codex-multi-auth 2.12.0 → 2.13.0

package/dist/lib/storage.js

@@ -898,7 +898,8 @@ export function normalizeAccountStorage(data) {
             return undefined;
         if (typeof raw !== "number" ||
             !Number.isFinite(raw) ||
-            !Number.isInteger(raw) ||
+            // See readAffinityGenerationFromDisk: an unsafe integer wedges the bump.
+            !Number.isSafeInteger(raw) ||
             raw < 0) {
             log.warn("Dropping invalid affinityGeneration from storage", {
                 value: raw,
@@ -941,7 +942,11 @@ export function readAffinityGenerationFromDisk(path) {
         const generation = parsed.affinityGeneration;
         if (typeof generation === "number" &&
             Number.isFinite(generation) &&
-            Number.isInteger(generation) &&
+            // Safe, not merely integral: past 2^53 `Math.max(gen, disk) + 1 === gen`,
+            // so `bumpStorageAffinityGeneration` silently stops advancing and no
+            // running proxy ever observes another `switch`. Rejecting the value
+            // lets the next bump write 1 and repair the file.
+            Number.isSafeInteger(generation) &&
             generation >= 0) {
             return generation;
         }
@@ -978,7 +983,12 @@ export function bumpStorageAffinityGeneration(storage, storagePath) {
         // No resolvable storage path (never configured). The in-memory counter
         // is still bumped below; only the lost-update guard is unavailable.
     }
-    const inMemoryGeneration = storage.affinityGeneration ?? 0;
+    // Guard the in-memory side too, not just the disk read. Past 2^53
+    // `Math.max(gen, disk) + 1 === gen`, so an unsafe value here would write the
+    // same generation forever and no running proxy would observe another
+    // `switch`. Treating it as 0 makes the next write repair the counter.
+    const rawInMemory = storage.affinityGeneration ?? 0;
+    const inMemoryGeneration = Number.isSafeInteger(rawInMemory) && rawInMemory >= 0 ? rawInMemory : 0;
     const next = Math.max(inMemoryGeneration, diskGeneration) + 1;
     storage.affinityGeneration = next;
     return next;
@@ -990,34 +1000,68 @@ export function bumpStorageAffinityGeneration(storage, storagePath) {
  * persisting routine state (rate-limit hits, cooldowns, etc.) so a CLI
  * `switch`/`unpin` that landed between proxy startup and the save is not
  * clobbered. Returns `pinnedAccountIndex: undefined` and
- * `affinityGeneration: 0` on any failure. See issue #474.
+ * `affinityGeneration: 0` on any failure by default. See issue #474.
+ *
+ * `strict` callers additionally need to know when the metadata could not be
+ * OBSERVED AT ALL, because persisting a stale in-memory pin over a newer disk
+ * pin is exactly the #474 regression. Strict mode therefore throws for the two
+ * cases where a newer selection may be hiding behind the failure:
+ *   - the file exists but cannot be read (EBUSY/EPERM/EACCES: on Windows an AV
+ *     scanner or indexer can hold accounts.json open), and
+ *   - the bytes are not valid JSON (a torn read of a concurrent atomic write).
+ *
+ * A MISSING file and a successfully parsed file with INVALID field values are
+ * deliberately not failures, in either mode. Neither can be concealing a newer
+ * pin (there is no file, or we can see the whole file and the field is
+ * unusable), and both are self-repaired by the very write that follows. Making
+ * them throw would wedge persistence permanently, since recreating or repairing
+ * storage goes through the same save path, and it would take every rate-limit
+ * window, cooldown and rotated refresh token in memory down with it.
  */
-export function readPinAndGenFromDisk(path) {
+export function readPinAndGenFromDisk(path, options) {
+    const unselected = {
+        pinnedAccountIndex: undefined,
+        affinityGeneration: 0,
+    };
     if (!existsSync(path)) {
-        return { pinnedAccountIndex: undefined, affinityGeneration: 0 };
+        return { ...unselected };
     }
+    let parsed;
     try {
-        const bytes = readFileSync(path);
-        const parsed = JSON.parse(bytes.toString("utf8"));
-        const rawPin = parsed.pinnedAccountIndex;
-        const pinnedAccountIndex = typeof rawPin === "number" &&
-            Number.isFinite(rawPin) &&
-            Number.isInteger(rawPin) &&
-            rawPin >= 0
-            ? rawPin
-            : undefined;
-        const rawGen = parsed.affinityGeneration;
-        const affinityGeneration = typeof rawGen === "number" &&
-            Number.isFinite(rawGen) &&
-            Number.isInteger(rawGen) &&
-            rawGen >= 0
-            ? rawGen
-            : 0;
-        return { pinnedAccountIndex, affinityGeneration };
+        parsed = JSON.parse(readFileSync(path, "utf8"));
     }
-    catch {
-        return { pinnedAccountIndex: undefined, affinityGeneration: 0 };
+    catch (error) {
+        // The file was deleted or renamed between existsSync and the read; same
+        // reasoning as the missing-file branch above.
+        if (error.code === "ENOENT") {
+            return { ...unselected };
+        }
+        if (options?.strict) {
+            throw new Error("Unable to read account selection metadata", {
+                cause: error,
+            });
+        }
+        return { ...unselected };
+    }
+    if (!isRecord(parsed)) {
+        return { ...unselected };
     }
+    const rawPin = parsed.pinnedAccountIndex;
+    const pinnedAccountIndex = typeof rawPin === "number" &&
+        Number.isFinite(rawPin) &&
+        Number.isInteger(rawPin) &&
+        rawPin >= 0
+        ? rawPin
+        : undefined;
+    const rawGen = parsed.affinityGeneration;
+    const affinityGeneration = typeof rawGen === "number" &&
+        Number.isFinite(rawGen) &&
+        // See readAffinityGenerationFromDisk: an unsafe integer wedges the bump.
+        Number.isSafeInteger(rawGen) &&
+        rawGen >= 0
+        ? rawGen
+        : 0;
+    return { pinnedAccountIndex, affinityGeneration };
 }
 /**
  * Loads OAuth accounts from disk storage.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.12.0",
+	"version": "2.13.0",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",

