claude-multiacc 2.0.65 → 2.0.66

package/lib/claude_oauth_refresh.py

@@ -0,0 +1,225 @@
+"""Refresh machine-local Claude logins without racing the native rotating grant.
+
+Claude Code 2.1.310 holds both refresh locks across the token request. The storage
+lock protects only the final read/compare/write, never the network round trip.
+An invalid_grant response can leave an empty-token tombstone; that is not a newer
+login and must not displace a successfully rotated grant. A removed login is logout.
+"""
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.request
+
+from claude_oauth_lock import RefreshLock
+from mcp_oauth import CLIENT_LOCK, CLIENT_LOCK_STALE_S, ClientLock
+
+REFRESH_MIN_EXPIRED = 300
+REFRESH_FAIL_BACKOFF = 600
+REFRESH_DENIED_BACKOFF = 21600
+CLIENT_LOCK_PROBE_S = 1.0
+CLIENT_LOCK_WAIT_S = 10.0
+
+
+def read_login(store):
+    """Unreadable, missing, or non-object logins cannot authorize a token write."""
+    try:
+        doc = store.read()
+        login = doc.get('claudeAiOauth') if isinstance(doc, dict) else None
+        return dict(login) if isinstance(login, dict) else None
+    except Exception:
+        return None
+
+
+def client_lock_busy(directory):
+    deadline = time.monotonic() + CLIENT_LOCK_PROBE_S
+    while True:
+        try:
+            if time.time() - os.stat(os.path.join(directory, CLIENT_LOCK)).st_mtime > CLIENT_LOCK_STALE_S:
+                return False
+        except OSError:
+            return False
+        if time.monotonic() >= deadline:
+            return True
+        time.sleep(0.05)
+
+
+def rotated_login(login, data, now):
+    result = dict(login, accessToken=data['access_token'])
+    if data.get('refresh_token'):
+        result['refreshToken'] = data['refresh_token']
+    result['expiresAt'] = int((now + float(data.get('expires_in') or 3600)) * 1000)
+    if data.get('refresh_token_expires_in'):
+        result['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
+    return result
+
+
+class OAuthRefresher:
+    def __init__(self, *, now, force, token_url, client_id, say, park_dead_grant, clear_expired):
+        self.now = now
+        self.force = force
+        self.token_url = token_url
+        self.client_id = client_id
+        self.say = say
+        self.park = park_dead_grant
+        self.clear_expired = clear_expired
+
+    def refresh(self, aid, directory, store):
+        # This lock must fail closed: a grace period after access expiry does not
+        # prove that another process has stopped refreshing the same rotating grant.
+        lock = RefreshLock(directory)
+        if not lock.acquire():
+            self.say(f'{aid}: oauth refresh skipped — the client holds its refresh lock; the next pass retries')
+            return None
+        try:
+            # Reread AFTER ownership: the client may have refreshed while we waited.
+            login = read_login(store)
+            if login is None:
+                return None
+            if login.get('accessToken') and login.get('expiresAt', 0) / 1000 > self.now + 60:
+                return login['accessToken']
+            if not self.eligible(aid, directory, login):
+                return None
+            if client_lock_busy(directory) or lock.compromised:
+                self.say(f'{aid}: oauth refresh skipped — the client holds its credential lock ({CLIENT_LOCK})')
+                return None
+            data = self.post(aid, directory, login['refreshToken'], store)
+            if data is None:
+                return None
+            rotated = rotated_login(login, data, self.now)
+            if not self.save(aid, directory, store, login['refreshToken'], rotated):
+                return None
+            try:
+                os.remove(os.path.join(directory, '.oauth-refresh.json'))
+            except OSError:
+                pass
+            if self.clear_expired(directory):
+                self.say(f'{aid}: dead-auth marker cleared (refresh grant works again)')
+            self.say(f'{aid}: oauth access token refreshed via refresh-token grant')
+            return rotated['accessToken']
+        finally:
+            lock.release()
+
+    def eligible(self, aid, directory, login):
+        if not login.get('refreshToken'):
+            self.park(aid, directory, 'no-refresh-token',
+                      'credential has no refresh token and its access token expired')
+            return False
+        if login.get('expiresAt', 0) / 1000 > self.now - REFRESH_MIN_EXPIRED:
+            return False
+        refresh_expiry = login.get('refreshTokenExpiresAt')
+        if refresh_expiry and refresh_expiry / 1000 <= self.now:
+            self.park(aid, directory, 'refresh-token-expired',
+                      'the refresh token itself expired; only a re-login can fix it')
+            return False
+        if not self.force:
+            try:
+                with open(os.path.join(directory, '.oauth-refresh.json')) as stream:
+                    if json.load(stream).get('retry_after', 0) > self.now:
+                        return False
+            except (OSError, ValueError, AttributeError):
+                pass
+        return True
+
+    def back_off(self, aid, directory, wait, why, denials=0):
+        path = os.path.join(directory, '.oauth-refresh.json')
+        try:
+            with open(path + '.tmp', 'w') as stream:
+                json.dump({'retry_after': int(self.now + wait), 'error': why, 'denials': denials,
+                           'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}, stream)
+            os.replace(path + '.tmp', path)
+        except OSError:
+            pass
+        self.say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
+
+    def post(self, aid, directory, refresh_token, store):
+        body = json.dumps({'grant_type': 'refresh_token', 'refresh_token': refresh_token,
+                           'client_id': self.client_id}).encode()
+        request = urllib.request.Request(self.token_url, data=body, headers={
+            'Content-Type': 'application/json', 'User-Agent': 'claude-multiacc/1.0',
+        })
+        try:
+            data = json.loads(urllib.request.urlopen(request, timeout=30).read().decode())
+        except Exception as error:
+            # A sign-in/logout can replace this grant without the refresh lock.
