claude-multiacc 2.0.65 → 2.0.67

package/bin/claude-accounts

@@ -1846,12 +1846,6 @@ TOKEN_URL = os.environ.get('CLAUDE_MULTIACC_TOKEN_URL',
                            'https://console.anthropic.com/v1/oauth/token')
 CLIENT_ID = os.environ.get('CLAUDE_MULTIACC_CLIENT_ID',
                            '9d1c250a-e61b-44d9-88ed-5944d1962f5e')
-# Only refresh a token that has been expired for a while: a LIVE session refreshes
-# its own credential within moments of expiry, so a long-expired one proves no
-# other writer is active (refresh tokens rotate; two racing refreshers strand one).
-REFRESH_MIN_EXPIRED = 300
-REFRESH_FAIL_BACKOFF = 600     # transient (network/5xx/429): retry in 10 min
-REFRESH_DENIED_BACKOFF = 21600  # 4xx = grant likely revoked: 6h; re-login needed anyway
 # A usage fetch the server says will never succeed (x-should-retry: false — e.g. the
 # 403 "does not meet scope requirement user:profile" that a setup token ALWAYS gets)
 # is not a hiccup to retry every pass. Retrying it is what manufactured the 429s that
@@ -2008,39 +2002,12 @@ def park_dead_grant(aid, d, slug, detail):
     say(f'{aid}: {detail} — re-login needed (claude-accounts relogin {aid})')
 
 
-# The client's own write lock: proper-lockfile's DIRECTORY <dir>/.storage-write.lock, stale
-# after 15 s (lib/mcp_oauth.py ClientLock). Claude Code takes it around every write of its
-# credential document, file or Keychain item alike — re-read, one change, the whole
-# document back — and its write FAILS after about 7.5 s of retries on a held lock. So the
-# refresher never holds it across the token POST: a lock held when a refresh would start
-# skips that refresh (nothing has rotated yet; the next pass retries), and the
-# check-and-set and the write take it after the POST, waiting longer, because a rotated
-# grant must land: past the wait (or with no helper) it is written as before, without it.
-try:
-    from mcp_oauth import CLIENT_LOCK, CLIENT_LOCK_STALE_S, ClientLock  # noqa: E402
-except Exception:  # noqa: BLE001 — fail open: refresh exactly as before, unlocked
-    ClientLock = None
-CLIENT_LOCK_PROBE_S = 1.0   # a client's write takes milliseconds: held this long, it is busy
+# Legacy Keychain migration needs only the client's short storage-write lock.
+# Refresh request locking and credential CAS live in claude_oauth_refresh.py.
+from mcp_oauth import ClientLock  # noqa: E402
 CLIENT_LOCK_WAIT_S = 10.0
 
 
-def client_lock_busy(d):
-    """A live writer holds <d>'s client lock, and still does CLIENT_LOCK_PROBE_S later."""
-    if ClientLock is None:
-        return False
-    path = os.path.join(d, CLIENT_LOCK)
-    deadline = time.monotonic() + CLIENT_LOCK_PROBE_S
-    while True:
-        try:
-            if time.time() - os.stat(path).st_mtime > CLIENT_LOCK_STALE_S:
-                return False             # its holder is gone; the write takes it over
-        except OSError:
-            return False                 # no lock: nobody is writing
-        if time.monotonic() >= deadline:
-            return True
-        time.sleep(0.05)
-
-
 class FileStore:
     """The OAuth credential as `.credentials.json`: atomic 0600 writes. The client keeps
     its MCP servers' OAuth state (mcpOAuth, mcpOAuthClientConfig) in this same file, so
@@ -2141,166 +2108,13 @@ def oauth_store(d):
 
