claude-multiacc 2.0.61 → 2.0.64

package/lib/codex_mcp_oauth.py

@@ -0,0 +1,204 @@
+#!/usr/bin/env python3
+"""Share machine-local Codex MCP fallback credentials and native refresh locks.
+
+Codex 0.163.0 opens .credentials.json with O_NOFOLLOW, writes it in place, and
+unlinks it when its final entry is removed. Hardlinks share one live document;
+a reserved tokenless entry keeps the inode alive after native logout. Native
+Codex still owns OAuth refresh and revocation. auth.json is never inspected.
+Credential values never enter output. Keyring items and network endpoints are not accessed.
+"""
+from __future__ import annotations
+
+import argparse
+import os
+from pathlib import Path
+import re
+import sys
+import subprocess
+
+sys.dont_write_bytecode = True
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+try:
+    import tomllib
+except ModuleNotFoundError:
+    tomllib = None
+
+from codex_mcp_oauth_locks import check_lock_dirs, held, join_locks, native_locks
+from codex_mcp_oauth_store import Deferred, commit_links, merge, read_json, save_receipt
+from codex_mcp_oauth_store import SENTINEL, staged_links, validate, write_shared
+
+SHARED_DIR = '.codex-mcp-oauth'
+CREDENTIALS = '.credentials.json'
+ACCOUNT_ID = re.compile(r'^acct-\d{2,4}$')
+
+
+def account_dirs(root, requested=None):
+    manifest = read_json(root / 'accounts.json')
+    accounts, physical_homes = [], {}
+    default_home = (Path.home() / '.codex').resolve()
+    for entry in manifest.get('accounts', []):
+        name = entry.get('id') if isinstance(entry, dict) else None
+        if not isinstance(name, str) or not ACCOUNT_ID.fullmatch(name):
+            continue
+        path = root / name
+        physical = path.resolve()
+        if path.is_symlink() and physical != default_home:
+            raise Deferred('only the default Codex home can be adopted')
+        if not path.is_dir() or path in accounts:
+            continue
+        if physical in physical_homes:
+            raise Deferred('manifest accounts share the same physical Codex home')
+        physical_homes[physical] = path
+        accounts.append(path)
+    if requested is not None and Path(requested).resolve() not in physical_homes:
+        raise Deferred('account outside manifest')
+    return sorted(accounts)
+
+
+def check_paths(root, accounts):
+    if account_dirs(root) != sorted(accounts):
+        raise Deferred('manifest accounts changed during OAuth preparation')
+    shared = root / SHARED_DIR
+    for path in (root, shared, shared / 'locks', shared / 'credentials.json', shared / 'managed.json'):
+        if path.is_symlink():
+            raise Deferred('shared state must remain inside pool')
+    for account in accounts:
+        if (account / CREDENTIALS).is_symlink():
+            raise Deferred('credential symlink is unsupported by native Codex')
+    check_lock_dirs(accounts, shared / 'locks')
+    check_backends(accounts)
+
+
+def shared_document(accounts, shared):
+    authority, receipt_path = shared / 'credentials.json', shared / 'managed.json'
+    receipt = read_json(receipt_path)
+    managed = receipt.get('accounts', [])
+    if not isinstance(managed, list) or not all(isinstance(name, str) for name in managed):
+        raise Deferred('invalid sharing receipt')
+    retired = bool(managed) and (not authority.exists() or any(
+        account.name in managed and not (account / CREDENTIALS).exists() for account in accounts))
+    canonical = validate(read_json(authority)) if not retired else {}
+    documents = [canonical]
+    for account in accounts:
+        path = account / CREDENTIALS
+        if not path.exists() or retired and account.name in managed:
+            continue
+        if authority.exists() and os.path.samefile(path, authority):
+            continue
+        private = validate(read_json(path))
+        private_grants = {key: value for key, value in private.items() if key != SENTINEL}
+        current_grants = {key: value for key, value in canonical.items() if key != SENTINEL}
+        if (authority.exists() or managed) and private_grants and private_grants != current_grants:
+            raise Deferred('private credential document conflicts with shared authority')
+        documents.append(private)
+    return merge(documents)
+
+
+def reconcile(root, accounts):
+    shared = root / SHARED_DIR
+    shared_document(accounts, shared)  # Reject conflicts before creating any migration state.
