codex-multi-auth 0.1.8 → 1.1.10

package/dist/lib/storage.js

@@ -713,107 +713,224 @@ function selectNewestAccount(current, candidate) {
     const candidateAddedAt = candidate.addedAt || 0;
     return candidateAddedAt >= currentAddedAt ? candidate : current;
 }
-function deduplicateAccountsByKey(accounts) {
-    const keyToIndex = new Map();
-    const indicesToKeep = new Set();
+function normalizeAccountIdKey(accountId) {
+    if (!accountId)
+        return undefined;
+    const trimmed = accountId.trim();
+    return trimmed || undefined;
+}
+/**
+ * Normalize email keys for case-insensitive account identity matching.
+ */
+export function normalizeEmailKey(email) {
+    if (!email)
+        return undefined;
+    const trimmed = email.trim();
+    if (!trimmed)
+        return undefined;
+    return trimmed.toLowerCase();
+}
+function normalizeRefreshTokenKey(refreshToken) {
+    if (!refreshToken)
+        return undefined;
+    const trimmed = refreshToken.trim();
+    return trimmed || undefined;
+}
+function toAccountIdentityRef(account) {
+    return {
+        accountId: normalizeAccountIdKey(account?.accountId),
+        emailKey: normalizeEmailKey(account?.email),
+        refreshToken: normalizeRefreshTokenKey(account?.refreshToken),
+    };
+}
+function collectDistinctIdentityValues(values) {
+    const distinct = new Set();
+    for (const value of values) {
+        if (value)
+            distinct.add(value);
+    }
+    return distinct;
+}
+export function getAccountIdentityKey(account) {
+    const ref = toAccountIdentityRef(account);
+    if (ref.accountId && ref.emailKey) {
+        return `account:${ref.accountId}::email:${ref.emailKey}`;
+    }
+    if (ref.accountId)
+        return `account:${ref.accountId}`;
+    if (ref.emailKey)
+        return `email:${ref.emailKey}`;
+    if (ref.refreshToken)
+        return `refresh:${ref.refreshToken}`;
+    return undefined;
+}
+function findNewestMatchingIndex(accounts, predicate) {
+    let matchIndex;
+    let match;
     for (let i = 0; i < accounts.length; i += 1) {
         const account = accounts[i];
         if (!account)
             continue;
-        const key = account.accountId || account.refreshToken;
-        if (!key)
+        const ref = toAccountIdentityRef(account);
+        if (!predicate(ref))
             continue;
-        const existingIndex = keyToIndex.get(key);
-        if (existingIndex === undefined) {
-            keyToIndex.set(key, i);
+        if (matchIndex === undefined) {
+            matchIndex = i;
+            match = account;
             continue;
         }
-        const existing = accounts[existingIndex];
-        const newest = selectNewestAccount(existing, account);
-        keyToIndex.set(key, newest === account ? i : existingIndex);
-    }
-    for (const idx of keyToIndex.values()) {
-        indicesToKeep.add(idx);
-    }
-    const result = [];
-    for (let i = 0; i < accounts.length; i += 1) {
-        if (indicesToKeep.has(i)) {
-            const account = accounts[i];
-            if (account)
-                result.push(account);
+        const newest = selectNewestAccount(match, account);
+        if (newest === account) {
+            matchIndex = i;
+            match = account;
         }
     }
-    return result;
+    return matchIndex;
 }
-/**
- * Removes duplicate accounts, keeping the most recently used entry for each unique key.
- * Deduplication is based on accountId or refreshToken.
- * @param accounts - Array of accounts to deduplicate
- * @returns New array with duplicates removed
- */
-export function deduplicateAccounts(accounts) {
-    return deduplicateAccountsByKey(accounts);
+function findCompositeAccountMatchIndex(accounts, candidateRef) {
+    if (!candidateRef.accountId || !candidateRef.emailKey)
+        return undefined;
+    return findNewestMatchingIndex(accounts, (ref) => ref.accountId === candidateRef.accountId &&
+        ref.emailKey === candidateRef.emailKey);
 }
-/**
- * Removes duplicate accounts by email, keeping the most recently used entry.
- * Accounts without email are always preserved.