+            # A failure of the old request must never park the new login.
+            disk = read_login(store)
+            if disk is None or disk.get('refreshToken') != refresh_token:
+                self.say(f'{aid}: oauth login changed during a failed refresh; leaving its state unchanged')
+                return None
+            if isinstance(error, urllib.error.HTTPError) and error.code in (400, 401, 403):
+                self.denied(aid, directory, error, store, refresh_token)
+            else:
+                why = f'HTTP {error.code}' if isinstance(error, urllib.error.HTTPError) else type(error).__name__
+                self.back_off(aid, directory, REFRESH_FAIL_BACKOFF, why)
+            return None
+        if not isinstance(data, dict) or not data.get('access_token'):
+            disk = read_login(store)
+            if disk is not None and disk.get('refreshToken') == refresh_token:
+                self.back_off(aid, directory, REFRESH_DENIED_BACKOFF, 'no access_token in response')
+            return None
+        return data
+
+    def denied(self, aid, directory, error, store, refresh_token):
+        body = ''
+        try:
+            body = error.read(400).decode('utf-8', 'replace')
+        except Exception:
+            pass
+        denials = 1
+        try:
+            with open(os.path.join(directory, '.oauth-refresh.json')) as stream:
+                denials += int(json.load(stream).get('denials', 0))
+        except (OSError, ValueError, TypeError, AttributeError):
+            pass
+        lock = ClientLock(directory, CLIENT_LOCK_WAIT_S)
+        if not lock.acquire():
+            return  # no rotation occurred; retry without marking an uncertain login
+        try:
+            disk = read_login(store)
+            if disk is None or disk.get('refreshToken') != refresh_token:
+                return
+            if 'invalid_grant' in body:
+                self.park(aid, directory, f'refresh-denied-http-{error.code}',
+                          'the refresh grant was refused as invalid_grant (revoked or rotated away)')
+            elif denials >= 3:
+                self.park(aid, directory, f'refresh-denied-http-{error.code}',
+                          f'the refresh grant was refused {denials} times in a row')
+            self.back_off(aid, directory, REFRESH_DENIED_BACKOFF,
+                          f'HTTP {error.code} — refresh token may be revoked; re-login needed', denials)
+        finally:
+            lock.release()
+
+    def save(self, aid, directory, store, started_with, login):
+        lock = ClientLock(directory, CLIENT_LOCK_WAIT_S)
+        held = False
+        try:
+            held = lock.acquire()
+        except Exception:
+            pass
+        if not held and os.path.isdir(lock.path):
+            self.say(f'{aid}: the client kept its credential lock ({CLIENT_LOCK}) past '
+                     f'{int(CLIENT_LOCK_WAIT_S)}s — writing the rotated login without it')
+        try:
+            disk = read_login(store)
+            # Native invalid_grant clears these three fields but leaves the login
+            # object. A missing document/key is logout, never a tombstone to restore.
+            tombstone = (disk is not None and disk.get('refreshToken') == ''
+                         and disk.get('accessToken') == '' and disk.get('expiresAt') == 0)
+            if disk is None or (disk.get('refreshToken') != started_with and not tombstone):
+                self.say(f'{aid}: credential was refreshed by something else mid-flight — '
+                         f'keeping the newer one in the {store.kind} (or its removal)')
+                return False
+            try:
+                # Store implementations merge only this key, preserving current MCP state.