+    shared.mkdir(mode=0o700, exist_ok=True)
+    os.chmod(shared, 0o700)
+    locks = shared / 'locks'
+    # Existing credential owners go first when consolidating native lock files.
+    accounts = sorted(accounts, key=lambda item: not (item / CREDENTIALS).exists())
+    with native_locks(accounts, locks) as locked_paths:
+        doc = shared_document(accounts, shared)
+        authority = shared / 'credentials.json'
+        if not authority.exists():
+            owner = next((item / CREDENTIALS for item in accounts if (item / CREDENTIALS).exists()), None)
+            if owner is not None:
+                os.link(owner, authority)
+        if not authority.exists():
+            write_shared(authority, doc)
+        with staged_links(authority, accounts, locks) as pending:
+            join_locks(accounts, locks, locked_paths)
+            if read_json(authority) != doc:
+                write_shared(authority, doc)
+            else:
+                os.chmod(authority, 0o600)
+            commit_links(pending)
+            save_receipt(shared / 'managed.json', accounts)
+    return True
+
+
+def ensure(root, account_dir=None, initialize=False, strict=False):
+    if os.environ.get('CODEX_MULTIACC_MCP_OAUTH', '1').lower() in ('0', 'false', 'off', 'no'):
+        return False
+    root = Path(os.path.abspath(root))
+    try:
+        if root.is_symlink():
+            raise Deferred('pool root must not be a symlink')
+        root = root.resolve()
+        accounts = account_dirs(root, account_dir)
+        if not accounts:
+            return False
+        if not initialize and not (root / SHARED_DIR).exists() and not any(
+                (item / CREDENTIALS).exists() for item in accounts):
+            return False
+        check_paths(root, accounts)
+        with held(root / '.codex-mcp-oauth.lock'):
+            check_paths(root, accounts)
+            return reconcile(root, accounts)
+    except Deferred:
+        if strict:
+            raise
+        return False
+    except (OSError, ValueError, TypeError) as exc:
+        if strict:
+            raise Deferred('invalid or inaccessible MCP OAuth storage') from exc
+        return False
+
+
+def check_backends(accounts):
+    for account in accounts:
+        config = account / 'config.toml'
+        if not config.exists():
+            continue
+        if tomllib is None:
+            raise Deferred('MCP OAuth sharing requires Python 3.11 or newer')
+        with config.open('rb') as stream:
+            doc = tomllib.load(stream)
+        features = doc.get('features', {})
+        if not isinstance(features, dict):
+            raise Deferred('invalid Codex feature configuration')
+        if doc.get('mcp_oauth_credentials_store', 'auto') != 'file' and features.get('secret_auth_storage', False):
+            raise Deferred('encrypted per-account MCP storage cannot be shared')
+
+
+def supported_version(binary):
+    try:
+        result = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=3, check=False)
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise Deferred('native Codex version could not be verified') from exc
+    match = re.fullmatch(r'codex-cli (\d+)\.(\d+)\.(\d+)\s*', result.stdout)
+    if result.returncode or not match or tuple(map(int, match.groups())) < (0, 163, 0):
+        raise Deferred('MCP OAuth sharing requires native Codex 0.163.0 or newer')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('command', choices=('ensure', 'apply'))
+    parser.add_argument('--root', required=True)
+    parser.add_argument('--codex-bin', required=True)
+    parser.add_argument('--account-dir')
+    parser.add_argument('--init', action='store_true')
+    parser.add_argument('--quiet', action='store_true')
+    args = parser.parse_args()
+    try:
+        supported_version(args.codex_bin)
+        prepared = ensure(args.root, args.account_dir, args.init, strict=True)
+        if not args.quiet:
+            print('Codex MCP OAuth storage is shared across this pool.' if prepared
+                  else 'No MCP OAuth storage prepared (disabled or no saved login).')
+        return 0
+    except Deferred as exc:
+        if not args.quiet:
+            print(f'codex-mcp-oauth: {exc}', file=sys.stderr)
+        return 1
+
+
+if __name__ == '__main__':
+    from codex_python import require_python311
+    require_python311(__file__)
+    sys.exit(main())

package/lib/codex_mcp_oauth.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Native Codex MCP credentials and refresh locks stay local to this pool.
