codex-multi-auth 2.17.0 → 2.17.3

package/dist/lib/codex-manager/settings-persist-utils.d.ts

@@ -6,4 +6,3 @@ export declare function readFileWithRetry(path: string, deps: {
     maxAttempts: number;
     sleep: (ms: number) => Promise<void>;
 }): Promise<string>;
-//# sourceMappingURL=settings-persist-utils.d.ts.map

package/dist/lib/codex-manager/settings-preview.d.ts

@@ -9,4 +9,3 @@ export declare function buildAccountListPreview(settings: DashboardDisplaySettin
     label: string;
     hint: string;
 };
-//# sourceMappingURL=settings-preview.d.ts.map

package/dist/lib/codex-manager/settings-write-queue.d.ts

@@ -1,4 +1,3 @@
 export declare function withQueuedRetry<T>(pathKey: string, task: () => Promise<T>, deps: {
     sleep: (ms: number) => Promise<void>;
 }): Promise<T>;
-//# sourceMappingURL=settings-write-queue.d.ts.map

package/dist/lib/codex-manager/statusline-settings-panel.d.ts

@@ -22,4 +22,3 @@ export interface StatuslineSettingsPanelDeps {
 }
 export declare function promptStatuslineSettingsPanel(initial: DashboardDisplaySettings, deps: StatuslineSettingsPanelDeps): Promise<DashboardDisplaySettings | null>;
 export {};
-//# sourceMappingURL=statusline-settings-panel.d.ts.map

package/dist/lib/codex-manager/theme-settings-panel.d.ts

@@ -10,4 +10,3 @@ export interface ThemeSettingsPanelDeps {
     UI_COPY: typeof UI_COPY;
 }
 export declare function promptThemeSettingsPanel(initial: DashboardDisplaySettings, deps: ThemeSettingsPanelDeps): Promise<DashboardDisplaySettings | null>;
-//# sourceMappingURL=theme-settings-panel.d.ts.map

package/dist/lib/codex-manager/unified-settings-controller.d.ts

@@ -24,4 +24,3 @@ export type UnifiedSettingsControllerDeps = {
     THEME_PANEL_KEYS: readonly (keyof DashboardDisplaySettings)[];
 };
 export declare function configureUnifiedSettingsController(initialSettings: DashboardDisplaySettings | undefined, deps: UnifiedSettingsControllerDeps): Promise<DashboardDisplaySettings>;
-//# sourceMappingURL=unified-settings-controller.d.ts.map

package/dist/lib/codex-manager/unified-settings-entry.d.ts

@@ -3,4 +3,3 @@ import type { UnifiedSettingsControllerDeps } from "./unified-settings-controlle
 export declare function configureUnifiedSettingsEntry(initialSettings: DashboardDisplaySettings | undefined, deps: {
     configureUnifiedSettingsController: (initialSettings: DashboardDisplaySettings | undefined, deps: UnifiedSettingsControllerDeps) => Promise<DashboardDisplaySettings>;
 } & UnifiedSettingsControllerDeps): Promise<DashboardDisplaySettings>;
-//# sourceMappingURL=unified-settings-entry.d.ts.map

package/dist/lib/codex-manager.d.ts

@@ -2,8 +2,7 @@ import { selectHybridAccountTraced } from "./rotation.js";
 import { formatBackupSavedAt, styleAccountDetailText } from "./codex-manager/formatters/index.js";
 import { type AccountStorageV3 } from "./storage.js";
 export { formatBackupSavedAt, styleAccountDetailText };
-export declare function autoSyncActiveAccountToCodex(): Promise<boolean>;
+export { autoSyncActiveAccountToCodex } from "./codex-manager/active-account-sync.js";
 /** @internal Exposed for diagnostics regression tests; not part of the CLI API. */
 export declare function buildSelectAccountTraced(): (storage: AccountStorageV3) => Promise<ReturnType<typeof selectHybridAccountTraced>>;
 export declare function runCodexMultiAuthCli(rawArgs: string[]): Promise<number>;
-//# sourceMappingURL=codex-manager.d.ts.map