- * @param accounts - Array of accounts to deduplicate
- * @returns New array with email duplicates removed
- */
-export function normalizeEmailKey(email) {
-    if (!email)
+function findSafeEmailMatchIndex(accounts, candidateRef) {
+    if (!candidateRef.emailKey)
         return undefined;
-    const trimmed = email.trim();
-    if (!trimmed)
+    const emailAccountIds = [candidateRef.accountId];
+    let foundAny = false;
+    for (let i = 0; i < accounts.length; i += 1) {
+        const account = accounts[i];
+        if (!account)
+            continue;
+        const ref = toAccountIdentityRef(account);
+        if (ref.emailKey !== candidateRef.emailKey)
+            continue;
+        foundAny = true;
+        emailAccountIds.push(ref.accountId);
+    }
+    if (!foundAny)
         return undefined;
-    return trimmed.toLowerCase();
+    if (collectDistinctIdentityValues(emailAccountIds).size > 1) {
+        return undefined;
+    }
+    return findNewestMatchingIndex(accounts, (ref) => ref.emailKey === candidateRef.emailKey);
 }
-export function deduplicateAccountsByEmail(accounts) {
-    const emailToNewestIndex = new Map();
-    const indicesToKeep = new Set();
+function findCompatibleRefreshTokenMatchIndex(accounts, candidateRef) {
+    if (!candidateRef.refreshToken)
+        return undefined;
+    let matchingIndex;
+    let matchingAccount = null;
     for (let i = 0; i < accounts.length; i += 1) {
         const account = accounts[i];
         if (!account)
             continue;
-        const email = normalizeEmailKey(account.email);
-        if (!email) {
-            indicesToKeep.add(i);
-            continue;
-        }
-        const existingIndex = emailToNewestIndex.get(email);
-        if (existingIndex === undefined) {
-            emailToNewestIndex.set(email, i);
+        const ref = toAccountIdentityRef(account);
+        if (ref.refreshToken !== candidateRef.refreshToken)
             continue;
-        }
-        const existing = accounts[existingIndex];
-        // istanbul ignore next -- defensive code: existingIndex always refers to valid account
-        if (!existing) {
-            emailToNewestIndex.set(email, i);
+        if ((candidateRef.accountId &&
+            ref.accountId &&
+            ref.accountId !== candidateRef.accountId) ||
+            (candidateRef.emailKey &&
+                ref.emailKey &&
+                ref.emailKey !== candidateRef.emailKey)) {
+            return undefined;
+        }
+        if (matchingIndex !== undefined &&
+            !candidateRef.accountId &&
+            !candidateRef.emailKey) {
+            return undefined;
+        }
+        if (matchingIndex === undefined || matchingAccount === null) {
+            matchingIndex = i;
+            matchingAccount = account;
             continue;
         }
-        const existingLastUsed = existing.lastUsed || 0;
-        const candidateLastUsed = account.lastUsed || 0;
-        const existingAddedAt = existing.addedAt || 0;
-        const candidateAddedAt = account.addedAt || 0;
-        const isNewer = candidateLastUsed > existingLastUsed ||
-            (candidateLastUsed === existingLastUsed &&
-                candidateAddedAt > existingAddedAt);
-        if (isNewer) {
-            emailToNewestIndex.set(email, i);
+        const newest = selectNewestAccount(matchingAccount ?? undefined, account);
+        if (newest === account) {
+            matchingIndex = i;
+            matchingAccount = account;
         }
     }
-    for (const idx of emailToNewestIndex.values()) {
-        indicesToKeep.add(idx);
+    return matchingIndex;
+}
+function findUniqueAccountIdMatchIndex(accounts, candidateRef, options) {
+    if (!candidateRef.accountId)
+        return undefined;
+    if (!candidateRef.emailKey &&
+        !options.allowUniqueAccountIdFallbackWithoutEmail) {
+        return undefined;
     }
-    const result = [];
+    let matchingIndex;
+    let matchingEmailKey;
     for (let i = 0; i < accounts.length; i += 1) {
