claude-multiacc 2.0.64 → 2.0.66

package/lib/autoresume.py

@@ -1214,6 +1214,14 @@ def codex_effort_ok(val):
         and EFFORT_VALUE_RE.match(val[len(CODEX_EFFORT_KEY):]) is not None
 
 
+def codex_speed_ok(val):
+    """Only known speed choices, never arbitrary config, may cross a relaunch."""
+    if val == "features.fast_mode=true":
+        return True
+    return isinstance(val, str) and re.fullmatch(
+        r'''service_tier=(?:default|fast|priority|ultrafast|"(?:default|fast|priority|ultrafast)"|'(?:default|fast|priority|ultrafast)')''', val) is not None
+
+
 def codex_argv_parse(argv):
     """The argv shapes a codex relaunch can rebuild (mirrors bin/codex's ar_argv_ok) ->
     (kept options, resume target or None), or None for anything else."""
@@ -1231,7 +1239,7 @@ def codex_argv_parse(argv):
             kept += [arg, expected]
             i += 1
         elif arg in ("-m", "--model", "-c"):
-            value_ok = codex_effort_ok if arg == "-c" else _value_ok
+            value_ok = (lambda value: codex_effort_ok(value) or codex_speed_ok(value)) if arg == "-c" else _value_ok
             if i + 1 >= len(argv) or not value_ok(argv[i + 1]):
                 return None
             kept += [arg, argv[i + 1]]
@@ -1315,7 +1323,11 @@ def settings_argv(provider, settings):
     (anything else counts as unknown). [] when nothing is known."""
     effort = settings.get("effort") if isinstance(settings, dict) else None
     effort = effort if isinstance(effort, str) and EFFORT_VALUE_RE.match(effort) else None
-    return settings_flags(provider, history_model(settings), effort)
+    flags = settings_flags(provider, history_model(settings), effort)
+    if provider == "codex" and isinstance(settings, dict) and settings.get("speed") in ("normal", "fast", "ultrafast"):
+        flags += ["-c", "service_tier=" + {"normal": "default", "fast": "fast",
+                                           "ultrafast": "ultrafast"}[settings["speed"]]]
+    return flags
 
 
 def argv_settings(provider, argv):
@@ -1336,6 +1348,10 @@ def argv_settings(provider, argv):
         elif provider == "codex" and arg == "-c" and codex_effort_ok(val):
             found["effort"] = val[len(CODEX_EFFORT_KEY):]
             i += 1
+        elif provider == "codex" and arg == "-c" and val.startswith("service_tier=") and codex_speed_ok(val):
+            from codex_speed import speed
+            found["speed"] = speed(val.split("=", 1)[1].strip("\"'"))
+            i += 1
         i += 1
     return found
 
@@ -1355,14 +1371,16 @@ def claude_model_left(launch, served):
     return family is not None and family != launch
 
 
-def without_settings(kept, model, effort):
+def without_settings(kept, model, effort, speed=False):
     """``kept`` without its model options (-m V, --model V, --model=V) when ``model`` and its
     effort options (--effort V, codex's -c model_reasoning_effort=V) when ``effort``. Both
     parsers refuse a value that starts with "-", so no value is ever taken for an option."""
     out, i = [], 0
     while i < len(kept):
         arg = kept[i]
-        if (model and arg in ("-m", "--model")) or (effort and arg in ("--effort", "-c")):
+        val = kept[i + 1] if i + 1 < len(kept) else ""
+        if ((model and arg in ("-m", "--model")) or (effort and arg == "--effort")
+                or (arg == "-c" and ((effort and codex_effort_ok(val)) or (speed and codex_speed_ok(val))))):
             i += 2
             continue
         if not (model and arg.startswith("--model=")):
@@ -1407,10 +1425,12 @@ def relaunch_argv(provider, argv, sid, cls, prompt=None, settings=None, detail=N
         left = claude_model_left(argv_settings("claude", kept).get("model"), settings.get("model"))
         settings = {"effort": settings.get("effort")}
     flags = settings_argv(provider, settings)
-    model, effort = left or "--model" in flags or "-m" in flags, "--effort" in flags or "-c" in flags
-    if provider == "codex" and not flags and history_model(settings):
+    model = left or "--model" in flags or "-m" in flags
+    effort = "--effort" in flags or any(codex_effort_ok(value) for value in flags)
+    speed = provider == "codex" and settings.get("speed") in ("normal", "fast", "ultrafast")
+    if provider == "codex" and not model and history_model(settings):
         model = effort = True  # no launch -m or -c alone: neither, and the thread restores both
-    return head + without_settings(kept, model, effort) + flags + tail
+    return head + without_settings(kept, model, effort, speed) + flags + tail
 