+# No Python startup for a pool that has never saved an MCP OAuth login.
+codex_mcp_oauth_ensure() { # root, python, module, optional account directory and native binary
+  [ "${CODEX_MULTIACC_MCP_OAUTH:-1}" != "0" ] || return 0
+  local root="$1" py="$2" module="$3" account="${4:-}" real="${5:-}" found=0 f
+  [ -f "$root/accounts.json" ] && [ -f "$module" ] || return 0
+  if [ -d "$root/.codex-mcp-oauth" ]; then
+    found=1
+  else
+    for f in "$root"/acct-*/.credentials.json; do
+      if [ -f "$f" ]; then found=1; break; fi
+    done
+  fi
+  [ "$found" = 1 ] || return 0
+  if [ -z "$real" ] && type find_real_codex >/dev/null 2>&1; then
+    real="$(find_real_codex 2>/dev/null)" || return 0
+  fi
+  [ -n "$real" ] || return 0
+  if [ -n "$account" ]; then
+    "$py" "$module" ensure --root "$root" --codex-bin "$real" --account-dir "$account" --quiet \
+      >/dev/null 2>&1 </dev/null || true
+  else
+    "$py" "$module" ensure --root "$root" --codex-bin "$real" --quiet >/dev/null 2>&1 </dev/null || true
+  fi
+  return 0
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then codex_mcp_oauth_ensure "$@"; fi

package/lib/codex_mcp_oauth_locks.py

@@ -0,0 +1,158 @@
+"""Join native Codex OAuth lock domains without bypassing an active lock holder."""
+from __future__ import annotations
+
+import contextlib
+import fcntl
+import os
+import re
+import stat
+import time
+from pathlib import Path
+
+from codex_mcp_oauth_native import exchange, exchange_supported, external_handles
+from codex_mcp_oauth_store import Deferred
+
+LOCK_NAME = re.compile(r'^(?:[a-f0-9]{64}|file-store|secrets-store)\.lock$')
+
+
+class LockPaths(dict):
+    """Native path snapshot plus the descriptors owned by this migration."""
+
+
+@contextlib.contextmanager
+def held(path):
+    fd = os.open(path, os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600)
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise Deferred('non-regular lock')
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError as exc:
+            raise Deferred('native OAuth operation in progress') from exc
+        yield fd
+    finally:
+        os.close(fd)
+
+
+def check_lock_dirs(accounts, shared):
+    for account in accounts:
+        path = account / 'mcp-oauth-locks'
+        if path.is_symlink():
+            if path.resolve() != shared:
+                raise Deferred('foreign lock directory link')
+        elif path.exists() and not path.is_dir():
+            raise Deferred('non-directory native locks')
+        if path.exists():
+            for item in path.iterdir():
+                if item.is_symlink() or not item.is_file() or not LOCK_NAME.fullmatch(item.name):
+                    raise Deferred('unsupported native lock state')
+
+
+def retired_directories(shared):
+    root = shared.parent / 'retired-locks'
+    if root.is_symlink() or root.exists() and not root.is_dir():
+        raise Deferred('unsupported retired native locks')
+    directories = []
+    for directory in root.iterdir() if root.exists() else []:
+        if not re.fullmatch(r'acct-\d{2,4}', directory.name):
+            raise Deferred('unsupported retired native locks')
+        if directory.is_symlink():
+            if directory.resolve() != shared:
+                raise Deferred('foreign retired lock link')
+            continue
+        if not directory.is_dir():
+            raise Deferred('unsupported retired native locks')
+        for path in directory.iterdir():
+            if path.is_symlink() or not path.is_file() or not LOCK_NAME.fullmatch(path.name):
+                raise Deferred('unsupported retired native locks')
+        directories.append(directory)
+    return directories
+
+
+@contextlib.contextmanager
+def native_locks(accounts, shared):
+    paths = [account / 'mcp-oauth-locks' for account in accounts] + [shared]
+    paths += retired_directories(shared)
+    with contextlib.ExitStack() as stack:
+        seen = set()
+        locked_paths = LockPaths()
+        locked_paths.owned_fds = set()
+        for directory in paths:
+            directory.mkdir(mode=0o700, exist_ok=True)
+            file_lock = directory / 'file-store.lock'
+            candidates = set(directory.iterdir())