-        if (indicesToKeep.has(i)) {
-            const account = accounts[i];
-            if (account)
-                result.push(account);
+        const account = accounts[i];
+        if (!account)
+            continue;
+        const ref = toAccountIdentityRef(account);
+        if (ref.accountId !== candidateRef.accountId)
+            continue;
+        if (matchingIndex !== undefined) {
+            return undefined;
+        }
+        matchingIndex = i;
+        matchingEmailKey = ref.emailKey;
+    }
+    if (matchingIndex !== undefined &&
+        matchingEmailKey &&
+        candidateRef.emailKey &&
+        matchingEmailKey !== candidateRef.emailKey) {
+        return undefined;
+    }
+    return matchingIndex;
+}
+export function findMatchingAccountIndex(accounts, candidate, options = {}) {
+    const candidateRef = toAccountIdentityRef(candidate);
+    const byComposite = findCompositeAccountMatchIndex(accounts, candidateRef);
+    if (byComposite !== undefined)
+        return byComposite;
+    const byEmail = findSafeEmailMatchIndex(accounts, candidateRef);
+    if (byEmail !== undefined)
+        return byEmail;
+    if (candidateRef.refreshToken) {
+        const byRefresh = findCompatibleRefreshTokenMatchIndex(accounts, candidateRef);
+        if (byRefresh !== undefined)
+            return byRefresh;
+    }
+    return findUniqueAccountIdMatchIndex(accounts, candidateRef, options);
+}
+export function resolveAccountSelectionIndex(accounts, candidate, fallbackIndex = 0) {
+    if (accounts.length === 0)
+        return 0;
+    const matchedIndex = findMatchingAccountIndex(accounts, candidate, {
+        allowUniqueAccountIdFallbackWithoutEmail: true,
+    });
+    if (matchedIndex !== undefined)
+        return matchedIndex;
+    return clampIndex(fallbackIndex, accounts.length);
+}
+function deduplicateAccountsByIdentity(accounts) {
+    const deduplicated = [];
+    for (const account of accounts) {
+        if (!account)
+            continue;
+        const existingIndex = findMatchingAccountIndex(deduplicated, account);
+        if (existingIndex === undefined) {
+            deduplicated.push(account);
+            continue;
         }
+        deduplicated[existingIndex] = selectNewestAccount(deduplicated[existingIndex], account);
     }
-    return result;
+    return deduplicated;
+}
+/**
+ * Removes duplicate accounts, keeping the most recently used entry for each
+ * safely matched identity.
+ */
+export function deduplicateAccounts(accounts) {
+    return deduplicateAccountsByIdentity(accounts);
+}
+export function deduplicateAccountsByEmail(accounts) {
+    return deduplicateAccountsByIdentity(accounts);
 }
 function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
@@ -823,20 +940,17 @@ function clampIndex(index, length) {
         return 0;
     return Math.max(0, Math.min(index, length - 1));
 }
-function toAccountKey(account) {
-    return account.accountId || account.refreshToken;
-}
-function extractActiveKey(accounts, activeIndex) {
+function extractActiveAccountRef(accounts, activeIndex) {
     const candidate = accounts[activeIndex];
     if (!isRecord(candidate))
-        return undefined;
-    const accountId = typeof candidate.accountId === "string" && candidate.accountId.trim()
-        ? candidate.accountId
-        : undefined;
-    const refreshToken = typeof candidate.refreshToken === "string" && candidate.refreshToken.trim()
-        ? candidate.refreshToken
-        : undefined;
-    return accountId || refreshToken;
+        return {};
+    return toAccountIdentityRef({
+        accountId: typeof candidate.accountId === "string" ? candidate.accountId : undefined,
+        email: typeof candidate.email === "string" ? candidate.email : undefined,
+        refreshToken: typeof candidate.refreshToken === "string"
+            ? candidate.refreshToken
+            : undefined,
+    });
 }
 /**
  * Normalizes and validates account storage data, migrating from v1 to v3 if needed.