 
 # ---- relaunch / state files ---------------------------------------------------------
@@ -2721,7 +2741,7 @@ class Watcher:
         try:
             found = session_settings(self.provider, self.transcript)
             self.served_model = history_model(found)
-            if not found.get("model") and not found.get("effort"):
+            if not found.get("model") and not found.get("effort") and not found.get("speed"):
                 return None
             # The catalog only clamps an effort to the model and supplies Codex's default
             # one: this pool's copy and caches, the other pool's only when the chain named it.

package/lib/claude_oauth_lock.py

@@ -0,0 +1,172 @@
+"""Serialize OAuth token POSTs with Claude Code's native refresh locks.
+
+Claude Code 2.1.310 Gnr/Vri use proper-lockfile directories: first
+<config>/.oauth_refresh.lock, then <realpath(config)>.lock, with a 60-second
+stale deadline and five-second mtime renewal. Ec changes callback scheduling,
+not that on-disk protocol. The optional native owner sidecar only accelerates
+proven-dead-holder recovery; without one, native clients retain the stale gate.
+
+Hold this lock across credential reread, token exchange and rotated-token save.
+The separate .storage-write.lock protects only short credential transactions.
+"""
+from __future__ import annotations
+
+import os
+import stat
+import threading
+import time
+from pathlib import Path
+
+STALE_SECONDS = 60.0
+UPDATE_SECONDS = 5.0
+RETRY_SECONDS = 0.05
+
+
+def _snapshot(path: Path) -> tuple[int, int, int] | None:
+    try:
+        value = path.lstat()
+        if stat.S_ISDIR(value.st_mode):
+            return value.st_dev, value.st_ino, value.st_mtime_ns
+    except OSError:
+        pass
+    return None
+
+
+class RefreshLock:
+    """Bounded, fail-closed lock; call release even after an exchange fails."""
+
+    def __init__(self, directory: str | Path, timeout: float = 1.0):
+        directory = Path(directory).absolute()
+        self.paths = (directory / ".oauth_refresh.lock", Path(str(directory.resolve()) + ".lock"))
+        self.timeout = max(0.0, timeout)
+        self._held: list[tuple[Path, int, tuple[int, int, int]]] = []
+        self._mutex = threading.Lock()
+        self._stop = threading.Event()
+        self._thread: threading.Thread | None = None
+        self._compromised = False
+
+    def acquire(self) -> bool:
+        deadline = time.monotonic() + self.timeout
+        with self._mutex:
+            if self._held:
+                return not self._compromised and all(
+                    _snapshot(path) == stamp and time.time_ns() - stamp[2] < STALE_SECONDS * 1e9
+                    for path, _, stamp in self._held)
+            self._compromised = False
+            self._stop.clear()
+            while True:
+                for path in self.paths:
+                    entry = self._claim(path)
+                    if entry is None:
+                        break
+                    self._held.append(entry)
+                if len(self._held) == len(self.paths):
+                    self._thread = threading.Thread(target=self._heartbeat, daemon=True)
+                    try:
+                        self._thread.start()
+                    except RuntimeError:
+                        self._release_paths()
+                        self._thread = None
+                        return False
+                    return True
+                self._release_paths()
+                remaining = deadline - time.monotonic()
+                if remaining <= 0:
+                    return False
