claude-multiacc 2.0.61 → 2.0.65

package/lib/autoresume.py

@@ -69,6 +69,7 @@ from autoresume_cross_receipt import confirm_cross
 from model_catalog import load as load_catalog, parse_id
 from model_match import resume_settings, settings_flags
 from session_settings import session_settings
+from codex_resume_cwd import codex_resume_cwd
 
 # ---- vocabulary ---------------------------------------------------------------------
 
@@ -1213,6 +1214,14 @@ def codex_effort_ok(val):
         and EFFORT_VALUE_RE.match(val[len(CODEX_EFFORT_KEY):]) is not None
 
 
+def codex_speed_ok(val):
+    """Only known speed choices, never arbitrary config, may cross a relaunch."""
+    if val == "features.fast_mode=true":
+        return True
+    return isinstance(val, str) and re.fullmatch(
+        r'''service_tier=(?:default|fast|priority|ultrafast|"(?:default|fast|priority|ultrafast)"|'(?:default|fast|priority|ultrafast)')''', val) is not None
+
+
 def codex_argv_parse(argv):
     """The argv shapes a codex relaunch can rebuild (mirrors bin/codex's ar_argv_ok) ->
     (kept options, resume target or None), or None for anything else."""
@@ -1230,7 +1239,7 @@ def codex_argv_parse(argv):
             kept += [arg, expected]
             i += 1
         elif arg in ("-m", "--model", "-c"):
-            value_ok = codex_effort_ok if arg == "-c" else _value_ok
+            value_ok = (lambda value: codex_effort_ok(value) or codex_speed_ok(value)) if arg == "-c" else _value_ok
             if i + 1 >= len(argv) or not value_ok(argv[i + 1]):
                 return None
             kept += [arg, argv[i + 1]]
@@ -1314,7 +1323,11 @@ def settings_argv(provider, settings):
     (anything else counts as unknown). [] when nothing is known."""
     effort = settings.get("effort") if isinstance(settings, dict) else None
     effort = effort if isinstance(effort, str) and EFFORT_VALUE_RE.match(effort) else None
-    return settings_flags(provider, history_model(settings), effort)
+    flags = settings_flags(provider, history_model(settings), effort)
+    if provider == "codex" and isinstance(settings, dict) and settings.get("speed") in ("normal", "fast", "ultrafast"):
+        flags += ["-c", "service_tier=" + {"normal": "default", "fast": "fast",
+                                           "ultrafast": "ultrafast"}[settings["speed"]]]
+    return flags
 
 
 def argv_settings(provider, argv):
@@ -1335,6 +1348,10 @@ def argv_settings(provider, argv):
         elif provider == "codex" and arg == "-c" and codex_effort_ok(val):
             found["effort"] = val[len(CODEX_EFFORT_KEY):]
             i += 1
+        elif provider == "codex" and arg == "-c" and val.startswith("service_tier=") and codex_speed_ok(val):
+            from codex_speed import speed
+            found["speed"] = speed(val.split("=", 1)[1].strip("\"'"))
+            i += 1
         i += 1
     return found
 
@@ -1354,14 +1371,16 @@ def claude_model_left(launch, served):
     return family is not None and family != launch
 
 
-def without_settings(kept, model, effort):
+def without_settings(kept, model, effort, speed=False):
     """``kept`` without its model options (-m V, --model V, --model=V) when ``model`` and its
     effort options (--effort V, codex's -c model_reasoning_effort=V) when ``effort``. Both
     parsers refuse a value that starts with "-", so no value is ever taken for an option."""
     out, i = [], 0
     while i < len(kept):
         arg = kept[i]
-        if (model and arg in ("-m", "--model")) or (effort and arg in ("--effort", "-c")):
+        val = kept[i + 1] if i + 1 < len(kept) else ""
+        if ((model and arg in ("-m", "--model")) or (effort and arg == "--effort")
+                or (arg == "-c" and ((effort and codex_effort_ok(val)) or (speed and codex_speed_ok(val))))):
             i += 2
             continue
         if not (model and arg.startswith("--model=")):
@@ -1406,10 +1425,12 @@ def relaunch_argv(provider, argv, sid, cls, prompt=None, settings=None, detail=N
         left = claude_model_left(argv_settings("claude", kept).get("model"), settings.get("model"))
         settings = {"effort": settings.get("effort")}
     flags = settings_argv(provider, settings)
-    model, effort = left or "--model" in flags or "-m" in flags, "--effort" in flags or "-c" in flags
-    if provider == "codex" and not flags and history_model(settings):
+    model = left or "--model" in flags or "-m" in flags
+    effort = "--effort" in flags or any(codex_effort_ok(value) for value in flags)
+    speed = provider == "codex" and settings.get("speed") in ("normal", "fast", "ultrafast")
+    if provider == "codex" and not model and history_model(settings):
         model = effort = True  # no launch -m or -c alone: neither, and the thread restores both
-    return head + without_settings(kept, model, effort) + flags + tail
+    return head + without_settings(kept, model, effort, speed) + flags + tail
 