package/scripts/codex-routing.js

@@ -2,6 +2,7 @@ const AUTH_SUBCOMMANDS = new Set([
 	"login",
 	"list",
 	"status",
+	"limits",
 	"switch",
 	"unpin",
 	"workspace",

package/scripts/codex.js

@@ -78,6 +78,8 @@ const APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV =
 	"CODEX_MULTI_AUTH_APP_ROTATION_USE_CANONICAL_HOME";
 const APP_RUNTIME_HELPER_INSTALL_APP_SERVER_SHIM_ENV =
 	"CODEX_MULTI_AUTH_APP_ROTATION_INSTALL_APP_SERVER_SHIM";
+const RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV =
+	"CODEX_MULTI_AUTH_RUNTIME_PROXY_UPSTREAM_BASE_URL";
 const APP_SERVER_CONFIG_ARGS_ENV =
 	"CODEX_MULTI_AUTH_APP_SERVER_CONFIG_ARGS_JSON";
 const APP_RUNTIME_HELPER_STATUS_FILE =
@@ -168,6 +170,95 @@ let warnedShadowHomeSqliteLinkFailure = false;
 const warnedShadowHomeLinkOnlyDirectoryFailures = new Set();
 const warnedShadowHomeSqliteSidecarPlaceholderFailures = new Set();
 