package/dist/lib/codex-manager.js

@@ -5,7 +5,6 @@ import { loadInferenceRequestTimes } from "./runtime/inference-activity.js";
 import { loadModelInventory, refreshAndPrintModelInventory } from "./runtime/model-discovery-status.js";
 import { AUTH_INVALIDATION_MARKER, AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, } from "./accounts.js";
 import { reboundUnauthorizedAccountIdentity, refreshCodexCliMirror, } from "./auth/account-access.js";
-import { codexCliAccountIdFor } from "./auth/token-utils.js";
 import { loadCodexCliState } from "./codex-cli/state.js";
 import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
 import { parseBestArgs, printBestUsage, runBestCommand, } from "./codex-manager/commands/best.js";
@@ -60,7 +59,7 @@ import { loadQuotaCache, saveQuotaCache } from "./quota-cache.js";
 import { readAppRuntimeHelperAccountSignal } from "./runtime/runtime-current-account.js";
 import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./quota-probe.js";
 import { queuedRefresh } from "./refresh-queue.js";
-import { clearAccounts, findMatchingAccountIndex, inspectStorageHealth, getLastAccountsSaveTimestamp, getStoragePath, loadAccounts, loadFlaggedAccounts, saveAccounts, setStoragePath, withAccountStorageTransaction, } from "./storage.js";
+import { clearAccounts, inspectStorageHealth, getLastAccountsSaveTimestamp, getStoragePath, loadAccounts, loadFlaggedAccounts, saveAccounts, setStoragePath, } from "./storage.js";
 // Formatter implementations moved to lib/codex-manager/formatters/ (audit
 // roadmap §4.1.1 phase 1). Re-exported here so existing consumers importing
 // from lib/codex-manager.js keep working unchanged.
@@ -196,99 +195,10 @@ async function runBest(args) {
         setCodexCliActiveSelection,
     });
 }
-export async function autoSyncActiveAccountToCodex() {
-    setStoragePath(null);
-    const storage = await loadAccounts();
-    if (!storage || storage.accounts.length === 0) {
-        return false;
-    }
-    const activeIndex = resolveActiveIndex(storage, "codex");
-    if (activeIndex < 0 || activeIndex >= storage.accounts.length) {
-        return false;
-    }
-    const account = storage.accounts[activeIndex];
-    if (!account) {
-        return false;
-    }
-    const accountMatch = {
-        accountId: account.accountId,
-        email: account.email,
-        refreshToken: account.refreshToken,
-    };
-    const now = Date.now();
-    let syncAccessToken = account.accessToken;
-    let syncRefreshToken = account.refreshToken;
-    let syncExpiresAt = account.expiresAt;
-    let syncIdToken;
-    let syncEmail = account.email;
-    let changed = false;
-    let nextStoredAccount = null;
-    if (!hasUsableAccessToken(account, now)) {
-        const refreshResult = await queuedRefresh(account.refreshToken);
-        if (refreshResult.type !== "success") {
-            return false;
-        }
-        nextStoredAccount = structuredClone(account);
-        const tokenAccountId = extractAccountId(refreshResult.access);
-        const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
-        if (nextStoredAccount.refreshToken !== refreshResult.refresh) {
-            nextStoredAccount.refreshToken = refreshResult.refresh;
-            changed = true;
-        }
-        if (nextStoredAccount.accessToken !== refreshResult.access) {
-            nextStoredAccount.accessToken = refreshResult.access;
-            changed = true;
-        }
-        if (nextStoredAccount.expiresAt !== refreshResult.expires) {
-            nextStoredAccount.expiresAt = refreshResult.expires;
-            changed = true;
-        }
-        if (nextEmail && nextEmail !== nextStoredAccount.email) {
-            nextStoredAccount.email = nextEmail;
-            changed = true;
-        }
-        if (applyTokenAccountIdentity(nextStoredAccount, tokenAccountId)) {
-            changed = true;
-        }
-        syncAccessToken = refreshResult.access;
-        syncRefreshToken = refreshResult.refresh;
-        syncExpiresAt = refreshResult.expires;
-        syncIdToken = refreshResult.idToken;
-        syncEmail = nextStoredAccount.email;
-    }
-    if (changed && nextStoredAccount) {
-        let persisted = false;
-        await withAccountStorageTransaction(async (loadedStorage, persist) => {
-            if (!loadedStorage) {
-                return;
-            }
-            const nextStorage = structuredClone(loadedStorage);
-            const targetIndex = findMatchingAccountIndex(nextStorage.accounts, accountMatch, {
-                allowUniqueAccountIdFallbackWithoutEmail: true,
-            }) ??
-                findMatchingAccountIndex(nextStorage.accounts, nextStoredAccount, {
-                    allowUniqueAccountIdFallbackWithoutEmail: true,
-                });
-            if (targetIndex === undefined) {
-                return;
-            }
-            nextStorage.accounts[targetIndex] = structuredClone(nextStoredAccount);
-            await persist(nextStorage);
-            persisted = true;
-        });
-        if (!persisted) {
-            return false;
-        }
-    }
-    return setCodexCliActiveSelection({
-        accountId: codexCliAccountIdFor(nextStoredAccount ?? account, syncAccessToken, syncIdToken),
-        email: syncEmail,
-        accessToken: syncAccessToken,
-        refreshToken: syncRefreshToken,
-        expiresAt: syncExpiresAt,
-        ...(syncIdToken ? { idToken: syncIdToken } : {}),
-    });
-}
+// Moved to lib/codex-manager/active-account-sync.ts so the wrapper's forwarded
+// path can import the sync without the whole manager/dispatch graph. Re-exported
+// here to keep the codex-manager.js surface (and its tests) unchanged.
+export { autoSyncActiveAccountToCodex } from "./codex-manager/active-account-sync.js";
 /** @internal Exposed for diagnostics regression tests; not part of the CLI API. */
 export function buildSelectAccountTraced() {
     return async (storage) => {