 
 # ---- relaunch / state files ---------------------------------------------------------
@@ -2698,11 +2719,11 @@ class Watcher:
         return self.busy_memo[1]
 
     def session_cwd(self):
-        """Where the probe and the relaunch run. claude: the registry's cwd first
-        (``--resume`` finds the transcript by it). codex: the launch directory first, so
-        the relaunch repeats the user's own invocation; the rollout's cwd after it."""
-        order = (self.cwd, self.st["cwd"]) if self.provider == "claude" \
-            else (self.st["cwd"], self.cwd)
+        """Restore the session's directory before the picked account trusts and resumes it.
+        Codex's saved cwd can differ from both the launching shell and initial metadata."""
+        order = (self.cwd, self.st["cwd"])
+        if self.provider == "codex":
+            order = (codex_resume_cwd(self.transcript, self.sid),) + order
         for cand in order:
             if cand and os.path.isdir(cand):
                 return cand
@@ -2720,7 +2741,7 @@ class Watcher:
         try:
             found = session_settings(self.provider, self.transcript)
             self.served_model = history_model(found)
-            if not found.get("model") and not found.get("effort"):
+            if not found.get("model") and not found.get("effort") and not found.get("speed"):
                 return None
             # The catalog only clamps an effort to the model and supplies Codex's default
             # one: this pool's copy and caches, the other pool's only when the chain named it.

package/lib/autoresume_cross.py

@@ -110,7 +110,8 @@ def revalidate(watcher, plan):
     history = plan['history']
     current = validate_source(watcher.provider, watcher.sid, watcher.transcript,
                               watcher.session_cwd(), inode=history['inode'])
-    return (current is not None and current['offset'] >= history['offset'] and not shared_source(watcher)
+    return (current is not None and current['offset'] >= history['offset'] and current['cwd'] == history['cwd']
+            and not shared_source(watcher)
             and all(enabled(watcher, provider, root) for provider, root in plan['roots'].items()))
 
 

package/lib/autoresume_handoff.py

@@ -12,6 +12,8 @@ import os
 import re
 import stat
 
+from codex_resume_cwd import codex_resume_cwd
+
 
 PROVIDERS = ("claude", "codex")
 SID_RE = re.compile(r"^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")
@@ -48,8 +50,8 @@ def _read_source(path, inode):
         return None
 
 
-def _codex_identity(data, sid, cwd):
-    """A main interactive rollout identifies itself in its first JSONL record."""
+def _codex_identity(data, sid, cwd, path, identity):
+    """Bind main-thread identity and its saved cwd at the validated snapshot boundary."""
     try:
         record = json.loads(data.split(b"\n", 1)[0])
     except (ValueError, UnicodeError):
@@ -63,8 +65,14 @@ def _codex_identity(data, sid, cwd):
         return False
     if meta.get("originator") not in (None, "codex-tui", "codex_cli_rs", "codex_cli"):
         return False
-    directory = meta.get("cwd")
-    return isinstance(directory, str) and os.path.isabs(directory) and os.path.realpath(directory) == cwd
+    try:
+        directory = codex_resume_cwd(path, sid, upto=identity.st_size)
+        after = os.stat(path)
+    except OSError:
+        return False
+    return (directory is not None and os.path.realpath(directory) == cwd
+            and (after.st_dev, after.st_ino) == (identity.st_dev, identity.st_ino)
+            and after.st_size >= identity.st_size)
 
 
 def _claude_identity(data, sid, cwd):
@@ -110,7 +118,7 @@ def validate_source(provider, sid, path, cwd, inode=None):
     if provider == "codex":
         if not name.startswith("rollout-") or not name.endswith("-" + sid + ".jsonl"):
             return None
-        valid = _codex_identity(data, sid, directory)
+        valid = _codex_identity(data, sid, directory, resolved, identity)
     else:
         valid = name == sid + ".jsonl" and _claude_identity(data, sid, directory)
     if not valid:

