw".into(), Value::String(body.clone()));
        }
        Fetch::Throttled => {
            m.insert("status".into(), Value::String("throttled".into()));
            m.insert(
                "note".into(),
                Value::String("the usage endpoint is rate-limited, not this account".into()),
            );
        }
        Fetch::Offline(msg) => {
            m.insert("status".into(), Value::String("offline".into()));
            m.insert("detail".into(), Value::String(msg.clone()));
        }
    }
    o
}

pub fn sessions(paths: &Paths, json: bool) -> Result<i32> {
    if json {
        // Scripting parity with the human view: {"accounts": {...}, "total": N}.
        // available=false distinguishes "no sessionwiki" from "zero sessions".
        let out = match crate::session_link::sessions_by_account(paths) {
            None => serde_json::json!({"available": false, "accounts": {}, "total": 0}),
            Some(counts) => {
                let total: usize = counts.values().sum();
                serde_json::json!({"available": true, "accounts": counts, "total": total})
            }
        };
        println!("{}", serde_json::to_string(&out)?);
        return Ok(0);
    }
    match crate::session_link::sessions_by_account(paths) {
        None => {
            println!(
                "session data unavailable - install sessionwiki to group sessions by account \
                 (`swapdex ui` already lists your recent sessions without it)"
            );
        }
        Some(counts) if counts.is_empty() => {
            // sessionwiki responded but its index is empty - the fresh-install
            // landmine. Say the one command that fixes it.
            println!("no sessions found (sessionwiki index empty - run `sessionwiki sync` once)");
        }
        Some(counts) => {
            for (account, n) in &counts {
                println!("{:<20} {n}", account);
            }
        }
    }
    Ok(0)
}

fn identity_line(id: &Account) -> String {
    let who = id.email.clone().unwrap_or_else(|| id.display.clone());
    match &id.tier {
        Some(t) => format!("{who} [{t}]"),
        None => who,
    }
}

fn expiry_note(expires_at: Option<i64>) -> String {
    // expiresAt is epoch millis. An OAuth ACCESS token lapses about hourly and
    // the tool refreshes it silently, so "expired" for a just-lapsed token is
    // pure noise (this is the `status` twin of the 0.20.0 ls/marker fix that
    // this line was missed by). Only note a snapshot older than STALE_DAYS,
    // where the refresh token itself may be dead and a re-login is plausible.
    match expires_at {
        Some(ms) if now_ms() - ms > STALE_DAYS * 86400 * 1000 => {
            " - login is old; may re-prompt if its refresh token has expired".to_string()
        }
        _ => String::new(),
    }
}

fn warn_if_expired(target: &crate::adapters::Snapshot, tool: &str) {
    if tool != "claude-code" {
        return;
    }
    if let Some(cred) = target.part("credentials") {
        if let Ok(v) = serde_json::from_slice::<Value>(cred.expose()) {
            // Only warn for an ANCIENT snapshot (>30d) whose refresh token may
            // be dead - a normally-expired access token (~1h) is refreshed
            // silently, so warning every switch was noise.
            if let Some(ms) = v["claudeAiOauth"]["expiresAt"].as_i64() {
                if now_ms() - ms > STALE_DAYS * 86400 * 1000 {
                    eprintln!("swapdex: note - this saved login is old; Claude may re-prompt for login if its refresh token has expired");
                }
            }
        }
    }
}

#[cfg(test)]
mod tests {
    use super::{human_until, keychain_verdict, win_line};

    fn s(items: &[&str]) -> Vec<String> {
        items.iter().map(|i| i.to_string()).collect()
    }

    #[test]
    fn human_until_formats_countdowns() {
        assert_eq!(human_until(1000, 900), "now", "past resets read as now");
        assert_eq!(human_until(0, 30), "0m", "sub-minute rounds down");
        assert_eq!(human_until(0, 2 * 3600 + 14 * 60), "2h 14m");
        assert_eq!(human_until(0, 3 * 86400 + 4 * 3600), "3d 4h");
    }

    #[test]
    fn win_line_shows_remaining_bar_and_reset() {
        let w = crate::quota::Window {
            used_pct: 61.0,
            resets_at: Some(2 * 3600 + 14 * 60),
        };
        let line = win_line("5h", &w, 0);
        assert!(line.contains("39% left"), "{line}");
        assert!(line.contains("resets in 2h 14m"), "{line}");
        let full = crate::quota::Window {
            used_pct: 0.0,
            resets_at: None,
        };
        let line = win_line("7d", &full, 0);
        assert!(line.contains("100% left"), "{line}");
        assert!(!line.contains("resets"), "no reset when absent: {line}");
    }

    const BARE: &str = "Claude Code-credentials";

    // The real-world multi-profile layout (one user, three CLAUDE_CONFIG_DIR
    // profiles): bare + two suffixed items, all LIVE logins.
    fn three_profiles() -> Vec<String> {
        s(&[
            BARE,
            "Claude Code-credentials-5953ba74",
            "Claude Code-credentials-feeb5ea6",
        ])
    }

    #[test]
    fn keychain_verdict_silent_when_no_item() {
        assert!(
            keychain_verdict(&[], Some(BARE), BARE).is_none(),
            "nothing to report if Claude has no Keychain item"
        );
    }