+            if directory != shared or file_lock.exists():
+                candidates.add(file_lock)
+            candidates = sorted(candidates, key=lambda item: item.name)
+            locked_paths[directory] = candidates
+            for path in candidates:
+                if path.exists():
+                    inode = (path.stat().st_dev, path.stat().st_ino)
+                    if inode in seen:
+                        continue
+                locked_paths.owned_fds.add(stack.enter_context(held(path)))
+                seen.add((path.stat().st_dev, path.stat().st_ino))
+        yield locked_paths
+
+
+def prepare_cutover(directories, shared, locked_paths):
+    exchange_supported()
+    paths = [path for values in locked_paths.values() for path in values]
+    if external_handles(paths, locked_paths.owned_fds):
+        raise Deferred('native OAuth lock handles are still open')
+    retired = shared.parent / 'retired-locks'
+    retired.mkdir(mode=0o700, exist_ok=True)
+    for directory in directories:
+        if set(directory.iterdir()) != set(locked_paths[directory]):
+            raise Deferred('native OAuth lock state changed during migration')
+        for source in locked_paths[directory]:
+            target = shared / source.name
+            if not target.exists():
+                os.link(source, target)
+        pending = retired / directory.parent.name
+        if pending.is_symlink() and pending.resolve() == shared:
+            pending.unlink()
+        pending.symlink_to(shared, target_is_directory=True)
+    return retired
+
+
+def drain_retired(shared, owned_fds):
+    directories = retired_directories(shared)
+    for directory in directories:
+        for path in directory.iterdir():
+            try:
+                os.link(path, shared / path.name)
+            except FileExistsError:
+                pass
+    discarded = [path for directory in directories for path in directory.iterdir()
+                 if not (shared / path.name).exists() or not os.path.samefile(path, shared / path.name)]
+    # Never release either lock domain while a pre-cutover native waiter can still use the old inode.
+    # Native contenders normally time out within 60s; no unsafe fixed deadline admits a suspended fd.
+    while discarded:
+        try:
+            if not external_handles(discarded, owned_fds):
+                break
+        except Deferred:
+            pass
+        time.sleep(0.05)
+    for directory in directories:
+        for path in directory.iterdir():
+            path.unlink()
+        directory.rmdir()
+
+
+def join_locks(accounts, shared, locked_paths):
+    """Preserve owner inodes; atomically cut over and drain retired native waiters."""
+    directories = [account / 'mcp-oauth-locks' for account in accounts
+                   if not (account / 'mcp-oauth-locks').is_symlink()]
+    if not directories:
+        if retired_directories(shared):
+            exchange_supported()
+            drain_retired(shared, locked_paths.owned_fds)
+        return
+    retired = prepare_cutover(directories, shared, locked_paths)
+    try:
+        for directory in directories:
+            exchange(directory, retired / directory.parent.name)
+    finally:
+        drain_retired(shared, locked_paths.owned_fds)

package/lib/codex_mcp_oauth_native.py

@@ -0,0 +1,102 @@
+"""Native lock migration primitives; inspect only task-owned lock file metadata."""
+from __future__ import annotations
+
+import ctypes
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+
+from codex_mcp_oauth_store import Deferred
+
+
+def exchange_supported():
+    libc = ctypes.CDLL(None, use_errno=True)
+    name = 'renamex_np' if sys.platform == 'darwin' else 'renameat2'
+    if sys.platform not in ('darwin', 'linux') or not hasattr(libc, name):
+        raise Deferred('atomic native lock migration is unavailable')
+    if sys.platform == 'darwin' and not shutil.which('lsof'):
+        raise Deferred('native lock migration requires lsof')
+    if sys.platform == 'linux' and not Path('/proc/self/fd').is_dir():
+        raise Deferred('native lock migration requires process file metadata')
+
+
+def exchange(source, target):
+    """Swap a directory and prepared symlink without an absent native pathname."""