package/lib/codex_exec_stdin.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Exit 0 only for a known `codex exec ... -` prompt that itself requires stdin EOF.
+# Unknown options/subcommands and early exits fail closed into ordinary passthrough.
+set -u
+
+seen_exec=0
+for arg in "$@"; do
+  case "$arg" in -h|--help|-V|--version) exit 1 ;; esac
+done
+while [ "$#" -gt 0 ]; do
+  arg="$1"; shift
+  case "$arg" in
+    --)
+      [ "$seen_exec" = 1 ] && [ "$#" = 1 ] && [ "$1" = - ]
+      exit $? ;;
+    -)
+      [ "$seen_exec" = 1 ] && [ "$#" = 0 ]
+      exit $? ;;
+    -c|--config|--enable|--disable|--remote|--remote-auth-token-env|-m|--model|--local-provider|\
+    -p|--profile|-s|--sandbox|-C|--cd|--add-dir|-a|--ask-for-approval|--thread-source|\
+    --cyber-access-program|--output-schema|--color|-o|--output-last-message)
+      [ "$#" -gt 0 ] || exit 1
+      case "$1" in -*) exit 1 ;; esac
+      shift ;;
+    -i|--image)
+      [ "$#" -gt 0 ] || exit 1
+      case "$1" in -*) exit 1 ;; esac
+      while [ "$#" -gt 0 ]; do
+        case "$1" in -*) break ;; esac
+        shift
+      done ;;
+    --config=*|--enable=*|--disable=*|--remote=*|--remote-auth-token-env=*|--model=*|--local-provider=*|\
+    --profile=*|--sandbox=*|--cd=*|--add-dir=*|--ask-for-approval=*|--thread-source=*|\
+    --cyber-access-program=*|--output-schema=*|--color=*|--output-last-message=*|--image=*|\
+    -c?*|-m?*|-p?*|-s?*|-C?*|-a?*|-o?*|-i?*) ;;
+    --strict-config|--oss|--approve-for-me|--dangerously-bypass-approvals-and-sandbox|\
+    --dangerously-bypass-hook-trust|--worktree|--skip-git-repo-check|--ephemeral|\
+    --ignore-user-config|--ignore-rules|--json|--no-daemon) ;;
+    exec|e)
+      [ "$seen_exec" = 0 ] || exit 1
+      seen_exec=1 ;;
+    *) exit 1 ;;
+  esac
+done
+exit 1