 
 def refresh_oauth(aid, d, store):
-    """Refresh a long-expired OAuth access token via the refresh-token grant and
-    persist the ROTATED credential atomically (0600 file, or the Keychain item it
-    came from). Returns the new bearer, or None (fail open: the stored credential
-    is never touched on failure). Failures back off via <dir>/.oauth-refresh.json —
-    a side file, NOT limits.json, because telemetry state must only ever reflect
-    real usage fetches."""
-    spath = os.path.join(d, '.oauth-refresh.json')
-    try:
-        doc = store.read()
-        o = doc.get('claudeAiOauth') if isinstance(doc, dict) else None
-        # Present-but-null/non-object claudeAiOauth (interrupted or reset credential
-        # write) must degrade THIS account only, like every other malformed input; and a
-        # document with no login in it at all (MCP state alone) has nothing to refresh.
-        if not isinstance(o, dict):
-            return None
-    except Exception:
-        return None
-    # NB: no "must have an accessToken" gate. A credential whose access token was
-    # cleared but whose REFRESH token is alive is exactly the shape a grant is supposed
-    # to recover from; requiring the dead half to be present meant such an account could
-    # never come back, and (with a setup token beside it) went dark for telemetry
-    # forever. The expiresAt gate below is what protects a live session's credential.
-    if not o.get('refreshToken'):
-        park_dead_grant(aid, d, 'no-refresh-token',
-                        'credential has no refresh token and its access token expired')
-        return None
-    if o.get('expiresAt', 0) / 1000.0 > now - REFRESH_MIN_EXPIRED:
-        return None  # not expired long enough to prove no live session owns it
-    if o.get('refreshTokenExpiresAt', 0) / 1000.0 <= now:
-        # Nothing can revive this account: park it so the shim stops selecting it
-        # (every run under it would fail with "OAuth session expired").
-        park_dead_grant(aid, d, 'refresh-token-expired',
-                        'the refresh token itself expired; only a re-login can fix it')
-        return None
-    if not force:
-        try:
-            if json.load(open(spath)).get('retry_after', 0) > now:
-                return None  # earlier refresh failure still backing off
-        except Exception:
-            pass
-
-    def back_off(wait, why, denials=0):
-        try:
-            with open(spath + '.tmp', 'w') as f:
-                json.dump({'retry_after': int(now + wait), 'error': why,
-                           'denials': denials,
-                           'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}, f)
-            os.replace(spath + '.tmp', spath)
-        except Exception:
-            pass
-        say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
+    # Import failures skip this account through the caller's guard; never rotate
+    # without the native request lock. The helper owns the full refresh transaction.
+    from claude_oauth_refresh import OAuthRefresher
+    return OAuthRefresher(now=now, force=force, token_url=TOKEN_URL, client_id=CLIENT_ID,
+                          say=say, park_dead_grant=park_dead_grant,
+                          clear_expired=clear_expired).refresh(aid, d, store)
 