+                time.sleep(min(RETRY_SECONDS, remaining))
+
+    def _claim(self, path: Path) -> tuple[Path, int, tuple[int, int, int]] | None:
+        try:
+            path.mkdir(mode=0o700)
+        except FileExistsError:
+            before = _snapshot(path)
+            if before is None or time.time_ns() - before[2] <= STALE_SECONDS * 1e9:
+                return None
+            try:
+                if _snapshot(path) != before:
+                    return None
+                path.rmdir()
+                path.mkdir(mode=0o700)
+            except OSError:
+                return None
+        except OSError:
+            return None
+        before = _snapshot(path)
+        descriptor = None
+        claimed = False
+        try:
+            descriptor = os.open(path, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+            value = os.fstat(descriptor)
+            if before is None or (value.st_dev, value.st_ino, value.st_mtime_ns) != before:
+                return None
+            now = time.time_ns()
+            os.utime(descriptor, ns=(now, now))
+            value = os.fstat(descriptor)
+            stamp = value.st_dev, value.st_ino, value.st_mtime_ns
+            before = stamp
+            if _snapshot(path) != stamp:
+                return None
+            claimed = True
+            result, descriptor = (path, descriptor, stamp), None
+            return result
+        except OSError:
+            return None
+        finally:
+            if descriptor is not None:
+                os.close(descriptor)
+            if not claimed and before is not None and _snapshot(path) == before:
+                try:
+                    path.rmdir()
+                except OSError:
+                    pass
+
+    def _renew(self) -> bool:
+        for index, (path, descriptor, stamp) in enumerate(self._held):
+            if _snapshot(path) != stamp or time.time_ns() - stamp[2] >= STALE_SECONDS * 1e9:
+                return False
+            try:
+                now = time.time_ns()
+                os.utime(descriptor, ns=(now, now))
+                value = os.fstat(descriptor)
+                updated = value.st_dev, value.st_ino, value.st_mtime_ns
+                if _snapshot(path) != updated:
+                    return False
+                self._held[index] = path, descriptor, updated
+            except OSError:
+                return False
+        return True
+
+    def _heartbeat(self) -> None:
+        while not self._stop.wait(UPDATE_SECONDS):
+            with self._mutex:
+                if not self._renew():
+                    self._compromised = True
+                    return
+
+    def _release_paths(self) -> None:
+        for path, descriptor, stamp in reversed(self._held):
+            try:
+                if _snapshot(path) == stamp:
+                    path.rmdir()
+            except OSError:
+                pass
+            finally:
+                os.close(descriptor)
+        self._held.clear()
+
+    def release(self) -> None:
+        self._stop.set()
+        thread = self._thread
+        if thread is not None:
+            thread.join(timeout=1.0)
+        with self._mutex:
+            self._release_paths()
+            self._thread = None
+
+    @property
+    def compromised(self) -> bool:
+        with self._mutex:
+            if any(_snapshot(path) != stamp or time.time_ns() - stamp[2] >= STALE_SECONDS * 1e9
+                   for path, _, stamp in self._held):
+                self._compromised = True
+            return self._compromised