package/lib/codex_mcp_oauth.py

@@ -0,0 +1,204 @@
+#!/usr/bin/env python3
+"""Share machine-local Codex MCP fallback credentials and native refresh locks.
+
+Codex 0.163.0 opens .credentials.json with O_NOFOLLOW, writes it in place, and
+unlinks it when its final entry is removed. Hardlinks share one live document;
+a reserved tokenless entry keeps the inode alive after native logout. Native
+Codex still owns OAuth refresh and revocation. auth.json is never inspected.
+Credential values never enter output. Keyring items and network endpoints are not accessed.
+"""
+from __future__ import annotations
+
+import argparse
+import os
+from pathlib import Path
+import re
+import sys
+import subprocess
+
+sys.dont_write_bytecode = True
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+try:
+    import tomllib
+except ModuleNotFoundError:
+    tomllib = None
+
+from codex_mcp_oauth_locks import check_lock_dirs, held, join_locks, native_locks
+from codex_mcp_oauth_store import Deferred, commit_links, merge, read_json, save_receipt
+from codex_mcp_oauth_store import SENTINEL, staged_links, validate, write_shared
+
+SHARED_DIR = '.codex-mcp-oauth'
+CREDENTIALS = '.credentials.json'
+ACCOUNT_ID = re.compile(r'^acct-\d{2,4}$')
+
+
+def account_dirs(root, requested=None):
+    manifest = read_json(root / 'accounts.json')
+    accounts, physical_homes = [], {}
+    default_home = (Path.home() / '.codex').resolve()
+    for entry in manifest.get('accounts', []):
+        name = entry.get('id') if isinstance(entry, dict) else None
+        if not isinstance(name, str) or not ACCOUNT_ID.fullmatch(name):
+            continue
+        path = root / name
+        physical = path.resolve()
+        if path.is_symlink() and physical != default_home:
+            raise Deferred('only the default Codex home can be adopted')
+        if not path.is_dir() or path in accounts:
+            continue
+        if physical in physical_homes:
+            raise Deferred('manifest accounts share the same physical Codex home')
+        physical_homes[physical] = path
+        accounts.append(path)
+    if requested is not None and Path(requested).resolve() not in physical_homes:
+        raise Deferred('account outside manifest')
+    return sorted(accounts)
+
+
+def check_paths(root, accounts):
+    if account_dirs(root) != sorted(accounts):
+        raise Deferred('manifest accounts changed during OAuth preparation')
+    shared = root / SHARED_DIR
+    for path in (root, shared, shared / 'locks', shared / 'credentials.json', shared / 'managed.json'):
+        if path.is_symlink():
+            raise Deferred('shared state must remain inside pool')
+    for account in accounts:
+        if (account / CREDENTIALS).is_symlink():
+            raise Deferred('credential symlink is unsupported by native Codex')
+    check_lock_dirs(accounts, shared / 'locks')
+    check_backends(accounts)
+
+
+def shared_document(accounts, shared):
+    authority, receipt_path = shared / 'credentials.json', shared / 'managed.json'
+    receipt = read_json(receipt_path)
+    managed = receipt.get('accounts', [])
+    if not isinstance(managed, list) or not all(isinstance(name, str) for name in managed):
+        raise Deferred('invalid sharing receipt')
+    retired = bool(managed) and (not authority.exists() or any(
+        account.name in managed and not (account / CREDENTIALS).exists() for account in accounts))
+    canonical = validate(read_json(authority)) if not retired else {}
+    documents = [canonical]
+    for account in accounts:
+        path = account / CREDENTIALS
+        if not path.exists() or retired and account.name in managed:
+            continue
+        if authority.exists() and os.path.samefile(path, authority):
+            continue
+        private = validate(read_json(path))
+        private_grants = {key: value for key, value in private.items() if key != SENTINEL}
+        current_grants = {key: value for key, value in canonical.items() if key != SENTINEL}
+        if (authority.exists() or managed) and private_grants and private_grants != current_grants:
+            raise Deferred('private credential document conflicts with shared authority')
+        documents.append(private)
+    return merge(documents)
+
+
+def reconcile(root, accounts):
+    shared = root / SHARED_DIR
+    shared_document(accounts, shared)  # Reject conflicts before creating any migration state.
+    shared.mkdir(mode=0o700, exist_ok=True)
+    os.chmod(shared, 0o700)
+    locks = shared / 'locks'
+    # Existing credential owners go first when consolidating native lock files.
+    accounts = sorted(accounts, key=lambda item: not (item / CREDENTIALS).exists())
+    with native_locks(accounts, locks) as locked_paths:
+        doc = shared_document(accounts, shared)
+        authority = shared / 'credentials.json'
+        if not authority.exists():
+            owner = next((item / CREDENTIALS for item in accounts if (item / CREDENTIALS).exists()), None)
+            if owner is not None:
+                os.link(owner, authority)
+        if not authority.exists():
+            write_shared(authority, doc)
+        with staged_links(authority, accounts, locks) as pending:
+            join_locks(accounts, locks, locked_paths)
+            if read_json(authority) != doc:
+                write_shared(authority, doc)
+            else:
+                os.chmod(authority, 0o600)
+            commit_links(pending)
+            save_receipt(shared / 'managed.json', accounts)
+    return True
+
+
+def ensure(root, account_dir=None, initialize=False, strict=False):
+    if os.environ.get('CODEX_MULTIACC_MCP_OAUTH', '1').lower() in ('0', 'false', 'off', 'no'):
+        return False
+    root = Path(os.path.abspath(root))
+    try:
+        if root.is_symlink():
+            raise Deferred('pool root must not be a symlink')
+        root = root.resolve()
+        accounts = account_dirs(root, account_dir)
+        if not accounts:
+            return False
+        if not initialize and not (root / SHARED_DIR).exists() and not any(
+                (item / CREDENTIALS).exists() for item in accounts):
+            return False
+        check_paths(root, accounts)
+        with held(root / '.codex-mcp-oauth.lock'):
+            check_paths(root, accounts)
+            return reconcile(root, accounts)
+    except Deferred:
+        if strict:
+            raise
+        return False
+    except (OSError, ValueError, TypeError) as exc:
+        if strict:
+            raise Deferred('invalid or inaccessible MCP OAuth storage') from exc
+        return False
+
+
+def check_backends(accounts):
+    for account in accounts:
+        config = account / 'config.toml'
+        if not config.exists():
+            continue
+        if tomllib is None:
+            raise Deferred('MCP OAuth sharing requires Python 3.11 or newer')
+        with config.open('rb') as stream:
+            doc = tomllib.load(stream)
+        features = doc.get('features', {})
+        if not isinstance(features, dict):
+            raise Deferred('invalid Codex feature configuration')
+        if doc.get('mcp_oauth_credentials_store', 'auto') != 'file' and features.get('secret_auth_storage', False):
+            raise Deferred('encrypted per-account MCP storage cannot be shared')
+
+
+def supported_version(binary):
+    try:
+        result = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=3, check=False)
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise Deferred('native Codex version could not be verified') from exc
+    match = re.fullmatch(r'codex-cli (\d+)\.(\d+)\.(\d+)\s*', result.stdout)
+    if result.returncode or not match or tuple(map(int, match.groups())) < (0, 163, 0):
+        raise Deferred('MCP OAuth sharing requires native Codex 0.163.0 or newer')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('command', choices=('ensure', 'apply'))
+    parser.add_argument('--root', required=True)
+    parser.add_argument('--codex-bin', required=True)
+    parser.add_argument('--account-dir')
+    parser.add_argument('--init', action='store_true')
+    parser.add_argument('--quiet', action='store_true')
+    args = parser.parse_args()
+    try:
+        supported_version(args.codex_bin)
+        prepared = ensure(args.root, args.account_dir, args.init, strict=True)
+        if not args.quiet:
+            print('Codex MCP OAuth storage is shared across this pool.' if prepared
+                  else 'No MCP OAuth storage prepared (disabled or no saved login).')
+        return 0
+    except Deferred as exc:
+        if not args.quiet:
+            print(f'codex-mcp-oauth: {exc}', file=sys.stderr)
+        return 1
+
+
+if __name__ == '__main__':
+    from codex_python import require_python311
+    require_python311(__file__)
+    sys.exit(main())