-    if client_lock_busy(d):
-        # The client is writing this credential right now (it may be its own refresh of
-        # the same grant): no request is sent, so nothing rotates, and no backoff is noted.
-        say(f'{aid}: oauth refresh skipped — the client holds its credential lock '
-            f'({CLIENT_LOCK}); the next pass retries')
-        return None
-    started_with = o['refreshToken']
-    body = json.dumps({'grant_type': 'refresh_token',
-                       'refresh_token': o['refreshToken'],
-                       'client_id': CLIENT_ID}).encode()
-    req = urllib.request.Request(TOKEN_URL, data=body, headers={
-        'Content-Type': 'application/json',
-        'User-Agent': 'claude-multiacc/1.0',
-    })
-    try:
-        data = json.loads(urllib.request.urlopen(req, timeout=30).read().decode())
-    except urllib.error.HTTPError as e:
-        if e.code in (400, 401, 403):
-            # A 4xx from the TOKEN endpoint is only proof of a dead grant when the
-            # server says so (OAuth's invalid_grant). Everything else 4xx — a bad
-            # client_id, an endpoint change, a WAF page, a provider incident — would
-            # hit EVERY account at once, so it must never park the whole pool on the
-            # first try: back off, and only park after this account has been refused
-            # repeatedly.
-            body = ''
-            try:
-                body = e.read().decode('utf-8', 'replace')[:400]
-            except Exception:
-                pass
-            denials = 1
-            try:
-                denials = int(json.load(open(spath)).get('denials', 0)) + 1
-            except Exception:
-                pass
-            if 'invalid_grant' in body:
-                park_dead_grant(aid, d, f'refresh-denied-http-{e.code}',
-                                'the refresh grant was refused as invalid_grant (revoked or rotated away)')
-            elif denials >= 3:
-                park_dead_grant(aid, d, f'refresh-denied-http-{e.code}',
-                                f'the refresh grant was refused {denials} times in a row')
-            back_off(REFRESH_DENIED_BACKOFF,
-                     f'HTTP {e.code} — refresh token may be revoked; re-login needed',
-                     denials=denials)
-        else:
-            back_off(REFRESH_FAIL_BACKOFF, f'HTTP {e.code}')
-        return None
-    except Exception as e:
-        back_off(REFRESH_FAIL_BACKOFF, str(e)[:200])
-        return None
-    tok = data.get('access_token') if isinstance(data, dict) else None
-    if not tok:
-        back_off(REFRESH_DENIED_BACKOFF, 'no access_token in response')
-        return None
-    o['accessToken'] = tok
-    # The grant ROTATES the refresh token: persist it (and both expiries) or the
-    # account is stranded — hence atomic write, and a loud message if it fails.
-    if data.get('refresh_token'):
-        o['refreshToken'] = data['refresh_token']
-    if data.get('expires_in'):
-        o['expiresAt'] = int((now + float(data['expires_in'])) * 1000)
-    else:
-        # No expires_in in the response: assume a conservative 1h. Leaving the old
-        # (past) expiresAt would make every later pass re-run the grant in a loop.
-        o['expiresAt'] = int((now + 3600) * 1000)
-    if data.get('refresh_token_expires_in'):
-        o['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
-    # CHECK-AND-SET. The grant rotates, and a live claude session refreshes the same
-    # file. REFRESH_MIN_EXPIRED makes that unlikely, not impossible — and losing the
-    # race by overwriting means the session's newer credential is destroyed. If the
-    # on-disk refresh token is no longer the one this grant was issued against, the
-    # other writer won: keep its result, discard ours. Both under the client's own lock,
-    # so no client write lands between the check and the write.
-    lock = ClientLock(d, CLIENT_LOCK_WAIT_S) if ClientLock is not None else None
-    try:
-        held = lock is not None and lock.acquire()
-    except Exception:  # noqa: BLE001 — the rotated grant lands either way
-        held = False
-    if lock is not None and not held and os.path.isdir(lock.path):
-        say(f'{aid}: the client kept its credential lock ({CLIENT_LOCK}) past '
-            f'{int(CLIENT_LOCK_WAIT_S)}s — writing the rotated login without it')
-    try:
-        try:
-            disk = store.read().get('claudeAiOauth', {})
-            if isinstance(disk, dict) and disk.get('refreshToken') != started_with:
-                say(f'{aid}: credential was refreshed by something else mid-flight — '
-                    f'keeping the newer one in the {store.kind}')
-                return None
-        except Exception:
-            pass
-        try:
-            # Only the login is ours: both stores write it INTO the document as it is now,
-            # so the MCP state the client saved meanwhile (mcpOAuth) is never rolled back.
-            store.write({'claudeAiOauth': o})
-        except Exception as e:
-            say(f'{aid}: token refreshed but credentials NOT persisted ({e}) — re-login may be needed')
-            return None
-    finally:
-        if held:
-            lock.release()
-    try:
-        os.remove(spath)
-    except OSError:
-        pass
-    # The grant answered: whatever parked this account before, it authenticates now.
-    if clear_expired(d):
-        say(f'{aid}: dead-auth marker cleared (refresh grant works again)')
-    say(f'{aid}: oauth access token refreshed via refresh-token grant')
-    return tok
 