package/lib/claude_oauth_refresh.py

@@ -0,0 +1,225 @@
+"""Refresh machine-local Claude logins without racing the native rotating grant.
+
+Claude Code 2.1.310 holds both refresh locks across the token request. The storage
+lock protects only the final read/compare/write, never the network round trip.
+An invalid_grant response can leave an empty-token tombstone; that is not a newer
+login and must not displace a successfully rotated grant. A removed login is logout.
+"""
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.request
+
+from claude_oauth_lock import RefreshLock
+from mcp_oauth import CLIENT_LOCK, CLIENT_LOCK_STALE_S, ClientLock
+
+REFRESH_MIN_EXPIRED = 300
+REFRESH_FAIL_BACKOFF = 600
+REFRESH_DENIED_BACKOFF = 21600
+CLIENT_LOCK_PROBE_S = 1.0
+CLIENT_LOCK_WAIT_S = 10.0
+
+
+def read_login(store):
+    """Unreadable, missing, or non-object logins cannot authorize a token write."""
+    try:
+        doc = store.read()
+        login = doc.get('claudeAiOauth') if isinstance(doc, dict) else None
+        return dict(login) if isinstance(login, dict) else None
+    except Exception:
+        return None
+
+
+def client_lock_busy(directory):
+    deadline = time.monotonic() + CLIENT_LOCK_PROBE_S
+    while True:
+        try:
+            if time.time() - os.stat(os.path.join(directory, CLIENT_LOCK)).st_mtime > CLIENT_LOCK_STALE_S:
+                return False
+        except OSError:
+            return False
+        if time.monotonic() >= deadline:
+            return True
+        time.sleep(0.05)
+
+
+def rotated_login(login, data, now):
+    result = dict(login, accessToken=data['access_token'])
+    if data.get('refresh_token'):
+        result['refreshToken'] = data['refresh_token']
+    result['expiresAt'] = int((now + float(data.get('expires_in') or 3600)) * 1000)
+    if data.get('refresh_token_expires_in'):
+        result['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
+    return result
+
+
+class OAuthRefresher:
+    def __init__(self, *, now, force, token_url, client_id, say, park_dead_grant, clear_expired):
+        self.now = now
+        self.force = force
+        self.token_url = token_url
+        self.client_id = client_id
+        self.say = say
+        self.park = park_dead_grant
+        self.clear_expired = clear_expired
+
+    def refresh(self, aid, directory, store):
+        # This lock must fail closed: a grace period after access expiry does not
+        # prove that another process has stopped refreshing the same rotating grant.
+        lock = RefreshLock(directory)
+        if not lock.acquire():
+            self.say(f'{aid}: oauth refresh skipped — the client holds its refresh lock; the next pass retries')
+            return None
+        try:
+            # Reread AFTER ownership: the client may have refreshed while we waited.
+            login = read_login(store)
+            if login is None:
+                return None
+            if login.get('accessToken') and login.get('expiresAt', 0) / 1000 > self.now + 60:
+                return login['accessToken']
+            if not self.eligible(aid, directory, login):
+                return None
+            if client_lock_busy(directory) or lock.compromised:
+                self.say(f'{aid}: oauth refresh skipped — the client holds its credential lock ({CLIENT_LOCK})')
+                return None
+            data = self.post(aid, directory, login['refreshToken'], store)
+            if data is None:
+                return None
+            rotated = rotated_login(login, data, self.now)
+            if not self.save(aid, directory, store, login['refreshToken'], rotated):
+                return None
+            try:
+                os.remove(os.path.join(directory, '.oauth-refresh.json'))
+            except OSError:
+                pass
+            if self.clear_expired(directory):
+                self.say(f'{aid}: dead-auth marker cleared (refresh grant works again)')
+            self.say(f'{aid}: oauth access token refreshed via refresh-token grant')
+            return rotated['accessToken']
+        finally:
+            lock.release()
+
+    def eligible(self, aid, directory, login):
+        if not login.get('refreshToken'):
+            self.park(aid, directory, 'no-refresh-token',
+                      'credential has no refresh token and its access token expired')
+            return False
+        if login.get('expiresAt', 0) / 1000 > self.now - REFRESH_MIN_EXPIRED:
+            return False
+        refresh_expiry = login.get('refreshTokenExpiresAt')
+        if refresh_expiry and refresh_expiry / 1000 <= self.now:
+            self.park(aid, directory, 'refresh-token-expired',
+                      'the refresh token itself expired; only a re-login can fix it')
+            return False
+        if not self.force:
+            try:
+                with open(os.path.join(directory, '.oauth-refresh.json')) as stream:
+                    if json.load(stream).get('retry_after', 0) > self.now:
+                        return False
+            except (OSError, ValueError, AttributeError):
+                pass
+        return True
+
+    def back_off(self, aid, directory, wait, why, denials=0):
