claude-multiacc 1.0.12 → 1.0.13

package/bin/codex-accounts

@@ -146,6 +146,36 @@ os.replace(path + '.tmp', path)
 PYEOF
 }
 
+# ---- per-account login lock ----------------------------------------------------
+# Two concurrent logins for the SAME account corrupt each other: the later one
+# snapshots the OLD credential and its abort/refusal "restores" that stale
+# credential over the fresh one the first sign-in produced. A ceremony can take
+# minutes, so the lock is only reclaimed after 30 minutes (holder presumed dead).
+# Stale reclaim is ATOMIC between contenders: rename steals the stale lock
+# (exactly one mv succeeds); the loser finds a live lock and refuses. Release is
+# OWNERSHIP-GUARDED (owner.<pid> marker), so a process can never remove a lock a
+# later contender legitimately re-took.
+login_lock_acquire() { # $1 = lock dir; nonzero when someone else holds it
+  local L="$1"
+  if ! mkdir "$L" 2>/dev/null; then
+    [ $(( $(epoch_now) - $(file_mtime "$L") )) -gt 1800 ] || return 1
+    mv "$L" "$L.stale.$$" 2>/dev/null || return 1
+    rm -rf "$L.stale.$$" 2>/dev/null
+    mkdir "$L" 2>/dev/null || return 1
+  fi
+  : > "$L/owner.$$" 2>/dev/null || true
+  return 0
+}
+login_lock_release() { # $1 = lock dir; removes it ONLY if this process owns it
+  local L="$1"
+  [ -e "$L/owner.$$" ] && rm -rf "$L" 2>/dev/null
+  return 0
+}
+login_lock_busy() { # $1 = acct dir; true when a LIVE login ceremony holds it
+  [ -d "$1/.login-lock" ] \
+    && [ $(( $(epoch_now) - $(file_mtime "$1/.login-lock") )) -le 1800 ]
+}
+
 auto_sync() { # best effort after mutations, Mac only, loud on failure
   [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CODEX_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
@@ -424,15 +454,19 @@ cmd_add() {
     # The sign-in itself succeeded and produced a fresh credential for an account
     # that is already registered — don't throw it away: save it to that account,
     # exactly as `login $owner` would have. This machine now runs $owner.
+    # Needs the owner's login lock (non-blocking): writing under a mid-ceremony
+    # login for that account would corrupt it.
     local od="$ACC_ROOT/$owner"
     seed_account_dir "$od"
-    if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+    if login_lock_acquire "$od/.login-lock" && mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
       chmod 600 "$od/auth.json" 2>/dev/null || true
       clear_auth_markers "$od"
+      login_lock_release "$od/.login-lock"
       mutate_unlock
       log_to ops.log "add redirect: signed in as $got (already $owner) — credential saved to $owner"
       echo "$got is already added as $owner — the fresh sign-in was saved to $owner (usable on this machine now)."
     else
+      login_lock_release "$od/.login-lock"
       mutate_unlock
       echo "$got is already added as $owner — skipping (nothing added)."
     fi
@@ -632,6 +666,10 @@ cmd_remove() {
     read -r ans
     case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
   fi
+  # Never delete an account out from under a live sign-in ceremony: the login's
+  # cleanup would then operate on a removed (or later recreated) path.
+  login_lock_busy "$ACC_ROOT/$id" \
+    && die "a login for $id is in progress — finish or abort it first"
   if [ -L "$ACC_ROOT/$id" ]; then
     rm -f "${ACC_ROOT:?}/${id:?}"   # adopted account: remove the symlink, never the target
   else
@@ -671,6 +709,18 @@ for a in json.load(open(sys.argv[1])).get('accounts', []):
         break
 PYEOF
 )"
+  # PER-ACCOUNT login lock (observed in the field: parallel relogin runs left a
+  # months-dead token inside a minutes-old auth.json — see login_lock_acquire).
+  local llock="$d/.login-lock"
+  login_lock_acquire "$llock" \
+    || die "another login for $id is already in progress (this terminal or another) — finish or abort it first"
+  # Released on EVERY exit: normal returns, die (exit fires EXIT), Ctrl-C (the INT
+  # handler exits, which fires EXIT). Runs in a subshell under relogin, so the trap
+  # scope is exactly this one login. Ownership-guarded: never removes a lock a
+  # later contender re-took.
+  # shellcheck disable=SC2064
+  trap "login_lock_release '$llock'" EXIT
+
   echo "Sign in as $email for $id."
   # Snapshot the credential BEFORE the ceremony: `codex login` writes auth.json into
   # the dir directly, so a sign-in to the WRONG account would otherwise leave that
@@ -712,17 +762,27 @@ PYEOF
     local owner
     owner="$(email_owner "$got")"
     if [ -n "$owner" ] && [ "$owner" != "$id" ]; then
+      # The redirect mutates the OWNER's credential, so it needs the owner's login
+      # lock too (non-blocking: if a login for that account is mid-ceremony, writing
+      # under it would recreate exactly the corruption this lock prevents — skip the
+      # redirect and fall through to the plain refusal instead).
       local od="$ACC_ROOT/$owner"
       seed_account_dir "$od"
-      if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
-        chmod 600 "$od/auth.json" 2>/dev/null || true
-        clear_auth_markers "$od"
-        restore_snap
-        trap - INT TERM
-        log_to ops.log "login redirect: signed in as $got -> credential saved to $owner (target was $id)"
-        echo "you signed in as $got — that is $owner, so the credential was saved to $owner (usable now)."
-        echo "$id ($email) still needs its own sign-in: codex-accounts login $id"
-        return 1
+      if login_lock_acquire "$od/.login-lock"; then
+        if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+          chmod 600 "$od/auth.json" 2>/dev/null || true
+          clear_auth_markers "$od"
+          login_lock_release "$od/.login-lock"
+          restore_snap
+          trap - INT TERM
+          log_to ops.log "login redirect: signed in as $got -> credential saved to $owner (target was $id)"
+          echo "you signed in as $got — that is $owner, so the credential was saved to $owner (usable now)."
+          echo "$id ($email) still needs its own sign-in: codex-accounts login $id"
+          return 1
+        fi
+        login_lock_release "$od/.login-lock"
+      else
+        echo "note: a login for $owner is in progress — not saving this credential there."
       fi
     fi
     restore_snap