 for acct in manifest.get('accounts', []):
     aid = acct['id']
@@ -2400,8 +2214,8 @@ for acct in manifest.get('accounts', []):
             bearer, source = tok, 'oauth'
     # A setup token is a LAST RESORT and only for an account that has no OAuth
     # credential at all. Where one exists but could not be used this pass — its
-    # access token expired moments ago (refresh_oauth waits REFRESH_MIN_EXPIRED to
-    # prove no live session owns it), a refresh backoff, or a Keychain this session
+    # access token expired moments ago (refresh_oauth gives the native
+    # client a five-minute grace period), a refresh backoff, or a Keychain this session
     # cannot open — spending the token is guaranteed to earn a 403 it can never not
     # earn, and that 403 used to park the whole ACCOUNT for six hours. Telemetry then
     # froze for an account whose OAuth would have worked on the very next pass, and

package/docs/INSTALLATION.md

@@ -56,9 +56,10 @@ version is on npm.
 (Note: newer npm versions gate install scripts; if postinstall is blocked, just run
 `claude-multiacc install` once.)
 
-New versions publish to npm automatically from `main` via GitHub Actions
-(`.github/workflows/publish.yml`, OIDC Trusted Publishing — no long-lived token after the
-first bootstrap publish; `scripts/auto-version.mjs` bumps the patch above the last release).
+New versions publish to npm automatically from `main` via GitHub Actions using OIDC
+Trusted Publishing. Prepare the version with `scripts/auto-version.mjs` before
+committing, then complete the [local release validation](RELEASING.md). The workflow
+verifies that evidence and publishes the exact validated version and package bytes.
 
 ### From a git checkout
 

package/docs/RELEASING.md

@@ -0,0 +1,75 @@
+# Releasing within two minutes of GitHub Actions starting
+
+Every release runs the full validation locally before GitHub Actions. The workflow
+then verifies authenticated evidence, repacks and compares the exact package, runs
+short hosted compatibility checks, publishes through npm OIDC, confirms registry
+integrity, and tags the same source. Measure the complete successful Actions run
+from its creation through completion, including setup and publication: the budget
+is 120 seconds. A timeout alone does not establish compliance.
+
+The full local checks still take minutes. They have not been removed, weakened or
+replaced by a smoke test. `scripts/release_validation.py` defines their canonical
+roster: the complete shell suite, selector, piped Codex retries, Keychain, shell PATH
+probe, Claude OAuth refresh coordination, autoresume, account seeding/settings/MCP,
+packed commands, and release policy tests. Seeding runs in a private Linux PID namespace; tmux and zsh must be present.
+
+## Prepare and validate an immutable candidate
+
+1. Resolve the next npm version before the final candidate commit:
+   `node scripts/auto-version.mjs .`. Commit all source, tests, release scripts and
+   documentation. Validation requires a clean checkout, including untracked files.
+2. Run `scripts/validate-release.sh --receipt /absolute/path/outside/repo/receipt.json`.
+   The helper prepares a Linux environment, runs with a private process namespace
+   and HOME, disables networking during tests, and mounts the candidate read-only.