+        path = os.path.join(directory, '.oauth-refresh.json')
+        try:
+            with open(path + '.tmp', 'w') as stream:
+                json.dump({'retry_after': int(self.now + wait), 'error': why, 'denials': denials,
+                           'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}, stream)
+            os.replace(path + '.tmp', path)
+        except OSError:
+            pass
+        self.say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
+
+    def post(self, aid, directory, refresh_token, store):
+        body = json.dumps({'grant_type': 'refresh_token', 'refresh_token': refresh_token,
+                           'client_id': self.client_id}).encode()
+        request = urllib.request.Request(self.token_url, data=body, headers={
+            'Content-Type': 'application/json', 'User-Agent': 'claude-multiacc/1.0',
+        })
+        try:
+            data = json.loads(urllib.request.urlopen(request, timeout=30).read().decode())
+        except Exception as error:
+            # A sign-in/logout can replace this grant without the refresh lock.
+            # A failure of the old request must never park the new login.
+            disk = read_login(store)
+            if disk is None or disk.get('refreshToken') != refresh_token:
+                self.say(f'{aid}: oauth login changed during a failed refresh; leaving its state unchanged')
+                return None
+            if isinstance(error, urllib.error.HTTPError) and error.code in (400, 401, 403):
+                self.denied(aid, directory, error, store, refresh_token)
+            else:
+                why = f'HTTP {error.code}' if isinstance(error, urllib.error.HTTPError) else type(error).__name__
+                self.back_off(aid, directory, REFRESH_FAIL_BACKOFF, why)
+            return None
+        if not isinstance(data, dict) or not data.get('access_token'):
+            disk = read_login(store)
+            if disk is not None and disk.get('refreshToken') == refresh_token:
+                self.back_off(aid, directory, REFRESH_DENIED_BACKOFF, 'no access_token in response')
+            return None
+        return data
+
+    def denied(self, aid, directory, error, store, refresh_token):
+        body = ''
+        try:
+            body = error.read(400).decode('utf-8', 'replace')
+        except Exception:
+            pass
+        denials = 1
+        try:
+            with open(os.path.join(directory, '.oauth-refresh.json')) as stream:
+                denials += int(json.load(stream).get('denials', 0))
+        except (OSError, ValueError, TypeError, AttributeError):
+            pass
+        lock = ClientLock(directory, CLIENT_LOCK_WAIT_S)
+        if not lock.acquire():
+            return  # no rotation occurred; retry without marking an uncertain login
+        try:
+            disk = read_login(store)
+            if disk is None or disk.get('refreshToken') != refresh_token:
+                return
+            if 'invalid_grant' in body:
+                self.park(aid, directory, f'refresh-denied-http-{error.code}',
+                          'the refresh grant was refused as invalid_grant (revoked or rotated away)')
+            elif denials >= 3:
+                self.park(aid, directory, f'refresh-denied-http-{error.code}',
+                          f'the refresh grant was refused {denials} times in a row')
+            self.back_off(aid, directory, REFRESH_DENIED_BACKOFF,
+                          f'HTTP {error.code} — refresh token may be revoked; re-login needed', denials)
+        finally:
+            lock.release()
+
+    def save(self, aid, directory, store, started_with, login):
+        lock = ClientLock(directory, CLIENT_LOCK_WAIT_S)
+        held = False
+        try:
+            held = lock.acquire()
+        except Exception:
+            pass
+        if not held and os.path.isdir(lock.path):
+            self.say(f'{aid}: the client kept its credential lock ({CLIENT_LOCK}) past '
+                     f'{int(CLIENT_LOCK_WAIT_S)}s — writing the rotated login without it')
+        try:
+            disk = read_login(store)
+            # Native invalid_grant clears these three fields but leaves the login
+            # object. A missing document/key is logout, never a tombstone to restore.
+            tombstone = (disk is not None and disk.get('refreshToken') == ''
+                         and disk.get('accessToken') == '' and disk.get('expiresAt') == 0)
+            if disk is None or (disk.get('refreshToken') != started_with and not tombstone):
+                self.say(f'{aid}: credential was refreshed by something else mid-flight — '
+                         f'keeping the newer one in the {store.kind} (or its removal)')
+                return False
+            try:
+                # Store implementations merge only this key, preserving current MCP state.
+                store.write({'claudeAiOauth': login})
+            except Exception as error:
+                self.say(f'{aid}: token refreshed but credentials NOT persisted '
+                         f'({type(error).__name__}) — re-login may be needed')
+                return False
+            return True
+        finally:
+            if held:
+                lock.release()