package/dist/lib/concurrency.d.ts

@@ -1,3 +1,2 @@
 /** Bounded independent work, refilling free slots immediately and preserving result order. */
 export declare function mapWithConcurrency<T, R>(items: readonly T[], limit: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;
-//# sourceMappingURL=concurrency.d.ts.map

package/dist/lib/config-schema.d.ts

@@ -29,4 +29,3 @@ export declare function buildConfigJsonSchema(): JsonObject;
  */
 export declare function renderConfigJsonSchema(): string;
 export {};
-//# sourceMappingURL=config-schema.d.ts.map

package/dist/lib/config.d.ts

@@ -385,4 +385,3 @@ export declare function getRoutingMutexMode(pluginConfig: PluginConfig): "enable
 export declare function getSchedulingStrategy(pluginConfig: PluginConfig): "hybrid" | "sequential";
 export declare function getPluginConfigExplainReport(): ConfigExplainReport;
 export {};
-//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.js

@@ -1,6 +1,5 @@
 import { existsSync, promises as fs, readFileSync } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { parseBooleanEnv } from "./env-parsing.js";
 import { stripModelEffortSuffix } from "./constants.js";
 import { withRetry, withRetrySync } from "./fs-retry.js";
@@ -8,8 +7,8 @@ import { logWarn } from "./logger.js";
 import { StorageError } from "./errors.js";
 import { getCodexHomeDir, getCodexMultiAuthDir, getLegacyCodexDir, } from "./runtime-paths.js";
 import { getValidationErrors, PluginConfigSchema } from "./schemas.js";
+import { getJsonStoreFileMtimeMs, withJsonStoreCasRetry, withJsonStoreFileLock, withJsonStoreWriteQueue, writeJsonStoreFileAtomicWithRetry, } from "./storage/json-store-lock.js";
 import { getUnifiedSettingsPath, loadUnifiedPluginConfigSync, saveUnifiedPluginConfig, } from "./unified-settings.js";
-import { tempPathFor } from "./temp-path.js";
 const CONFIG_DIR = getCodexMultiAuthDir();
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 const CODEX_HOME_DIR = getCodexHomeDir();
@@ -23,8 +22,6 @@ const TUI_COLOR_PROFILES = new Set(["truecolor", "ansi16", "ansi256"]);
 const TUI_GLYPH_MODES = new Set(["ascii", "unicode", "auto"]);
 const UNSUPPORTED_CODEX_POLICIES = new Set(["strict", "fallback"]);
 const emittedConfigWarnings = new Set();
-const configSaveQueues = new Map();
-const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
 const RETRYABLE_CONFIG_READ_CODES = new Set(["EBUSY", "EPERM", "EAGAIN"]);
 /**
  * Synchronous readFileSync with bounded retry on transient FS-lock codes.
@@ -330,212 +327,14 @@ function stripUtf8Bom(content) {
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function getConfigFileMtimeMs(filePath) {
-    // config-08: the mtime CAS preflight (and savePluginConfig's env-path branch)
-    // run on the Windows-sensitive save path, where a transient EBUSY/EPERM/EAGAIN
-    // from an AV/indexer lock on a single fs.stat would abort the entire save.
-    // Mirror readConfigRecordForSave's bounded transient-FS retry (same code set,
-    // same backoff, 5 attempts). ENOENT still returns null immediately. On
-    // exhaustion the last failure surfaces so the caller treats it as a real
-    // save error rather than a phantom missing file.
-    return withRetry(async () => {
-        try {
-            return (await fs.stat(filePath)).mtimeMs;
-        }
-        catch (error) {
-            if (error?.code === "ENOENT") {
-                return null;
-            }
-            throw error;
-        }
-    }, {
-        maxAttempts: 5,
-        backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
-        retryableCodes: RETRYABLE_CONFIG_READ_CODES,
-    });
-}
-async function writeJsonFileAtomicWithRetry(filePath, payload, options) {
-    const tempPath = tempPathFor(filePath);
-    await fs.mkdir(dirname(filePath), { recursive: true });
-    await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
-    let renamed = false;
-    try {
-        // Compare-and-swap guard: if a concurrent writer changed the target file
-        // since the caller read it (mtime mismatch), abort with ESTALE so the
-        // caller can re-read and merge instead of clobbering the other write.