@@ -864,7 +978,7 @@ export function normalizeAccountStorage(data) {
         ? data.activeIndex
         : 0;
     const rawActiveIndex = clampIndex(activeIndexValue, rawAccounts.length);
-    const activeKey = extractActiveKey(rawAccounts, rawActiveIndex);
+    const activeRef = extractActiveAccountRef(rawAccounts, rawActiveIndex);
     const fromVersion = data.version;
     const baseStorage = fromVersion === 1
         ? migrateV1ToV3(data)
@@ -872,16 +986,15 @@ export function normalizeAccountStorage(data) {
     const validAccounts = rawAccounts.filter((account) => isRecord(account) &&
         typeof account.refreshToken === "string" &&
         !!account.refreshToken.trim());
-    const deduplicatedAccounts = deduplicateAccountsByEmail(deduplicateAccountsByKey(validAccounts));
+    const deduplicatedAccounts = deduplicateAccounts(validAccounts);
     const activeIndex = (() => {
         if (deduplicatedAccounts.length === 0)
             return 0;
-        if (activeKey) {
-            const mappedIndex = deduplicatedAccounts.findIndex((account) => toAccountKey(account) === activeKey);
-            if (mappedIndex >= 0)
-                return mappedIndex;
-        }
-        return clampIndex(rawActiveIndex, deduplicatedAccounts.length);
+        return resolveAccountSelectionIndex(deduplicatedAccounts, {
+            accountId: activeRef.accountId,
+            email: activeRef.emailKey,
+            refreshToken: activeRef.refreshToken,
+        }, rawActiveIndex);
     })();
     const activeIndexByFamily = {};
     const rawFamilyIndices = isRecord(baseStorage.activeIndexByFamily)
@@ -893,15 +1006,12 @@ export function normalizeAccountStorage(data) {
             ? rawIndexValue
             : rawActiveIndex;
         const clampedRawIndex = clampIndex(rawIndex, rawAccounts.length);
-        const familyKey = extractActiveKey(rawAccounts, clampedRawIndex);
-        let mappedIndex = clampIndex(rawIndex, deduplicatedAccounts.length);
-        if (familyKey && deduplicatedAccounts.length > 0) {
-            const idx = deduplicatedAccounts.findIndex((account) => toAccountKey(account) === familyKey);
-            if (idx >= 0) {
-                mappedIndex = idx;
-            }
-        }
-        activeIndexByFamily[family] = mappedIndex;
+        const familyRef = extractActiveAccountRef(rawAccounts, clampedRawIndex);
+        activeIndexByFamily[family] = resolveAccountSelectionIndex(deduplicatedAccounts, {
+            accountId: familyRef.accountId,
+            email: familyRef.emailKey,
+            refreshToken: familyRef.refreshToken,
+        }, rawIndex);
     }
     return {
         version: 3,
@@ -1314,6 +1424,17 @@ async function saveAccountsUnlocked(storage) {
         throw new StorageError(`Failed to save accounts: ${err?.message || "Unknown error"}`, code, path, hint, err instanceof Error ? err : undefined);
     }
 }
+function cloneAccountStorageForPersistence(storage) {
+    return {
+        version: 3,
+        accounts: structuredClone(storage?.accounts ?? []),
+        activeIndex: typeof storage?.activeIndex === "number" &&
+            Number.isFinite(storage.activeIndex)
+            ? storage.activeIndex
+            : 0,
+        activeIndexByFamily: structuredClone(storage?.activeIndexByFamily ?? {}),
+    };
+}
 export async function withAccountStorageTransaction(handler) {
     return withStorageLock(async () => {
         const state = {
@@ -1328,6 +1449,40 @@ export async function withAccountStorageTransaction(handler) {
         return transactionSnapshotContext.run(state, () => handler(current, persist));
     });
 }
+export async function withAccountAndFlaggedStorageTransaction(handler) {
+    return withStorageLock(async () => {
+        const state = {
+            snapshot: await loadAccountsInternal(saveAccountsUnlocked),
+            active: true,
+        };
+        const current = state.snapshot;
+        const persist = async (accountStorage, flaggedStorage) => {
+            const previousAccounts = cloneAccountStorageForPersistence(state.snapshot);
+            const nextAccounts = cloneAccountStorageForPersistence(accountStorage);
+            await saveAccountsUnlocked(nextAccounts);
+            try {
+                await saveFlaggedAccountsUnlocked(flaggedStorage);
+                state.snapshot = nextAccounts;
+            }
+            catch (error) {
+                try {
+                    await saveAccountsUnlocked(previousAccounts);
+                    state.snapshot = previousAccounts;
+                }
+                catch (rollbackError) {
+                    const combinedError = new AggregateError([error, rollbackError], "Flagged save failed and account storage rollback also failed");
+                    log.error("Failed to rollback account storage after flagged save failure", {
+                        error: String(error),
+                        rollbackError: String(rollbackError),
+                    });
+                    throw combinedError;
+                }
+                throw error;
+            }
+        };
+        return transactionSnapshotContext.run(state, () => handler(current, persist));
+    });
+}
 /**
  * Persists account storage to disk using atomic write (temp file + rename).
  * Creates the Codex multi-auth storage directory if it doesn't exist.