+/**
+ * True only for a NUMERIC loopback literal, as `new URL().hostname` reports it.
+ *
+ * A name is deliberately not enough. `localhost` is resolved by the OS at
+ * connect time, so an /etc/hosts or Windows hosts entry can point it at a
+ * routable address, and the upstream request carries the managed OAuth bearer
+ * token and the request body. WHATWG URL always reports an IPv6 host in its
+ * bracketed form, so `::1` is only ever seen here as `[::1]`.
+ */
+function isLoopbackUrlHostname(hostname) {
+	if (hostname === "[::1]") {
+		return true;
+	}
+	const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+	if (!ipv4) {
+		return false;
+	}
+	const octets = ipv4.slice(1).map((part) => Number(part));
+	if (octets.some((octet) => !Number.isInteger(octet) || octet > 255)) {
+		return false;
+	}
+	// The whole 127.0.0.0/8 block is loopback, not just 127.0.0.1.
+	return octets[0] === 127;
+}
+
+/**
+ * Whether the raw URL text carries an explicit `:port`.
+ *
+ * `new URL()` erases a port that matches the scheme default, so
+ * `http://127.0.0.1:80/x` reports `parsed.port === ""` and a `!parsed.port`
+ * check would reject a perfectly valid, explicitly-ported loopback URL.
+ */
+function hasExplicitUrlPort(raw) {
+	const withoutScheme = raw.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+	const authority = withoutScheme.split(/[/?#]/, 1)[0] ?? "";
+	// Strip userinfo first, or a password containing ':' reads as a port.
+	const hostAndPort = authority.slice(authority.lastIndexOf("@") + 1);
+	if (hostAndPort.startsWith("[")) {
+		const close = hostAndPort.indexOf("]");
+		return close !== -1 && /^:\d+$/.test(hostAndPort.slice(close + 1));
+	}
+	const colon = hostAndPort.indexOf(":");
+	return colon !== -1 && /^:\d+$/.test(hostAndPort.slice(colon));
+}
+
+function resolveRuntimeRotationProxyUpstreamBaseUrl(env = process.env) {
+	const raw = (env[RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV] ?? "").trim();
+	if (!raw) {
+		return undefined;
+	}
+
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new Error(
+			`${RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV} must be an absolute loopback HTTP URL.`,
+		);
+	}
+
+	if (
+		parsed.protocol !== "http:" ||
+		!isLoopbackUrlHostname(parsed.hostname.toLowerCase()) ||
+		!(parsed.port || hasExplicitUrlPort(raw)) ||
+		parsed.username ||
+		parsed.password ||
+		parsed.search ||
+		parsed.hash
+	) {
+		throw new Error(
+			`${RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV} must use HTTP with a numeric loopback host (127.0.0.0/8 or [::1]; a name such as "localhost" is not accepted because it can resolve off-host), an explicit port, and no credentials, query, or fragment.`,
+		);
+	}
+
+	return parsed.toString().replace(/\/$/, "");
+}
+
+/**
+ * @param clientApiKey Shared secret the wrapper and proxy authenticate with.
+ * @param upstreamBaseUrl Already-resolved upstream, or undefined for the
+ * default backend. Callers pass the value they resolved rather than the env, so
+ * one launch never parses (and never re-reports) the same variable twice.
+ */
+function createRuntimeRotationProxyOptions(clientApiKey, upstreamBaseUrl) {
+	return upstreamBaseUrl
+		? { clientApiKey, upstreamBaseUrl }
+		: { clientApiKey };
+}
+
 async function loadRuntimeConstants() {
 	const fallback = {
 		RUNTIME_ROTATION_PROXY_PROVIDER_ID: `${APP_SERVER_ACCOUNT_DISPLAY_NAME}-runtime-proxy`,
@@ -4711,7 +4802,12 @@ async function runRuntimeRotationAppHelper(identityToken = "") {
 			throw new Error("runtime rotation config helpers are unavailable");
 		}
 		const clientApiKey = createRuntimeRotationProxyClientApiKey();
-		proxyServer = await proxyModule.startRuntimeRotationProxy({ clientApiKey });
+		proxyServer = await proxyModule.startRuntimeRotationProxy(
+			createRuntimeRotationProxyOptions(
+				clientApiKey,
+				resolveRuntimeRotationProxyUpstreamBaseUrl(),
+			),
+		);
 		const useCanonicalHome =
 			(process.env[APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV] ?? "").trim() ===
 			"1";
@@ -5112,13 +5208,52 @@ async function createRuntimeRotationProxyContextIfEnabled(
 	baseContext,
 	rawArgs,
 ) {
+	// Resolve the configured upstream BEFORE the enabled gate. Every path that
+	// leaves this function with `baseContext` forwards Responses traffic, and its
+	// managed OAuth bearer token, straight to the real backend. An explicit
+	// upstream is a routing requirement rather than a rotation preference, so
+	// `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`, `CODEX_MULTI_AUTH_BYPASS=1`, a
+	// missing `dist/lib/config.js` or a disabled setting must all fail closed
+	// here instead of silently reaching chatgpt.com.
+	let configuredUpstreamBaseUrl;
+	try {
+		configuredUpstreamBaseUrl =
+			resolveRuntimeRotationProxyUpstreamBaseUrl(baseContext.env);
+	} catch (error) {
+		baseContext.cleanup?.();
+		return {
+			startupError: `codex-multi-auth runtime rotation upstream is invalid: ${
+				error instanceof Error ? error.message : String(error)
+			}`,
+		};
+	}
+	// The one exception is a subcommand that never reaches the backend at all
+	// (`--version`, `login`, ...): there is no traffic to misroute, so it passes
+	// through with the upstream simply unused.
+	const requireConfiguredUpstream =
+		configuredUpstreamBaseUrl !== undefined &&
+		shouldUseRuntimeRoutingForForwardedArgs(rawArgs);
+
 	const enabled = await isRuntimeRotationProxyEnabled(rawArgs, baseContext.env);
 	if (!enabled) {
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError: `codex-multi-auth runtime rotation is disabled, so ${RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV} cannot be honored and requests would go to the direct backend instead. Enable runtime rotation or unset that variable.`,
+			};
+		}
 		return baseContext;
 	}
 
