claude-multiacc 1.0.11 → 1.0.13

package/bin/codex-accounts

@@ -146,6 +146,36 @@ os.replace(path + '.tmp', path)
 PYEOF
 }
 
+# ---- per-account login lock ----------------------------------------------------
+# Two concurrent logins for the SAME account corrupt each other: the later one
+# snapshots the OLD credential and its abort/refusal "restores" that stale
+# credential over the fresh one the first sign-in produced. A ceremony can take
+# minutes, so the lock is only reclaimed after 30 minutes (holder presumed dead).
+# Stale reclaim is ATOMIC between contenders: rename steals the stale lock
+# (exactly one mv succeeds); the loser finds a live lock and refuses. Release is
+# OWNERSHIP-GUARDED (owner.<pid> marker), so a process can never remove a lock a
+# later contender legitimately re-took.
+login_lock_acquire() { # $1 = lock dir; nonzero when someone else holds it
+  local L="$1"
+  if ! mkdir "$L" 2>/dev/null; then
+    [ $(( $(epoch_now) - $(file_mtime "$L") )) -gt 1800 ] || return 1
+    mv "$L" "$L.stale.$$" 2>/dev/null || return 1
+    rm -rf "$L.stale.$$" 2>/dev/null
+    mkdir "$L" 2>/dev/null || return 1
+  fi
+  : > "$L/owner.$$" 2>/dev/null || true
+  return 0
+}
+login_lock_release() { # $1 = lock dir; removes it ONLY if this process owns it
+  local L="$1"
+  [ -e "$L/owner.$$" ] && rm -rf "$L" 2>/dev/null
+  return 0
+}
+login_lock_busy() { # $1 = acct dir; true when a LIVE login ceremony holds it
+  [ -d "$1/.login-lock" ] \
+    && [ $(( $(epoch_now) - $(file_mtime "$1/.login-lock") )) -le 1800 ]
+}
+
 auto_sync() { # best effort after mutations, Mac only, loud on failure
   [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CODEX_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
@@ -421,8 +451,25 @@ cmd_add() {
   mutate_lock || die "could not acquire the account lock — try again"
   owner="$(email_owner "$got")"
   if [ -n "$owner" ]; then
-    mutate_unlock
-    echo "$got is already added as $owner — skipping (nothing added)."
+    # The sign-in itself succeeded and produced a fresh credential for an account
+    # that is already registered — don't throw it away: save it to that account,
+    # exactly as `login $owner` would have. This machine now runs $owner.
+    # Needs the owner's login lock (non-blocking): writing under a mid-ceremony
+    # login for that account would corrupt it.
+    local od="$ACC_ROOT/$owner"
+    seed_account_dir "$od"
+    if login_lock_acquire "$od/.login-lock" && mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+      chmod 600 "$od/auth.json" 2>/dev/null || true
+      clear_auth_markers "$od"
+      login_lock_release "$od/.login-lock"
+      mutate_unlock
+      log_to ops.log "add redirect: signed in as $got (already $owner) — credential saved to $owner"
+      echo "$got is already added as $owner — the fresh sign-in was saved to $owner (usable on this machine now)."
+    else
+      login_lock_release "$od/.login-lock"
+      mutate_unlock
+      echo "$got is already added as $owner — skipping (nothing added)."
+    fi
     return 0   # RESERVED_DIR still set -> trap removes the temp dir
   fi
   if [ -n "$email" ] && [ "$got" != "$email" ]; then
@@ -619,6 +666,10 @@ cmd_remove() {
     read -r ans
     case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
   fi
+  # Never delete an account out from under a live sign-in ceremony: the login's
+  # cleanup would then operate on a removed (or later recreated) path.
+  login_lock_busy "$ACC_ROOT/$id" \
+    && die "a login for $id is in progress — finish or abort it first"
   if [ -L "$ACC_ROOT/$id" ]; then
     rm -f "${ACC_ROOT:?}/${id:?}"   # adopted account: remove the symlink, never the target
   else
@@ -658,6 +709,18 @@ for a in json.load(open(sys.argv[1])).get('accounts', []):
         break
 PYEOF
 )"
+  # PER-ACCOUNT login lock (observed in the field: parallel relogin runs left a
+  # months-dead token inside a minutes-old auth.json — see login_lock_acquire).
+  local llock="$d/.login-lock"
+  login_lock_acquire "$llock" \
+    || die "another login for $id is already in progress (this terminal or another) — finish or abort it first"
+  # Released on EVERY exit: normal returns, die (exit fires EXIT), Ctrl-C (the INT
+  # handler exits, which fires EXIT). Runs in a subshell under relogin, so the trap
+  # scope is exactly this one login. Ownership-guarded: never removes a lock a
+  # later contender re-took.