+    libc = ctypes.CDLL(None, use_errno=True)
+    left, right = os.fsencode(source), os.fsencode(target)
+    if sys.platform == 'darwin':
+        result = libc.renamex_np(ctypes.c_char_p(left), ctypes.c_char_p(right), ctypes.c_uint(2))
+    else:
+        result = libc.renameat2(-100, ctypes.c_char_p(left), -100, ctypes.c_char_p(right), ctypes.c_uint(2))
+    if result:
+        raise Deferred('atomic native lock migration failed')
+
+
+def linux_handles(identities, owned_fds):
+    for process in Path('/proc').iterdir():
+        if not process.name.isdecimal():
+            continue
+        try:
+            if process.stat().st_uid != os.getuid():
+                continue
+            for descriptor in (process / 'fd').iterdir():
+                if int(process.name) == os.getpid() and int(descriptor.name) in owned_fds:
+                    continue
+                try:
+                    info = descriptor.stat()
+                    if (info.st_dev, info.st_ino) in identities:
+                        return True
+                except FileNotFoundError:
+                    continue
+        except FileNotFoundError:
+            continue
+        except PermissionError as exc:
+            if exited_process(process):
+                continue
+            raise Deferred('native lock handles could not be inspected') from exc
+    return False
+
+
+def exited_process(process):
+    """A reaped or single-thread zombie process cannot retain a native lock fd."""
+    try:
+        fields = dict(line.split(':', 1) for line in (process / 'status').read_text().splitlines()
+                      if ':' in line)
+    except FileNotFoundError:
+        return True
+    except OSError:
+        return False
+    # A zombie thread-group leader can still have living threads and open files.
+    state = fields.get('State', '').split()
+    return bool(state and state[0] in ('Z', 'X') and fields.get('Threads', '').strip() == '1')
+
+
+def mac_handles(paths, owned_fds):
+    try:
+        result = subprocess.run(['lsof', '-nP', '-Fpf', '--', *map(str, paths)],
+                                capture_output=True, text=True, timeout=5, check=False)
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise Deferred('native lock handles could not be inspected') from exc
+    if result.returncode not in (0, 1) or result.returncode == 1 and result.stderr:
+        raise Deferred('native lock handles could not be inspected')
+    pid = None
+    for line in result.stdout.splitlines():
+        if line.startswith('p') and line[1:].isdecimal():
+            pid = int(line[1:])
+        elif line.startswith('f'):
+            number = line[1:].rstrip('ruw')
+            if pid != os.getpid() or not number.isdecimal() or int(number) not in owned_fds:
+                return True
+    return False
+
+
+def external_handles(paths, owned_fds):
+    paths = list(paths)
+    if not paths:
+        return False
+    identities = {(path.stat().st_dev, path.stat().st_ino) for path in paths}
+    if sys.platform == 'linux':
+        return linux_handles(identities, owned_fds)
+    return mac_handles(paths, owned_fds)

package/lib/codex_mcp_oauth_store.py

@@ -0,0 +1,149 @@
+"""Native Codex fallback document validation and shared-inode persistence."""
+from __future__ import annotations
+
+import contextlib
+import json
+import os
+import stat
+from pathlib import Path
+
+SENTINEL = '__multiacc_shared_store__|0000000000000000'
+PLACEHOLDER = {
+    'server_name': '__multiacc_shared_store__', 'server_url': 'urn:claude-multiacc:shared-mcp-store',
+    'client_id': '', 'access_token': '', 'refresh_token': None, 'expires_at': 0, 'scopes': [],
+}
+MAX_BYTES = 4 << 20
+
+
+class Deferred(Exception):
+    """Leave an unsafe or contended store unchanged; never include credential values."""