package/lib/codex_mcp_oauth.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Native Codex MCP credentials and refresh locks stay local to this pool.
+# No Python startup for a pool that has never saved an MCP OAuth login.
+codex_mcp_oauth_ensure() { # root, python, module, optional account directory and native binary
+  [ "${CODEX_MULTIACC_MCP_OAUTH:-1}" != "0" ] || return 0
+  local root="$1" py="$2" module="$3" account="${4:-}" real="${5:-}" found=0 f
+  [ -f "$root/accounts.json" ] && [ -f "$module" ] || return 0
+  if [ -d "$root/.codex-mcp-oauth" ]; then
+    found=1
+  else
+    for f in "$root"/acct-*/.credentials.json; do
+      if [ -f "$f" ]; then found=1; break; fi
+    done
+  fi
+  [ "$found" = 1 ] || return 0
+  if [ -z "$real" ] && type find_real_codex >/dev/null 2>&1; then
+    real="$(find_real_codex 2>/dev/null)" || return 0
+  fi
+  [ -n "$real" ] || return 0
+  if [ -n "$account" ]; then
+    "$py" "$module" ensure --root "$root" --codex-bin "$real" --account-dir "$account" --quiet \
+      >/dev/null 2>&1 </dev/null || true
+  else
+    "$py" "$module" ensure --root "$root" --codex-bin "$real" --quiet >/dev/null 2>&1 </dev/null || true
+  fi
+  return 0
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then codex_mcp_oauth_ensure "$@"; fi