    #[test]
    fn keychain_verdict_manages_own_env_profile_among_aliased_siblings() {
        // No env -> swapdex manages the bare item; the suffixed items are
        // OTHER profiles (claude-work aliases) and must be called that - not
        // "stale strays" to delete.
        let (ok, msg) = keychain_verdict(&three_profiles(), Some(BARE), BARE).unwrap();
        assert!(ok, "coexisting aliased profiles are healthy: {msg}");
        assert!(msg.contains("other CLAUDE_CONFIG_DIR profiles"), "{msg}");
        assert!(msg.contains("never touches"), "{msg}");
    }

    #[test]
    fn keychain_verdict_single_profile_is_plain_ok() {
        let (ok, msg) = keychain_verdict(&s(&[BARE]), Some(BARE), BARE).unwrap();
        assert!(ok);
        assert!(msg.contains("managing this environment's profile"), "{msg}");
    }

    // Device-code login policy: on by default, SWAPDEX_CODEX_LOGIN=browser opts
    // out. (That the flag actually reaches `codex login` is the argv test below.)
    #[test]
    fn device_auth_policy() {
        use super::codex_device_auth;
        assert!(codex_device_auth(false), "device-auth by default");
        assert!(!codex_device_auth(true), "opt-out -> browser flow");
    }

    // #4: a restore whose apply FAILS must not strand the requested backup. The
    // outgoing login is backed up only AFTER apply succeeds; otherwise it becomes
    // the newest backup and a retry sees it as "already active", never restoring
    // the target we were asked for.
    #[test]
    fn failed_restore_keeps_the_requested_backup_newest() {
        use crate::adapters::claude::Claude;
        use crate::adapters::AuthTool;
        use crate::paths::Paths;
        use crate::store::Store;

        fn seed(p: &Paths, uuid: &str, email: &str) {
            std::fs::create_dir_all(p.claude_credentials().parent().unwrap()).unwrap();
            std::fs::write(
                p.claude_credentials(),
                serde_json::to_vec(&serde_json::json!({"claudeAiOauth": {
                    "accessToken": "AT", "refreshToken": "RT", "expiresAt": 9999999999999i64,
                    "scopes": ["x"], "subscriptionType": "max", "rateLimitTier": "default"}}))
                .unwrap(),
            )
            .unwrap();
            std::fs::write(
                p.claude_config_json(),
                serde_json::to_vec(&serde_json::json!({
                    "oauthAccount": {"accountUuid": uuid, "emailAddress": email}}))
                .unwrap(),
            )
            .unwrap();
        }

        // Backup A (the target) lives in the LIVE machine's store.
        let liveroot = tempfile::tempdir().unwrap();
        let plive = Paths::rooted(liveroot.path());
        let aroot = tempfile::tempdir().unwrap();
        let pa = Paths::rooted(aroot.path());
        seed(&pa, "uuid-A", "a@x.com");
        let snap_a = Claude.capture(&pa).unwrap();
        let store = Store::open(&plive).unwrap();
        store.backup(&snap_a).unwrap();

        // The live login is B (a different account).
        seed(&plive, "uuid-B", "b@y.com");

        // Force apply(A) to fail: plant a dir at the .claude.json atomic temp path.
        let cfg = plive.claude_config_json();
        let tmp = cfg.parent().unwrap().join(format!(
            ".{}.swapdex.tmp",
            cfg.file_name().unwrap().to_str().unwrap()
        ));
        std::fs::create_dir(&tmp).unwrap();

        assert!(
            super::restore(&plive, None, false).is_err(),
            "apply must fail (planted temp dir)"
        );

        // A must still be the NEWEST backup: B was never promoted, so a retry
        // restores A instead of hitting "already active".
        let (_stamp, newest) = store.load_backup("claude-code").unwrap().unwrap();
        assert_eq!(
            super::snapshot_account_id(&newest, "claude-code").as_deref(),
            Some("uuid-A"),
            "a failed restore must not strand A by making B the newest backup"
        );
    }

    #[test]
    fn keychain_verdict_flags_refused_ambiguity() {
        // The derived item does not exist and several profiles are present:
        // resolution refuses to guess (target None) and doctor explains.
        let found = s(&[
            "Claude Code-credentials-5953ba74",
            "Claude Code-credentials-feeb5ea6",
        ]);
        let (ok, msg) = keychain_verdict(&found, None, BARE).unwrap();
        assert!(!ok, "refused ambiguity is a finding");
        assert!(msg.contains("refuses to guess"), "{msg}");
        assert!(msg.contains("CLAUDE_CONFIG_DIR"), "{msg}");
        assert!(msg.contains(BARE), "names the missing derived item: {msg}");
    }

    #[test]
    fn keychain_verdict_single_item_fallback_is_ok_with_note() {
        // Alias-only setup: env derives bare (missing), the only login is a
        // suffixed item - swapdex manages it, with a pointer to the env.
        let (ok, msg) = keychain_verdict(
            &s(&["Claude Code-credentials-5953ba74"]),
            Some("Claude Code-credentials-5953ba74"),
            BARE,
        )
        .unwrap();
        assert!(ok, "managing the only existing login works: {msg}");
        assert!(msg.contains("only"), "{msg}");
        assert!(msg.contains("CLAUDE_CONFIG_DIR"), "{msg}");
    }

    #[test]
    fn keychain_verdict_flags_target_not_in_found() {
        // Defensive: the two keychain reads disagreed.
        let (ok, msg) =
            keychain_verdict(&s(&["Claude Code-credentials-5953ba74"]), Some(BARE), BARE).unwrap();
        assert!(!ok);
        assert!(msg.contains("re-run"), "{msg}");
    }
}