+   npm 12.2.1 is used locally and in Actions so the packed bytes match.
+3. Keep the receipt, complete command logs and packed artifact together outside the
+   checkout. Any failing command or source change prevents successful attestation.
+4. Push that exact candidate and authenticate the result:
+
+   ```bash
+   python3 scripts/release_validation.py publish --repository gowalk-public/claude-multiacc --receipt /absolute/path/outside/repo/receipt.json
+   ```
+
+5. Mark the draft PR ready after publishing the statuses, or rerun its workflow if
+   it was already ready. Same-repository ready PRs verify the exact head and run the
+   short hosted checks; they cannot publish a package. Draft and fork PRs skip this job.
+6. Merge only when the branch tree is exactly the tested tree. If main changed such
+   that the merge would change it, update the branch and repeat validation. A squash
+   merge may change the commit ID; its tree must still equal the validated PR head.
+
+The repository variable `LOCAL_RELEASE_VALIDATION_ACTOR` names the trusted GitHub
+account allowed to attest local execution. GitHub authenticates that actor, not the
+local machine; this does not claim hardware or machine attestation. A checked-in
+JSON file alone never admits a release. Raw local receipts remain available for
+review and bind each command's exact arguments, return code and log digest.
+
+The latest `local-release-validation` status binds the Git tree and complete suite
+policy. The latest `local-release-artifact` status binds version and tarball SHA-256.
+Both must be successful, created by the trusted actor, and less than 24 hours old.
+A newer failed, pending or unauthorized status blocks an older success. Changes to
+source bytes, modes, symlink targets, policy, version or package bytes require fresh
+evidence. No CI version bump is permitted after validation.
+
+## Publication and confirmation
+
+The workflow retains real hosted PATH-probe and atomic-lock checks because hosted
+shell integration and core utilities can differ from a local Linux image. It runs
+the release-policy rejection tests as well. These short checks supplement the full
+local proof.
+
+After publishing, require both a green workflow and matching npm integrity/version
+and Git tag. Record the measured run duration. Queue or registry outages can prevent
+a release; they must never cause stale proof to be accepted or required checks to
+be skipped. The workflow refuses to start publication when it has already consumed
+the time reserved for publication and tagging.
+
+npm can accept a package and keep it unavailable while processing it. That is
+reported as pending registry confirmation, never as a completed deployment. A rerun
+checks the exact existing version's integrity, skips republishing matching bytes,
+and completes the matching tag. Conflicting bytes or an existing tag for another
+commit stop before any new publication. Registry confirmation uses the remaining
+run budget while reserving time for tagging and Actions cleanup; it never extends
+the 120-second budget. Recovery uses the new attempt's start time;
+reports retain the original run creation time so waiting does not disappear from
+the end-to-end record. Registry processing time is external to Actions and must be
+reported separately if it prevents the requested complete deployment budget.