package/lib/codex_mcp_oauth_locks.py

@@ -0,0 +1,158 @@
+"""Join native Codex OAuth lock domains without bypassing an active lock holder."""
+from __future__ import annotations
+
+import contextlib
+import fcntl
+import os
+import re
+import stat
+import time
+from pathlib import Path
+
+from codex_mcp_oauth_native import exchange, exchange_supported, external_handles
+from codex_mcp_oauth_store import Deferred
+
+LOCK_NAME = re.compile(r'^(?:[a-f0-9]{64}|file-store|secrets-store)\.lock$')
+
+
+class LockPaths(dict):
+    """Native path snapshot plus the descriptors owned by this migration."""
+
+
+@contextlib.contextmanager
+def held(path):
+    fd = os.open(path, os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600)
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise Deferred('non-regular lock')
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError as exc:
+            raise Deferred('native OAuth operation in progress') from exc
+        yield fd
+    finally:
+        os.close(fd)
+
+
+def check_lock_dirs(accounts, shared):
+    for account in accounts:
+        path = account / 'mcp-oauth-locks'
+        if path.is_symlink():
+            if path.resolve() != shared:
+                raise Deferred('foreign lock directory link')
+        elif path.exists() and not path.is_dir():
+            raise Deferred('non-directory native locks')
+        if path.exists():
+            for item in path.iterdir():
+                if item.is_symlink() or not item.is_file() or not LOCK_NAME.fullmatch(item.name):
+                    raise Deferred('unsupported native lock state')
+
+
+def retired_directories(shared):
+    root = shared.parent / 'retired-locks'
+    if root.is_symlink() or root.exists() and not root.is_dir():
+        raise Deferred('unsupported retired native locks')
+    directories = []
+    for directory in root.iterdir() if root.exists() else []:
+        if not re.fullmatch(r'acct-\d{2,4}', directory.name):
+            raise Deferred('unsupported retired native locks')
+        if directory.is_symlink():
+            if directory.resolve() != shared:
+                raise Deferred('foreign retired lock link')
+            continue
+        if not directory.is_dir():
+            raise Deferred('unsupported retired native locks')
+        for path in directory.iterdir():
+            if path.is_symlink() or not path.is_file() or not LOCK_NAME.fullmatch(path.name):
+                raise Deferred('unsupported retired native locks')
+        directories.append(directory)
+    return directories
+
+
+@contextlib.contextmanager
+def native_locks(accounts, shared):
+    paths = [account / 'mcp-oauth-locks' for account in accounts] + [shared]
+    paths += retired_directories(shared)
+    with contextlib.ExitStack() as stack:
+        seen = set()
+        locked_paths = LockPaths()
+        locked_paths.owned_fds = set()
+        for directory in paths:
+            directory.mkdir(mode=0o700, exist_ok=True)
+            file_lock = directory / 'file-store.lock'
+            candidates = set(directory.iterdir())
+            if directory != shared or file_lock.exists():
+                candidates.add(file_lock)
+            candidates = sorted(candidates, key=lambda item: item.name)
+            locked_paths[directory] = candidates
+            for path in candidates:
+                if path.exists():
+                    inode = (path.stat().st_dev, path.stat().st_ino)
+                    if inode in seen:
+                        continue
+                locked_paths.owned_fds.add(stack.enter_context(held(path)))
+                seen.add((path.stat().st_dev, path.stat().st_ino))
+        yield locked_paths
+
+
+def prepare_cutover(directories, shared, locked_paths):
+    exchange_supported()
+    paths = [path for values in locked_paths.values() for path in values]
+    if external_handles(paths, locked_paths.owned_fds):
+        raise Deferred('native OAuth lock handles are still open')
+    retired = shared.parent / 'retired-locks'
+    retired.mkdir(mode=0o700, exist_ok=True)
+    for directory in directories:
+        if set(directory.iterdir()) != set(locked_paths[directory]):
+            raise Deferred('native OAuth lock state changed during migration')
+        for source in locked_paths[directory]:
+            target = shared / source.name
+            if not target.exists():
+                os.link(source, target)
+        pending = retired / directory.parent.name
+        if pending.is_symlink() and pending.resolve() == shared:
+            pending.unlink()
+        pending.symlink_to(shared, target_is_directory=True)
+    return retired
+
+
+def drain_retired(shared, owned_fds):
+    directories = retired_directories(shared)
+    for directory in directories:
+        for path in directory.iterdir():
+            try:
+                os.link(path, shared / path.name)
+            except FileExistsError:
+                pass
+    discarded = [path for directory in directories for path in directory.iterdir()
+                 if not (shared / path.name).exists() or not os.path.samefile(path, shared / path.name)]
+    # Never release either lock domain while a pre-cutover native waiter can still use the old inode.
+    # Native contenders normally time out within 60s; no unsafe fixed deadline admits a suspended fd.
+    while discarded:
+        try:
+            if not external_handles(discarded, owned_fds):
+                break
+        except Deferred:
+            pass
+        time.sleep(0.05)
+    for directory in directories:
+        for path in directory.iterdir():
+            path.unlink()
+        directory.rmdir()
+
+
+def join_locks(accounts, shared, locked_paths):
+    """Preserve owner inodes; atomically cut over and drain retired native waiters."""
+    directories = [account / 'mcp-oauth-locks' for account in accounts
+                   if not (account / 'mcp-oauth-locks').is_symlink()]
+    if not directories:
+        if retired_directories(shared):
+            exchange_supported()
+            drain_retired(shared, locked_paths.owned_fds)
+        return
+    retired = prepare_cutover(directories, shared, locked_paths)
+    try:
+        for directory in directories:
+            exchange(directory, retired / directory.parent.name)
+    finally:
+        drain_retired(shared, locked_paths.owned_fds)