 	const configTomlModule = await loadRuntimeConfigTomlModule();
 	if (!configTomlModule) {
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError:
+					"codex-multi-auth runtime rotation config helpers are unavailable; configured upstream routing cannot continue.",
+			};
+		}
 		console.error(
 			"codex-multi-auth runtime rotation config helpers are unavailable; continuing without runtime rotation.",
 		);
@@ -5188,6 +5323,13 @@ async function createRuntimeRotationProxyContextIfEnabled(
 
 	const proxyModule = await loadRuntimeRotationProxyModule();
 	if (!proxyModule) {
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError:
+					"codex-multi-auth runtime rotation proxy is unavailable; configured upstream routing cannot continue.",
+			};
+		}
 		console.error(
 			"codex-multi-auth runtime rotation proxy is unavailable; continuing without runtime rotation.",
 		);
@@ -5198,7 +5340,12 @@ async function createRuntimeRotationProxyContextIfEnabled(
 	let shadowContext;
 	try {
 		const clientApiKey = createRuntimeRotationProxyClientApiKey();
-		proxyServer = await proxyModule.startRuntimeRotationProxy({ clientApiKey });
+		proxyServer = await proxyModule.startRuntimeRotationProxy(
+			createRuntimeRotationProxyOptions(
+				clientApiKey,
+				configuredUpstreamBaseUrl,
+			),
+		);
 		shadowContext = createRuntimeRotationProxyCodexHome(
 			baseContext.env,
 			proxyServer.baseUrl,
@@ -5211,6 +5358,14 @@ async function createRuntimeRotationProxyContextIfEnabled(
 		} catch {
 			// Best-effort cleanup only.
 		}
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError: `codex-multi-auth runtime rotation proxy failed to start with configured upstream: ${
+					error instanceof Error ? error.message : String(error)
+				}`,
+			};
+		}
 		console.error(
 			`codex-multi-auth runtime rotation proxy failed to start; continuing without runtime rotation: ${error instanceof Error ? error.message : String(error)}`,
 		);