+
+
+def read_json(path):
+    try:
+        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    except FileNotFoundError:
+        return {}
+    with os.fdopen(fd, 'r', encoding='utf-8') as stream:
+        if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
+            raise Deferred('non-regular document')
+        raw = stream.read(MAX_BYTES + 1)
+    if len(raw) > MAX_BYTES:
+        raise Deferred('oversized document')
+    doc = json.loads(raw)
+    if not isinstance(doc, dict):
+        raise Deferred('invalid document')
+    return doc
+
+
+def validate(doc):
+    identities = {}
+    for key, entry in doc.items():
+        if key == SENTINEL:
+            if entry != PLACEHOLDER:
+                raise Deferred('reserved identity conflict')
+            continue
+        if not isinstance(entry, dict) or not isinstance(key, str):
+            raise Deferred('invalid credential entry')
+        for field in ('server_name', 'server_url', 'client_id', 'access_token'):
+            if not isinstance(entry.get(field), str):
+                raise Deferred('invalid credential fields')
+        if 'executor_owned' in entry and type(entry['executor_owned']) is not bool:
+            raise Deferred('invalid credential owner')
+        name = entry['server_name']
+        if entry.get('executor_owned') or name.startswith(('executor:', 'ema-idp:')) or key.startswith('ema-idp:'):
+            raise Deferred('scoped credential cannot be shared')
+        if name.removeprefix('local:') == PLACEHOLDER['server_name']:
+            raise Deferred('reserved identity conflict')
+        issuer = entry.get('issuer')
+        if issuer is not None and not isinstance(issuer, str):
+            raise Deferred('invalid issuer field')
+        refresh, expiry = entry.get('refresh_token'), entry.get('expires_at')
+        scopes = entry.get('scopes', [])
+        if (refresh is not None and not isinstance(refresh, str)
+                or expiry is not None and (type(expiry) is not int or expiry < 0)
+                or not isinstance(scopes, list) or not all(isinstance(value, str) for value in scopes)):
+            raise Deferred('invalid credential fields')
+        identity = (name.removeprefix('local:'), entry['server_url'])
+        if identity in identities and identities[identity] != (key, entry):
+            raise Deferred('duplicate credential identity')
+        identities[identity] = (key, entry)
+    return doc
+
+
+def merge(documents):
+    result = {}
+    grants = [{key: entry for key, entry in doc.items() if key != SENTINEL} for doc in documents]
+    populated = [doc for doc in grants if doc]
+    if populated and any(doc != populated[0] for doc in populated[1:]):
+        raise Deferred('independent credential documents require separate authorization')
+    for doc in documents:
+        validate(doc)
+        for key, entry in doc.items():
+            if key in result and result[key] != entry:
+                raise Deferred('conflicting credential grants')
+            result[key] = entry
+    validate(result)
+    result[SENTINEL] = dict(PLACEHOLDER)
+    return result
+
+
+def write_shared(path, doc):
+    """Native Codex truncates in place too; callers hold its file-store lock."""
+    data = json.dumps(doc, separators=(',', ':')).encode()
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600)
+    with os.fdopen(fd, 'wb') as stream:
+        if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
+            raise Deferred('non-regular shared document')
+        os.fchmod(stream.fileno(), 0o600)
+        stream.truncate(0)
+        stream.write(data)
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+@contextlib.contextmanager
+def staged_links(source, accounts, locks):
+    """Prove every hardlink and symlink can be created before changing native state."""
+    pending, scratch_paths = [], []
+    try:
+        for account in accounts:
+            if source.stat().st_dev != account.stat().st_dev:
+                raise Deferred('account credentials are on different filesystems')
+            target = account / '.credentials.json'
+            if not target.exists() or not os.path.samefile(source, target):
+                scratch = account / '.codex-mcp-oauth-link'
+                if scratch.is_symlink() or scratch.exists() and not os.path.samefile(source, scratch):
+                    raise Deferred('foreign staged credential link')
+                if not scratch.exists():
+                    os.link(source, scratch)
+                scratch_paths.append(scratch)
+                pending.append((scratch, target))
+            if not (account / 'mcp-oauth-locks').is_symlink():
+                scratch = account / '.codex-mcp-oauth-locks-link'
+                if scratch.is_symlink():
+                    if scratch.resolve() != locks:
+                        raise Deferred('foreign staged native lock link')
+                elif scratch.exists():
+                    raise Deferred('foreign staged native lock link')
+                else:
+                    scratch.symlink_to(locks, target_is_directory=True)
+                scratch_paths.append(scratch)
+        yield pending
+    finally:
+        for scratch in scratch_paths:
+            scratch.unlink(missing_ok=True)
+
+
+def commit_links(pending):
+    for scratch, target in pending:
+        os.replace(scratch, target)
+
+
+def save_receipt(path, accounts):
+    document = {'accounts': sorted(item.name for item in accounts)}
+    if read_json(path) == document:
+        return
+    scratch = path.with_name('managed.pending.json')
+    write_shared(scratch, document)
+    os.replace(scratch, path)