package/lib/claude_oauth_lock.py

@@ -0,0 +1,172 @@
+"""Serialize OAuth token POSTs with Claude Code's native refresh locks.
+
+Claude Code 2.1.310 Gnr/Vri use proper-lockfile directories: first
+<config>/.oauth_refresh.lock, then <realpath(config)>.lock, with a 60-second
+stale deadline and five-second mtime renewal. Ec changes callback scheduling,
+not that on-disk protocol. The optional native owner sidecar only accelerates
+proven-dead-holder recovery; without one, native clients retain the stale gate.
+
+Hold this lock across credential reread, token exchange and rotated-token save.
+The separate .storage-write.lock protects only short credential transactions.
+"""
+from __future__ import annotations
+
+import os
+import stat
+import threading
+import time
+from pathlib import Path
+
+STALE_SECONDS = 60.0
+UPDATE_SECONDS = 5.0
+RETRY_SECONDS = 0.05
+
+
+def _snapshot(path: Path) -> tuple[int, int, int] | None:
+    try:
+        value = path.lstat()
+        if stat.S_ISDIR(value.st_mode):
+            return value.st_dev, value.st_ino, value.st_mtime_ns
+    except OSError:
+        pass
+    return None
+
+
+class RefreshLock:
+    """Bounded, fail-closed lock; call release even after an exchange fails."""
+
+    def __init__(self, directory: str | Path, timeout: float = 1.0):
+        directory = Path(directory).absolute()
+        self.paths = (directory / ".oauth_refresh.lock", Path(str(directory.resolve()) + ".lock"))
+        self.timeout = max(0.0, timeout)
+        self._held: list[tuple[Path, int, tuple[int, int, int]]] = []
+        self._mutex = threading.Lock()
+        self._stop = threading.Event()
+        self._thread: threading.Thread | None = None
+        self._compromised = False
+
+    def acquire(self) -> bool:
+        deadline = time.monotonic() + self.timeout
+        with self._mutex:
+            if self._held:
+                return not self._compromised and all(
+                    _snapshot(path) == stamp and time.time_ns() - stamp[2] < STALE_SECONDS * 1e9
+                    for path, _, stamp in self._held)
+            self._compromised = False
+            self._stop.clear()
+            while True:
+                for path in self.paths:
+                    entry = self._claim(path)
+                    if entry is None:
+                        break
+                    self._held.append(entry)
+                if len(self._held) == len(self.paths):
+                    self._thread = threading.Thread(target=self._heartbeat, daemon=True)
+                    try:
+                        self._thread.start()
+                    except RuntimeError:
+                        self._release_paths()
+                        self._thread = None
+                        return False
+                    return True
+                self._release_paths()
+                remaining = deadline - time.monotonic()
+                if remaining <= 0:
+                    return False
+                time.sleep(min(RETRY_SECONDS, remaining))
+
+    def _claim(self, path: Path) -> tuple[Path, int, tuple[int, int, int]] | None:
+        try:
+            path.mkdir(mode=0o700)
+        except FileExistsError:
+            before = _snapshot(path)
+            if before is None or time.time_ns() - before[2] <= STALE_SECONDS * 1e9:
+                return None
+            try:
+                if _snapshot(path) != before:
+                    return None
+                path.rmdir()
+                path.mkdir(mode=0o700)
+            except OSError:
+                return None
+        except OSError:
+            return None
+        before = _snapshot(path)
+        descriptor = None
+        claimed = False
+        try:
+            descriptor = os.open(path, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+            value = os.fstat(descriptor)
+            if before is None or (value.st_dev, value.st_ino, value.st_mtime_ns) != before:
+                return None
+            now = time.time_ns()
+            os.utime(descriptor, ns=(now, now))
+            value = os.fstat(descriptor)
+            stamp = value.st_dev, value.st_ino, value.st_mtime_ns
+            before = stamp
+            if _snapshot(path) != stamp:
+                return None
+            claimed = True
+            result, descriptor = (path, descriptor, stamp), None
+            return result
+        except OSError:
+            return None
+        finally:
+            if descriptor is not None:
+                os.close(descriptor)
+            if not claimed and before is not None and _snapshot(path) == before:
+                try:
+                    path.rmdir()
+                except OSError:
+                    pass
+
+    def _renew(self) -> bool:
+        for index, (path, descriptor, stamp) in enumerate(self._held):
+            if _snapshot(path) != stamp or time.time_ns() - stamp[2] >= STALE_SECONDS * 1e9:
+                return False
+            try:
+                now = time.time_ns()
+                os.utime(descriptor, ns=(now, now))
+                value = os.fstat(descriptor)
+                updated = value.st_dev, value.st_ino, value.st_mtime_ns
+                if _snapshot(path) != updated:
+                    return False
+                self._held[index] = path, descriptor, updated
+            except OSError:
+                return False
+        return True
+
+    def _heartbeat(self) -> None:
+        while not self._stop.wait(UPDATE_SECONDS):
+            with self._mutex:
+                if not self._renew():
+                    self._compromised = True
+                    return
+
+    def _release_paths(self) -> None:
+        for path, descriptor, stamp in reversed(self._held):
+            try:
+                if _snapshot(path) == stamp:
+                    path.rmdir()
+            except OSError:
+                pass
+            finally:
+                os.close(descriptor)
+        self._held.clear()
+
+    def release(self) -> None:
+        self._stop.set()
+        thread = self._thread
+        if thread is not None:
+            thread.join(timeout=1.0)
+        with self._mutex:
+            self._release_paths()
+            self._thread = None
+
+    @property
+    def compromised(self) -> bool:
+        with self._mutex:
+            if any(_snapshot(path) != stamp or time.time_ns() - stamp[2] >= STALE_SECONDS * 1e9
+                   for path, _, stamp in self._held):
+                self._compromised = True
+            return self._compromised