-        if (options && "expectedMtimeMs" in options) {
-            const currentMtimeMs = await getConfigFileMtimeMs(filePath);
-            if (currentMtimeMs !== options.expectedMtimeMs) {
-                const staleError = new Error(`Config at ${filePath} changed on disk during save; retrying with latest state.`);
-                staleError.code = "ESTALE";
-                throw staleError;
-            }
-        }
-        await withRetry(() => fs.rename(tempPath, filePath), {
-            maxAttempts: 5,
-            backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
-            retryableCodes: RETRYABLE_FS_CODES,
-        });
-        renamed = true;
-    }
-    finally {
-        if (!renamed) {
-            try {
-                await fs.unlink(tempPath);
-            }
-            catch {
-                // Best-effort temp cleanup.
-            }
-        }
-    }
-}
-async function withConfigSaveLock(path, task) {
-    const previous = configSaveQueues.get(path) ?? Promise.resolve();
-    const queued = previous.catch(() => { }).then(task);
-    configSaveQueues.set(path, queued);
-    try {
-        await queued;
-    }
-    finally {
-        if (configSaveQueues.get(path) === queued) {
-            configSaveQueues.delete(path);
-        }
-    }
-}
-// Cross-process config-save lock. withConfigSaveLock only serializes saves
-// within THIS process (a per-path promise queue); it does nothing against a
-// second process. The mtime CAS in writeJsonFileAtomicWithRetry narrows but does
-// not close the read→check→merge→rename TOCTOU window (another process can still
-// land a write between the CAS stat and the rename). This file lock provides the
-// cross-process mutual exclusion that closes that window. It deliberately mirrors
-// RefreshLeaseCoordinator (lib/refresh-lease.ts): exclusive `wx` lockfile create,
-// JSON payload carrying pid + expiry, stale-takeover via expiry/mtime, and a
-// best-effort retrying release in a finally. The mtime CAS stays as a second-line
-// guard for any non-participating writer.
-const CONFIG_LOCK_TTL_MS = 10_000;
-const CONFIG_LOCK_WAIT_TIMEOUT_MS = 10_000;
-const CONFIG_LOCK_POLL_MS = 50;
-async function unlinkConfigLockWithRetry(lockPath) {
-    try {
-        await withRetry(() => fs.unlink(lockPath), {
-            maxAttempts: 5,
-            backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
-            retryableCodes: RETRYABLE_FS_CODES,
-        });
-    }
-    catch {
-        // ENOENT (already released) or best-effort release failure: a leftover
-        // lockfile is recovered as stale by the next acquirer via its
-        // expiry/mtime, so never fail the save over this.
-    }
-}
-// Owner-safe release: only unlink the lockfile if it still carries OUR owner
-// token. If a slow save was deemed stale and a second process stole the lock,
-// the lockfile now holds the new owner's token — deleting it would reopen
-// concurrent saves, so we leave it alone.
-async function releaseConfigLockIfOwner(lockPath, owner) {
-    try {
-        const content = await fs.readFile(lockPath, "utf-8");
-        const parsed = JSON.parse(stripUtf8Bom(content));
-        if (parsed?.owner && parsed.owner !== owner) {
-            // Lock was taken over by another holder; do not delete their lock.
-            return;
-        }
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT")
-            return;
-        // Unreadable/malformed: fall through and attempt our best-effort unlink.
-    }
-    await unlinkConfigLockWithRetry(lockPath);
-}
-async function isConfigLockStale(lockPath) {
-    try {
-        const content = await fs.readFile(lockPath, "utf-8");
-        const parsed = JSON.parse(stripUtf8Bom(content));
-        if (typeof parsed?.expiresAt === "number" &&
-            Number.isFinite(parsed.expiresAt)) {
-            return parsed.expiresAt <= Date.now();
-        }
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT")
-            return true;
-        // Unreadable/malformed payload: fall through to the mtime heuristic.
-    }
-    try {
-        const stat = await fs.stat(lockPath);