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -1828,6 +1828,69 @@ rc=$?
 { [ "$rc" = "0" ] && [ "$(cat "$FAKE_LOGIN_ARGS")" = "" ]; } \
   && t_ok "codex: --browser opts into the localhost callback flow" \
   || t_fail "codex --browser opt-out" "rc=$rc login args: '$(cat "$FAKE_LOGIN_ARGS")'"
+# lock released after a completed login
+[ ! -d "$CX/acct-04/.login-lock" ] && t_ok "codex: login lock released after completion" \
+  || { t_fail "codex login lock release" ".login-lock survived a completed login"; rmdir "$CX/acct-04/.login-lock" 2>/dev/null; }
+# a SECOND concurrent login for the same account is refused before any ceremony —
+# a parallel run snapshotting the old credential could otherwise "restore" it over
+# the fresh one (field incident: months-dead token inside a minutes-old auth.json)
+mkdir "$CX/acct-04/.login-lock"
+export FAKE_LOGIN_ARGS="$WORK/cx-login-args"
+: > "$FAKE_LOGIN_ARGS"
+cp "$CX/acct-04/auth.json" "$WORK/cx-lock-auth.bak"
+out="$(FAKE_EMAIL=d@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+check "codex: concurrent login for the same account is refused" "already in progress" "$out"
+[ "$rc" != "0" ] && t_ok "codex: concurrent login exits nonzero" || t_fail "codex login lock rc" "rc=0"
+[ ! -s "$FAKE_LOGIN_ARGS" ] && t_ok "codex: refused concurrent login never ran a ceremony" \
+  || t_fail "codex login lock ceremony" "codex login was invoked despite the lock"
+cmp -s "$CX/acct-04/auth.json" "$WORK/cx-lock-auth.bak" \
+  && t_ok "codex: refused concurrent login left the credential untouched" \
+  || t_fail "codex login lock credential" "auth.json changed"
+# a STALE lock (holder died >30min ago) is reclaimed, not fatal
+python3 - "$CX/acct-04/.login-lock" <<'EOF'
+import os, sys, time
+t = time.time() - 2000
+os.utime(sys.argv[1], (t, t))
+EOF
+out="$(FAKE_EMAIL=d@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: stale login lock is reclaimed" || t_fail "codex stale login lock" "rc=$rc: $out"
+[ ! -d "$CX/acct-04/.login-lock" ] && t_ok "codex: reclaimed lock released again" \
+  || { t_fail "codex stale lock release" "lock left behind"; rmdir "$CX/acct-04/.login-lock" 2>/dev/null; }
+# lock released after a FAILED ceremony too
+FAKE_LOGIN_FAIL=1 FAKE_EMAIL=d@cx codex-accounts login acct-04 >/dev/null 2>&1
+[ ! -d "$CX/acct-04/.login-lock" ] && t_ok "codex: login lock released after a failed ceremony" \
+  || { t_fail "codex login lock on failure" "lock left behind"; rmdir "$CX/acct-04/.login-lock" 2>/dev/null; }
+# remove refuses to delete an account under a live ceremony
+mkdir "$CX/acct-04/.login-lock"
+out="$(codex-accounts remove acct-04 --yes 2>&1)"
+rc=$?
+check "codex: remove refuses during a live login" "login for acct-04 is in progress" "$out"
+[ "$rc" != "0" ] && [ -d "$CX/acct-04" ] && t_ok "codex: account survives a remove during login" \
+  || t_fail "codex remove guard" "rc=$rc dir_exists=$([ -d "$CX/acct-04" ] && echo yes || echo no)"
+rmdir "$CX/acct-04/.login-lock"
+# a redirect never writes under a mid-ceremony login on the OWNER account either:
+# it skips the save and falls back to the plain refusal
+mkdir "$CX/acct-01/.login-lock"
+mv "$CX/acct-01/auth.json" "$WORK/cx-a01.hold"
+out="$(FAKE_EMAIL=a@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+check "codex: redirect skipped while the owner has a login in progress" "login for acct-01 is in progress" "$out"
+[ "$rc" != "0" ] && t_ok "codex: skipped redirect still refuses" || t_fail "codex busy-owner redirect rc" "rc=0"
+[ ! -f "$CX/acct-01/auth.json" ] && t_ok "codex: no write under the owner's live ceremony" \
+  || t_fail "codex busy-owner redirect" "auth.json written under an active login lock"
+rmdir "$CX/acct-01/.login-lock"
+mv "$WORK/cx-a01.hold" "$CX/acct-01/auth.json"
+got_email="$(python3 - "$CX/acct-04/auth.json" <<'EOF'
+import base64, json, sys
+t = json.load(open(sys.argv[1]))['tokens']['id_token']
+p = t.split('.')[1]; p += '=' * (-len(p) % 4)
+print(json.loads(base64.urlsafe_b64decode(p)).get('email', ''))
+EOF
+)"
+[ "$got_email" = "d@cx" ] && t_ok "codex: busy-owner refusal restored the target credential" \
+  || t_fail "codex busy-owner restore" "acct-04 auth belongs to: $got_email"
 unset FAKE_LOGIN_ARGS
 
 # a parked account shows in expired and relogin fixes exactly that