@@ -1397,7 +1552,10 @@ function normalizeFlaggedStorage(data) {
             value === "id_token" ||
             value === "org" ||
             value === "manual";
-        const isSwitchReason = (value) => value === "rate-limit" || value === "initial" || value === "rotation";
+        const isSwitchReason = (value) => value === "rate-limit" ||
+            value === "initial" ||
+            value === "rotation" ||
+            value === "best";
         const isCooldownReason = (value) => value === "auth-failure" ||
             value === "network-error" ||
             value === "rate-limit";
@@ -1516,48 +1674,53 @@ export async function loadFlaggedAccounts() {
         return empty;
     }
 }
-export async function saveFlaggedAccounts(storage) {
-    return withStorageLock(async () => {
-        const path = getFlaggedAccountsPath();
-        const markerPath = getIntentionalResetMarkerPath(path);
-        const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
-        const tempPath = `${path}.${uniqueSuffix}.tmp`;
-        try {
-            await fs.mkdir(dirname(path), { recursive: true });
-            if (existsSync(path)) {
-                try {
-                    await fs.copyFile(path, `${path}.bak`);
-                }
-                catch (backupError) {
-                    log.warn("Failed to create flagged backup snapshot", {
-                        path,
-                        error: String(backupError),
-                    });
-                }
-            }
-            const content = JSON.stringify(normalizeFlaggedStorage(storage), null, 2);
-            await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
-            await fs.rename(tempPath, path);
+async function saveFlaggedAccountsUnlocked(storage) {
+    const path = getFlaggedAccountsPath();
+    const markerPath = getIntentionalResetMarkerPath(path);
+    const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+    const tempPath = `${path}.${uniqueSuffix}.tmp`;
+    try {
+        await fs.mkdir(dirname(path), { recursive: true });
+        if (existsSync(path)) {
             try {
-                await fs.unlink(markerPath);
+                await copyFileWithRetry(path, `${path}.bak`, {
+                    allowMissingSource: true,
+                });
             }
-            catch {
-                // Best effort cleanup.
+            catch (backupError) {
+                log.warn("Failed to create flagged backup snapshot", {
+                    path,
+                    error: String(backupError),
+                });
             }
         }
-        catch (error) {
-            try {
-                await fs.unlink(tempPath);
-            }
-            catch {
-                // Ignore cleanup failures.
-            }
-            log.error("Failed to save flagged account storage", {
-                path,
-                error: String(error),
-            });
-            throw error;
+        const content = JSON.stringify(normalizeFlaggedStorage(storage), null, 2);
+        await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
+        await renameFileWithRetry(tempPath, path);
+        try {
+            await fs.unlink(markerPath);
+        }
+        catch {
+            // Best effort cleanup.
+        }
+    }
+    catch (error) {
+        try {
+            await fs.unlink(tempPath);
         }
+        catch {
+            // Ignore cleanup failures.
+        }
+        log.error("Failed to save flagged account storage", {
+            path,
+            error: String(error),
+        });
+        throw error;
+    }
+}
+export async function saveFlaggedAccounts(storage) {
+    return withStorageLock(async () => {
+        await saveFlaggedAccountsUnlocked(storage);
     });
 }
 export async function clearFlaggedAccounts() {
@@ -1635,7 +1798,7 @@ export async function exportAccounts(filePath, force = true, beforeCommit) {
 }
 /**
  * Imports accounts from a JSON file, merging with existing accounts.
- * Deduplicates by accountId/email, preserving most recently used entries.
+ * Deduplicates by safe account identity, preserving most recently used entries.
  * @param filePath - Source file path
  * @throws Error if file is invalid or would exceed MAX_ACCOUNTS
  */
@@ -1662,12 +1825,12 @@ export async function importAccounts(filePath) {
         const existingActiveIndex = existing?.activeIndex ?? 0;
         const merged = [...existingAccounts, ...normalized.accounts];
         if (merged.length > ACCOUNT_LIMITS.MAX_ACCOUNTS) {
-            const deduped = deduplicateAccountsByEmail(deduplicateAccounts(merged));
+            const deduped = deduplicateAccounts(merged);
             if (deduped.length > ACCOUNT_LIMITS.MAX_ACCOUNTS) {
                 throw new Error(`Import would exceed maximum of ${ACCOUNT_LIMITS.MAX_ACCOUNTS} accounts (would have ${deduped.length})`);
             }
         }
-        const deduplicatedAccounts = deduplicateAccountsByEmail(deduplicateAccounts(merged));
+        const deduplicatedAccounts = deduplicateAccounts(merged);
         const newStorage = {
             version: 3,
             accounts: deduplicatedAccounts,