-        return Date.now() - stat.mtimeMs > CONFIG_LOCK_TTL_MS;
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT")
-            return true;
-        return false;
-    }
-}
-async function withConfigFileLock(targetPath, task) {
-    const lockPath = `${targetPath}.lock`;
-    const owner = randomUUID();
-    await fs.mkdir(dirname(lockPath), { recursive: true });
-    const deadline = Date.now() + CONFIG_LOCK_WAIT_TIMEOUT_MS;
-    let acquired = false;
-    while (!acquired) {
-        try {
-            const now = Date.now();
-            const payload = {
-                pid: process.pid,
-                owner,
-                acquiredAt: now,
-                expiresAt: now + CONFIG_LOCK_TTL_MS,
-            };
-            const handle = await fs.open(lockPath, "wx", 0o600);
-            try {
-                await handle.writeFile(`${JSON.stringify(payload)}\n`, "utf8");
-            }
-            finally {
-                await handle.close();
-            }
-            acquired = true;
-        }
-        catch (error) {
-            const code = error?.code;
-            if (code !== "EEXIST") {
-                // A transient FS lock on the lockfile itself: retry until the deadline,
-                // matching the bounded backoff used elsewhere on the Windows save path.
-                if (typeof code === "string" &&
-                    RETRYABLE_FS_CODES.has(code) &&
-                    Date.now() < deadline) {
-                    await sleep(CONFIG_LOCK_POLL_MS);
-                    continue;
-                }
-                throw error;
-            }
-            // Lock is held. Take it over if the holder expired/crashed; otherwise wait.
-            if (await isConfigLockStale(lockPath)) {
-                await unlinkConfigLockWithRetry(lockPath);
-                continue;
-            }
-            if (Date.now() >= deadline) {
-                const timeoutError = new Error(`Timed out acquiring config save lock at ${lockPath}.`);
-                timeoutError.code = "ELOCKTIMEOUT";
-                throw timeoutError;
-            }
-            await sleep(CONFIG_LOCK_POLL_MS);
-        }
-    }
-    try {
-        return await task();
-    }
-    finally {
-        await releaseConfigLockIfOwner(lockPath, owner);
-    }
-}
+// Cross-process save safety lives in lib/storage/json-store-lock.ts:
+// withJsonStoreWriteQueue (per-path in-process queue), withJsonStoreFileLock
+// (candidate-directory lock + dead-owner recovery), and the mtime CAS
+// trio (getJsonStoreFileMtimeMs / writeJsonStoreFileAtomicWithRetry /
+// withJsonStoreCasRetry). The file lock provides the cross-process mutual
+// exclusion that closes the read→check→merge→rename TOCTOU window against
+// OTHER processes; the mtime CAS stays on as a second-line guard for any
+// non-participating writer.
 /**
  * Read and parse a JSON configuration file and return its top-level object when present and valid.
  *
@@ -718,19 +517,19 @@ export async function savePluginConfig(configPatch) {
     }
     const envPath = (process.env.CODEX_MULTI_AUTH_CONFIG_PATH ?? "").trim();
     if (envPath.length > 0) {
-        await withConfigSaveLock(envPath, async () => {
+        await withJsonStoreWriteQueue(envPath, async () => {
             // In-process queue (above) is the cheap fast path; the cross-process file
             // lock (below) closes the read→merge→rename TOCTOU window against OTHER
             // processes. Acquire the file lock for the full critical section, then run
             // the same mtime CAS retry as a second-line guard for any non-participating
             // writer. Mirrors the unified-settings save path (writeSettingsRecordAsync
             // CAS).
-            await withConfigFileLock(envPath, async () => {
+            await withJsonStoreFileLock(envPath, async () => {
                 // CAS retry: ESTALE means the file's mtime moved between our stat and
                 // the write, so each attempt re-stats, re-reads, and re-merges against
                 // the latest on-disk state before writing again.
-                await withRetry(async () => {