+                store.write({'claudeAiOauth': login})
+            except Exception as error:
+                self.say(f'{aid}: token refreshed but credentials NOT persisted '
+                         f'({type(error).__name__}) — re-login may be needed')
+                return False
+            return True
+        finally:
+            if held:
+                lock.release()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.65",
+  "version": "2.0.66",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {
@@ -56,7 +56,8 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
     "test": "npm run test:core && npm run test:seeding && npm run test:commands",
-    "test:core": "bash tests/run-tests.sh && npm run test:selector && npm run test:shim",
+    "test:core": "bash tests/run-tests.sh && npm run test:claude-oauth && npm run test:selector && npm run test:shim",
+    "test:claude-oauth": "python3 -m unittest discover -s tests -p 'test_claude_oauth*.py'",
     "test:shim": "python3 tests/test_shim_path.py && npm run test:codex-stdin",
     "test:codex-stdin": "python3 tests/test_codex_exec_stdin.py && python3 tests/test_codex_retry_process.py",
     "test:selector": "python3 -m unittest discover -s tests -p 'test_selector*.py'",

package/tests/claude_oauth_fixture.py

@@ -0,0 +1,100 @@
+"""Temporary Claude OAuth stores and a stub provider; never load a real account."""
+
+from __future__ import annotations
+
+import ast
+import io
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import time
+from unittest import mock
+import urllib.request
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "lib"))
+import claude_oauth_refresh  # noqa: E402
+
+
+def file_store_class():
+    """Load the real file store only; never execute limits or access the real pool."""
+    source = (REPO / "bin/claude-accounts").read_text(encoding="utf-8")
+    source = source.split("cmd_limits() {", 1)[1].split("<<'PYEOF'", 1)[1]
+    source = source.split("\n", 1)[1].split("\nPYEOF", 1)[0]
+    nodes = [node for node in ast.parse(source).body
+             if isinstance(node, ast.ClassDef) and node.name == "FileStore"]
+    namespace = {"json": json, "os": os}
+    exec(compile(ast.Module(body=nodes, type_ignores=[]), "limits-test-definitions", "exec"), namespace)
+    return namespace["FileStore"]
+
+
+class AcquireCallbackLock:
+    """Make a competing login finish exactly when our lock is acquired."""
+
+    def __init__(self, callback):
+        self.callback = callback
+        self.compromised = False
+        self.released = False
+
+    def acquire(self):
+        self.callback()
+        return True
+
+    def release(self):
+        self.released = True
+
+
+class OAuthRefreshFixture:
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="multiacc-oauth-refresh-")
+        self.addCleanup(self.temp.cleanup)
+        self.account = Path(self.temp.name) / "acct-test"
+        self.account.mkdir()
+        self.path = self.account / ".credentials.json"
+        self.now = time.time()
+        self.original = {"claudeAiOauth": {
+            "accessToken": "fixture-old-access", "refreshToken": "fixture-old-refresh",
+            "expiresAt": int((self.now - 3600) * 1000),
+            "refreshTokenExpiresAt": int((self.now + 86400) * 1000),
+            "scopes": ["user:inference", "user:profile"]},
+            "mcpOAuth": {"fixture-server": {"accessToken": "fixture-mcp-original"}}}
+        self.write(self.original)
+        self.store = file_store_class()(str(self.path))
+        self.posts = []
+        self.messages = []
+        self.park = mock.Mock()
+        self.on_post = lambda: None
+        self.lock = None
+        self.error = None
+        self.reply = {"access_token": "fixture-new-access", "refresh_token": "fixture-new-refresh",
+                      "expires_in": 3600, "refresh_token_expires_in": 2592000}
+        patcher = mock.patch.object(urllib.request, "urlopen", side_effect=self.provider)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+    def write(self, document):
+        self.path.write_text(json.dumps(document), encoding="utf-8")
+
+    def read(self):
+        return json.loads(self.path.read_text(encoding="utf-8"))
+
+    def provider(self, request, **_kwargs):
+        self.assertEqual(request.full_url, "https://provider.invalid/token")
+        self.posts.append(json.loads(request.data))
+        self.on_post()
+        if self.error is not None:
+            raise self.error
+        return io.BytesIO(json.dumps(self.reply).encode())
+
+    def refresh(self):
+        options = {"now": self.now, "force": True, "token_url": "https://provider.invalid/token",
+                   "client_id": "fixture-client", "say": self.messages.append,
+                   "park_dead_grant": self.park, "clear_expired": lambda *_args: False}
+        if self.lock is not None:
+            patcher = mock.patch.object(claude_oauth_refresh, "RefreshLock", return_value=self.lock)
+            patcher.start()
+            self.addCleanup(patcher.stop)
+        refresher = claude_oauth_refresh.OAuthRefresher(**options)
+        return refresher.refresh("acct-test", str(self.account), self.store)