+  # shellcheck disable=SC2064
+  trap "login_lock_release '$llock'" EXIT
+
   echo "Sign in as $email for $id."
   # Snapshot the credential BEFORE the ceremony: `codex login` writes auth.json into
   # the dir directly, so a sign-in to the WRONG account would otherwise leave that
@@ -692,6 +755,36 @@ PYEOF
   got_lc="$(printf '%s' "$got" | tr '[:upper:]' '[:lower:]')"
   email_lc="$(printf '%s' "$email" | tr '[:upper:]' '[:lower:]')"
   if [ -n "$got" ] && [ "$got_lc" != "$email_lc" ] && [ "$force" != "1" ]; then
+    # Signed in as a DIFFERENT account. If that account is registered in this pool,
+    # the sign-in was not a mistake worth discarding — route the fresh credential to
+    # ITS account dir (what `login <owner>` would have produced), restore this
+    # account's prior state, and report honestly that THIS account is still unfixed.
+    local owner
+    owner="$(email_owner "$got")"
+    if [ -n "$owner" ] && [ "$owner" != "$id" ]; then
+      # The redirect mutates the OWNER's credential, so it needs the owner's login
+      # lock too (non-blocking: if a login for that account is mid-ceremony, writing
+      # under it would recreate exactly the corruption this lock prevents — skip the
+      # redirect and fall through to the plain refusal instead).
+      local od="$ACC_ROOT/$owner"
+      seed_account_dir "$od"
+      if login_lock_acquire "$od/.login-lock"; then
+        if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+          chmod 600 "$od/auth.json" 2>/dev/null || true
+          clear_auth_markers "$od"
+          login_lock_release "$od/.login-lock"
+          restore_snap
+          trap - INT TERM
+          log_to ops.log "login redirect: signed in as $got -> credential saved to $owner (target was $id)"
+          echo "you signed in as $got — that is $owner, so the credential was saved to $owner (usable now)."
+          echo "$id ($email) still needs its own sign-in: codex-accounts login $id"
+          return 1
+        fi
+        login_lock_release "$od/.login-lock"
+      else
+        echo "note: a login for $owner is in progress — not saving this credential there."
+      fi
+    fi
     restore_snap
     trap - INT TERM
     die "you signed in as $got but $id is $email — nothing saved, previous credential restored (use --force to override)"
@@ -819,12 +912,27 @@ cmd_relogin() {
     read -r ans
     case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
   fi
+  # Accounts that were BROKEN when this run started: if one of them turns healthy
+  # mid-run (a redirected sign-in from an earlier iteration landed its credential),
+  # asking the user to sign it in again would be pure friction — it gets skipped.
+  # Accounts that were healthy at start (explicit ids / --all) are never skipped:
+  # the user asked to re-authenticate them on purpose.
+  local pre_bad
+  pre_bad=" $(accounts_needing_login 2>/dev/null | tr '\n' ' ') "
   # One sync at the end instead of one per account: each auto_sync is an ssh round trip.
   local prev_no_sync="${CODEX_MULTIACC_NO_SYNC:-0}" failed="" done_ok=0
   export CODEX_MULTIACC_NO_SYNC=1
   for id in $ids; do
     echo
     echo "=== $id ==============================================================="
+    case "$pre_bad" in
+      *" $id "*)
+        if [ "$(account_audit 2>/dev/null | awk -F'\t' -v i="$id" '$1 == i { print $4 }')" = "ok" ]; then
+          echo "$id already has a working login (a credential landed during an earlier sign-in) — skipping."