-                    const expectedMtimeMs = await getConfigFileMtimeMs(envPath);
+                await withJsonStoreCasRetry(async () => {
+                    const expectedMtimeMs = await getJsonStoreFileMtimeMs(envPath);
                     const envConfigState = await readConfigRecordForSave(envPath);
                     if (envConfigState.status === "unreadable") {
                         throw unreadableConfigSaveError(envPath, envConfigState.errorMessage);
@@ -742,39 +541,45 @@ export async function savePluginConfig(configPatch) {
                         ...(existingConfig ?? {}),
                         ...sanitizedPatch,
                     };
-                    await writeJsonFileAtomicWithRetry(envPath, merged, {
+                    await writeJsonStoreFileAtomicWithRetry(envPath, merged, {
                         expectedMtimeMs,
                     });
-                }, { maxAttempts: 3, backoffMs: 0, retryableCodes: ["ESTALE"] });
+                });
             });
         });
         return;
     }
     const unifiedPath = getUnifiedSettingsPath();
-    await withConfigSaveLock(unifiedPath, async () => {
-        const unifiedConfigState = await readConfigRecordForSave(unifiedPath);
-        if (unifiedConfigState.status === "unreadable") {
-            throw unreadableConfigSaveError(unifiedPath, unifiedConfigState.errorMessage);
-        }
-        const unifiedConfigRecord = unifiedConfigState.status === "ok"
-            ? unifiedConfigState.record.pluginConfig
-            : loadUnifiedPluginConfigSync();
-        const unifiedConfig = sanitizeStoredPluginConfigRecord(unifiedConfigRecord);
-        const legacyPath = unifiedConfig === null ? resolvePluginConfigPath() : null;
-        const legacyConfigState = legacyPath
-            ? await readConfigRecordForSave(legacyPath)
-            : null;
-        if (legacyConfigState?.status === "unreadable") {
-            throw unreadableConfigSaveError(legacyPath, legacyConfigState.errorMessage);
-        }
-        const legacyConfig = legacyConfigState?.status === "ok"
-            ? sanitizeStoredPluginConfigRecord(legacyConfigState.record)
-            : null;
-        const merged = {
-            ...(unifiedConfig ?? legacyConfig ?? {}),
-            ...sanitizedPatch,
-        };
-        await saveUnifiedPluginConfig(merged);
+    await withJsonStoreWriteQueue(unifiedPath, async () => {
+        // Hold the same cross-process lockfile for the read→merge portion, not
+        // just the write: saveUnifiedPluginConfig re-acquires both primitives
+        // re-entrantly inside this critical section, so the merged pluginConfig
+        // cannot interleave with another process's write to the same file.
+        await withJsonStoreFileLock(unifiedPath, async () => {
+            const unifiedConfigState = await readConfigRecordForSave(unifiedPath);
+            if (unifiedConfigState.status === "unreadable") {
+                throw unreadableConfigSaveError(unifiedPath, unifiedConfigState.errorMessage);
+            }
+            const unifiedConfigRecord = unifiedConfigState.status === "ok"
+                ? unifiedConfigState.record.pluginConfig
+                : loadUnifiedPluginConfigSync();
+            const unifiedConfig = sanitizeStoredPluginConfigRecord(unifiedConfigRecord);
+            const legacyPath = unifiedConfig === null ? resolvePluginConfigPath() : null;
+            const legacyConfigState = legacyPath
+                ? await readConfigRecordForSave(legacyPath)
+                : null;
+            if (legacyConfigState?.status === "unreadable") {
+                throw unreadableConfigSaveError(legacyPath, legacyConfigState.errorMessage);
+            }
+            const legacyConfig = legacyConfigState?.status === "ok"
+                ? sanitizeStoredPluginConfigRecord(legacyConfigState.record)
+                : null;
+            const merged = {
+                ...(unifiedConfig ?? legacyConfig ?? {}),
+                ...sanitizedPatch,
+            };
+            await saveUnifiedPluginConfig(merged);
+        });
     });
 }
 function parseNumberEnv(value) {

package/dist/lib/constants.d.ts

@@ -113,4 +113,3 @@ export type WireReasoningEffort = Exclude<ModelReasoningEffort, "ultra">;
  * untouched.
  */
 export declare function stripModelEffortSuffix(modelId: string): string;
-//# sourceMappingURL=constants.d.ts.map

package/dist/lib/context-budget/model-context-windows.d.ts

@@ -22,4 +22,3 @@ export interface EffectiveContextWindow {
  */
 export declare function getEffectiveContextWindow(model: string | null | undefined, overrides: Record<string, number> | undefined): EffectiveContextWindow | null;
 export declare function listEstimatedModelContextWindows(): Record<string, number>;
-//# sourceMappingURL=model-context-windows.d.ts.map

package/dist/lib/context-budget-guard.d.ts

@@ -97,4 +97,3 @@ export declare class ContextBudgetGuard {
     noteHardPauseEmitted(key: string): void;
 }
 export {};
-//# sourceMappingURL=context-budget-guard.d.ts.map

package/dist/lib/context-budget-response.d.ts

@@ -22,4 +22,3 @@ export declare function createContextBudgetPauseResponse(advisory: Extract<Conte
 export declare function buildContextBudgetHeaders(advisory: Extract<ContextBudgetAdvisory, {
     level: "soft" | "hard";
 }>): Record<string, string>;
-//# sourceMappingURL=context-budget-response.d.ts.map

package/dist/lib/context-budget-response.js

@@ -17,14 +17,14 @@ function buildPauseMessage(advisory) {
     const windowNote = advisory.windowSource === "override"
         ? "your configured window size"
         : "an estimated window size (unverified — set `contextBudgetGuardModelWindowOverrides` if you know the real limit)";
-    return `[Plugin Notice] Context budget guard paused this session at ${formatPercent(advisory.percent)}% of ${windowNote} for \`${advisory.model}\`, before hitting the model's actual limit.
-
-Please use one of these commands to reduce context size:
-
-• **/compact** - Compress conversation history (recommended)
-• **/clear** - Start fresh with empty context
-• **/undo** - Remove recent messages
-
+    return `[Plugin Notice] Context budget guard paused this session at ${formatPercent(advisory.percent)}% of ${windowNote} for \`${advisory.model}\`, before hitting the model's actual limit.
+
+Please use one of these commands to reduce context size:
+
+• **/compact** - Compress conversation history (recommended)
+• **/clear** - Start fresh with empty context
+• **/undo** - Remove recent messages
+
 Then retry your request. This pause clears itself automatically once your context usage drops back below the threshold.`;
 }
 /**

package/dist/lib/context-overflow.d.ts

@@ -29,4 +29,3 @@ export declare function handleContextOverflow(response: Response, model?: string
 } | {
     handled: false;
 }>;
-//# sourceMappingURL=context-overflow.d.ts.map

package/dist/lib/context-overflow.js

@@ -33,16 +33,16 @@ export function isContextOverflowError(status, bodyText) {
 /**
  * The message shown to users when context overflow occurs
  */
-const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
-
-Please use one of these commands to reduce context size:
-
-• **/compact** - Compress conversation history (recommended)
-• **/clear** - Start fresh with empty context
-• **/undo** - Remove recent messages
-
-Then retry your request.
-
+const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
+
+Please use one of these commands to reduce context size:
+
+• **/compact** - Compress conversation history (recommended)
+• **/clear** - Start fresh with empty context
+• **/undo** - Remove recent messages
+
+Then retry your request.
+
 Alternatively, you can switch to a model with a larger context window.`;
 /**
  * Creates a synthetic SSE response for context overflow errors.

package/dist/lib/dashboard-settings.d.ts

@@ -87,4 +87,3 @@ export declare function loadDashboardDisplaySettings(): Promise<DashboardDisplay
  */
 export declare function saveDashboardDisplaySettings(settings: DashboardDisplaySettings): Promise<void>;
 export {};
-//# sourceMappingURL=dashboard-settings.d.ts.map

package/dist/lib/entitlement-cache.d.ts

@@ -41,4 +41,3 @@ export declare class EntitlementCache {
     prune(now?: number): number;
     snapshot(now?: number): EntitlementCacheSnapshot;
 }
-//# sourceMappingURL=entitlement-cache.d.ts.map