+          done_ok=$((done_ok + 1))
+          continue
+        fi ;;
+    esac
     if [ "$browser" = "1" ]; then
       ( cmd_login "$id" --browser ) && done_ok=$((done_ok + 1)) || failed="$failed $id"
     else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -1757,6 +1757,62 @@ EOF
 )"
 [ "$got_email" = "d@cx" ] && t_ok "codex: refused login restores the prior credential" \
   || t_fail "codex login restore" "auth.json now belongs to: $got_email"
+# signing in as a DIFFERENT-but-REGISTERED account routes the credential to that
+# account instead of discarding it (and the target account stays honestly unfixed)
+rm -f "$CX/acct-01/auth.json"
+out="$(FAKE_EMAIL=a@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+check "codex: cross-account sign-in is redirected, not discarded" "credential was saved to acct-01" "$out"
+check "codex: redirect says the target still needs its sign-in" "acct-04 (d@cx) still needs its own sign-in" "$out"
+[ "$rc" != "0" ] && t_ok "codex: redirected login still exits nonzero for the target" \
+  || t_fail "codex redirect rc" "rc=0 for an account that was not fixed"
+[ -s "$CX/acct-01/auth.json" ] && t_ok "codex: redirected credential landed at its owner" \
+  || t_fail "codex redirect landing" "acct-01/auth.json missing"
+got_email="$(python3 - "$CX/acct-04/auth.json" <<'EOF'
+import base64, json, sys
+t = json.load(open(sys.argv[1]))['tokens']['id_token']
+p = t.split('.')[1]; p += '=' * (-len(p) % 4)
+print(json.loads(base64.urlsafe_b64decode(p)).get('email', ''))
+EOF
+)"
+[ "$got_email" = "d@cx" ] && t_ok "codex: redirect restored the target's prior credential" \
+  || t_fail "codex redirect restore" "acct-04 auth.json belongs to: $got_email"
+# `add` while signed into an already-registered account also keeps the credential
+rm -f "$CX/acct-01/auth.json"
+before_dirs="$(ls "$CX" | sort)"
+out="$(FAKE_EMAIL=a@cx codex-accounts add 2>&1)"
+rc=$?
+check "codex: add of a registered account saves the fresh sign-in to it" "fresh sign-in was saved to acct-01" "$out"
+[ "$rc" = "0" ] && t_ok "codex: add redirect exits 0 (nothing new to register)" || t_fail "codex add redirect rc" "rc=$rc"
+[ -s "$CX/acct-01/auth.json" ] && t_ok "codex: add redirect landed the credential" \
+  || t_fail "codex add redirect" "acct-01/auth.json missing"
+[ "$before_dirs" = "$(ls "$CX" | sort)" ] && t_ok "codex: add redirect leaves no reserved dir behind" \
+  || t_fail "codex add redirect cleanup" "pool dirs changed"
+n="$(grep -c '"email": "a@cx"' "$CX/accounts.json")"
+[ "$n" = "1" ] && t_ok "codex: add redirect creates no duplicate entry" || t_fail "codex add redirect dup" "count=$n"
+# relogin end-to-end: a redirect mid-run fixes the OTHER account, whose own turn is
+# then skipped instead of demanding a second sign-in. Both accounts' home must be
+# THIS machine's kind, or a credless account reads as 'remote' (grant lives
+# elsewhere) on the other platform and never enters the worklist.
+cx_mk=mac; [ "$(uname -s)" = "Darwin" ] || cx_mk=linux
+python3 - "$CX/accounts.json" "$cx_mk" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+for a in d['accounts']:
+    if a['id'] in ('acct-01', 'acct-04'):
+        a['home'] = sys.argv[2]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+rm -f "$CX/acct-01/auth.json" "$CX/acct-04/auth.json"
+out="$(FAKE_EMAIL=d@cx codex-accounts relogin --yes 2>&1)"
+rc=$?
+check "codex: relogin redirect saves the mis-ordered sign-in" "credential was saved to acct-04" "$out"
+check "codex: relogin skips an account fixed mid-run" "already has a working login" "$out"
+check "codex: relogin counts the redirect-fixed account" "re-authenticated 1 of 2" "$out"
+check "codex: relogin still reports the unfixed account" "still failing: acct-01" "$out"
+[ "$rc" != "0" ] && t_ok "codex: relogin with an unfixed account exits nonzero" || t_fail "codex relogin redirect rc" "rc=0"
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+mk_cx_auth "$CX/acct-04/auth.json" d@cx "$FUTURE_EXP"
 # the sign-in ceremony is DEVICE-CODE by default (the localhost browser callback
 # cannot reach a remote/SSH machine); --browser opts into the callback flow
 export FAKE_LOGIN_ARGS="$WORK/cx-login-args"
@@ -1772,6 +1828,69 @@ rc=$?
 { [ "$rc" = "0" ] && [ "$(cat "$FAKE_LOGIN_ARGS")" = "" ]; } \
   && t_ok "codex: --browser opts into the localhost callback flow" \
   || t_fail "codex --browser opt-out" "rc=$rc login args: '$(cat "$FAKE_LOGIN_ARGS")'"
+# lock released after a completed login
+[ ! -d "$CX/acct-04/.login-lock" ] && t_ok "codex: login lock released after completion" \
+  || { t_fail "codex login lock release" ".login-lock survived a completed login"; rmdir "$CX/acct-04/.login-lock" 2>/dev/null; }
+# a SECOND concurrent login for the same account is refused before any ceremony —
+# a parallel run snapshotting the old credential could otherwise "restore" it over
+# the fresh one (field incident: months-dead token inside a minutes-old auth.json)
+mkdir "$CX/acct-04/.login-lock"
+export FAKE_LOGIN_ARGS="$WORK/cx-login-args"
+: > "$FAKE_LOGIN_ARGS"
+cp "$CX/acct-04/auth.json" "$WORK/cx-lock-auth.bak"
+out="$(FAKE_EMAIL=d@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+check "codex: concurrent login for the same account is refused" "already in progress" "$out"
+[ "$rc" != "0" ] && t_ok "codex: concurrent login exits nonzero" || t_fail "codex login lock rc" "rc=0"
+[ ! -s "$FAKE_LOGIN_ARGS" ] && t_ok "codex: refused concurrent login never ran a ceremony" \
+  || t_fail "codex login lock ceremony" "codex login was invoked despite the lock"
+cmp -s "$CX/acct-04/auth.json" "$WORK/cx-lock-auth.bak" \
+  && t_ok "codex: refused concurrent login left the credential untouched" \
+  || t_fail "codex login lock credential" "auth.json changed"
+# a STALE lock (holder died >30min ago) is reclaimed, not fatal
+python3 - "$CX/acct-04/.login-lock" <<'EOF'
+import os, sys, time
+t = time.time() - 2000
+os.utime(sys.argv[1], (t, t))
+EOF
+out="$(FAKE_EMAIL=d@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: stale login lock is reclaimed" || t_fail "codex stale login lock" "rc=$rc: $out"
+[ ! -d "$CX/acct-04/.login-lock" ] && t_ok "codex: reclaimed lock released again" \
+  || { t_fail "codex stale lock release" "lock left behind"; rmdir "$CX/acct-04/.login-lock" 2>/dev/null; }
+# lock released after a FAILED ceremony too
+FAKE_LOGIN_FAIL=1 FAKE_EMAIL=d@cx codex-accounts login acct-04 >/dev/null 2>&1
+[ ! -d "$CX/acct-04/.login-lock" ] && t_ok "codex: login lock released after a failed ceremony" \
+  || { t_fail "codex login lock on failure" "lock left behind"; rmdir "$CX/acct-04/.login-lock" 2>/dev/null; }
+# remove refuses to delete an account under a live ceremony
+mkdir "$CX/acct-04/.login-lock"
+out="$(codex-accounts remove acct-04 --yes 2>&1)"
+rc=$?
+check "codex: remove refuses during a live login" "login for acct-04 is in progress" "$out"
+[ "$rc" != "0" ] && [ -d "$CX/acct-04" ] && t_ok "codex: account survives a remove during login" \
+  || t_fail "codex remove guard" "rc=$rc dir_exists=$([ -d "$CX/acct-04" ] && echo yes || echo no)"
+rmdir "$CX/acct-04/.login-lock"
+# a redirect never writes under a mid-ceremony login on the OWNER account either:
+# it skips the save and falls back to the plain refusal
+mkdir "$CX/acct-01/.login-lock"
+mv "$CX/acct-01/auth.json" "$WORK/cx-a01.hold"
+out="$(FAKE_EMAIL=a@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+check "codex: redirect skipped while the owner has a login in progress" "login for acct-01 is in progress" "$out"
+[ "$rc" != "0" ] && t_ok "codex: skipped redirect still refuses" || t_fail "codex busy-owner redirect rc" "rc=0"
+[ ! -f "$CX/acct-01/auth.json" ] && t_ok "codex: no write under the owner's live ceremony" \
+  || t_fail "codex busy-owner redirect" "auth.json written under an active login lock"
+rmdir "$CX/acct-01/.login-lock"
+mv "$WORK/cx-a01.hold" "$CX/acct-01/auth.json"
+got_email="$(python3 - "$CX/acct-04/auth.json" <<'EOF'
+import base64, json, sys
+t = json.load(open(sys.argv[1]))['tokens']['id_token']
+p = t.split('.')[1]; p += '=' * (-len(p) % 4)
+print(json.loads(base64.urlsafe_b64decode(p)).get('email', ''))
+EOF
+)"
+[ "$got_email" = "d@cx" ] && t_ok "codex: busy-owner refusal restored the target credential" \
+  || t_fail "codex busy-owner restore" "acct-04 auth belongs to: $got_email"
 unset FAKE_LOGIN_ARGS
 
 # a parked account shows in expired and relogin fixes exactly that