codex-multi-auth 2.17.0 → 2.17.3

package/dist/lib/budget-guard.js

@@ -3,11 +3,10 @@ import { basename, join } from "node:path";
 import { logWarn } from "./logger.js";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { isRecord, sleep } from "./utils.js";
-import { tempPathFor } from "./temp-path.js";
+import { getJsonStoreFileMtimeMs, resetJsonStoreWriteQueuesForTests, stampUpdatedAt, withJsonStoreCasRetry, withJsonStoreFileLock, withJsonStoreWriteQueue, writeJsonStoreFileAtomicWithRetry, } from "./storage/json-store-lock.js";
 const BUDGET_GUARD_FILE_NAME = "budget-guards.json";
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
 const VALID_WINDOWS = new Set(["hour", "day", "week", "month"]);
-let writeQueue = Promise.resolve();
 function isRetryableFsError(error) {
     const code = error?.code;
     return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
@@ -40,13 +39,35 @@ function normalizeLimit(key, value) {
             : 0,
     };
 }
+// Normalized keys can literally be Object.prototype member names —
+// "constructor" and "__proto__" both survive normalizeKey untouched. On a
+// plain object, reading an absent key resolves an inherited member
+// ({}.constructor === Object), which made a same-named limit look "already
+// present" to the merge and silently dropped the incoming entry; writing
+// "__proto__" invokes the setter and mutates the prototype instead of storing
+// anything. Null-prototype maps make every key a plain data slot regardless of
+// name (same convention as lib/storage/snapshot-merge.ts).
+function newLimitsMap() {
+    return Object.create(null);
+}
+// Writes into maps that callers may have built as plain object literals cannot
+// rely on the map being null-prototype, so "__proto__" needs an own-property
+// write that bypasses the inherited setter.
+function writeLimitEntry(map, key, limit) {
+    Object.defineProperty(map, key, {
+        value: limit,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+    });
+}
 function emptyStore() {
-    return { version: 1, limits: {} };
+    return { version: 1, limits: newLimitsMap() };
 }
 function normalizeStore(value) {
     if (!isRecord(value) || value.version !== 1)
         return emptyStore();
-    const limits = {};
+    const limits = newLimitsMap();
     if (isRecord(value.limits)) {
         for (const [rawKey, raw] of Object.entries(value.limits)) {
             const key = normalizeKey(rawKey);
@@ -94,54 +115,113 @@ export async function loadBudgetGuardStore() {
         return emptyStore();
     }
 }
-export async function saveBudgetGuardStore(store) {
-    const path = getBudgetGuardPath();
-    const payload = normalizeStore(store);
-    const task = async () => {
-        await fs.mkdir(getCodexMultiAuthDir(), { recursive: true, mode: 0o700 });
-        const tempPath = tempPathFor(path);
-        let moved = false;
-        try {
-            await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
-                encoding: "utf8",
-                mode: 0o600,
-            });
-            for (let attempt = 0; attempt < 5; attempt += 1) {
-                try {
-                    await fs.rename(tempPath, path);
-                    moved = true;
-                    return;
-                }
-                catch (error) {
-                    if (!isRetryableFsError(error) || attempt >= 4)
-                        throw error;
-                    await sleep(10 * 2 ** attempt);
-                }
+/**
+ * Per-key merge of the caller's normalized store over the freshest on-disk
+ * store. Budget entries carry `updatedAt`; the newer entry wins per key so a
+ * save built on a stale snapshot cannot resurrect an older limit over a
+ * concurrent process's newer one. Keys the caller does not carry are
+ * preserved (upsert-only store — nothing deletes entries), matching the
+ * config save's patch-over-fresh-read semantics.
+ *
+ * When `baseline` (the caller's pre-edit snapshot) is supplied, entries
+ * identical to it are untouched carried copies and skipped entirely, so a
+ * stale snapshot row can never be re-stamped over a raced write. Entries
+ * that differ are deliberate writes and must not lose purely on timestamp:
+ * the upsert-time floor stamps against the caller's snapshot, but a
+ * concurrent writer can land a still-newer entry before this merge runs, so
+ * the merge re-stamps against the freshest on-disk entry instead of
+ * silently dropping the edit. Without a baseline every supplied entry is a
+ * plain `updatedAt >=` upsert.
+ */
+function mergeBudgetGuardLimits(current, incoming, baseline) {
+    const merged = {
+        version: 1,
+        limits: Object.assign(newLimitsMap(), current.limits),
+    };
+    const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    for (const [key, limit] of Object.entries(incoming.limits)) {
+        const existing = merged.limits[key];
+        if (!baseline) {
+            if (!existing || limit.updatedAt >= existing.updatedAt) {
+                merged.limits[key] = limit;
             }
+            continue;
         }
-        finally {
-            if (!moved) {
-                try {
-                    await fs.unlink(tempPath);
-                }
-                catch {
-                    // Best-effort temp cleanup.
-                }
-            }
+        if (same(limit, baseline.limits[key]))
+            continue;
+        limit.updatedAt = stampUpdatedAt(limit.updatedAt, existing?.updatedAt);
+        merged.limits[key] = limit;
+    }
+    return merged;
+}
+export async function saveBudgetGuardStore(store, baseline) {
+    const path = getBudgetGuardPath();
+    const incoming = normalizeStore(store);
+    // Normalize at invocation like `incoming`: later caller-side mutation of
+    // `baseline` must not shift which entries the merge counts as deliberate.
+    const prior = baseline ? normalizeStore(baseline) : undefined;
+    // Per-path promise queue serializes writers inside THIS process; the
+    // lock directory closes the same window against OTHER processes. Inside the lock
+    // every attempt re-stats (CAS), re-reads the freshest on-disk store, and
+    // merges this call's entries over it — so a save that raced a concurrent
+    // write reloads-and-retries rather than blindly overwriting it.
+    await withJsonStoreWriteQueue(path, async () => {
+        await withJsonStoreFileLock(path, async () => {
+            await withJsonStoreCasRetry(async () => {
+                const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+                const current = await loadBudgetGuardStore();
+                const merged = mergeBudgetGuardLimits(current, incoming, prior);
+                await fs.mkdir(getCodexMultiAuthDir(), {
+                    recursive: true,
+                    mode: 0o700,
+                });
+                await writeJsonStoreFileAtomicWithRetry(path, merged, {
+                    expectedMtimeMs,
+                    mode: 0o600,
+                });
+            });
+        });
+    });
+}
+/**
+ * Run a budget-guard read→mutate→write inside the write queue (in-process
+ * serialization) AND the cross-process lock directory, with mtime CAS retry:
+ * every attempt re-reads the freshest on-disk store and re-applies `mutate`
+ * before writing — so a mutation is applied to the latest committed state
+ * rather than merged by whole-record `updatedAt`, which can drop or clobber
+ * a concurrent process's change to the same key. `mutate` must be
+ * re-appliable across retries (apply precomputed work onto the store it is
+ * handed, don't capture mutated state). Prefer this over load→upsert→save
+ * whenever the caller is mutating rather than importing a foreign store.
+ */
+export async function updateBudgetGuardStore(mutate) {
+    const path = getBudgetGuardPath();
+    return withJsonStoreWriteQueue(path, () => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
+        const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+        const store = await loadBudgetGuardStore();
+        const { result, dirty } = mutate(store);
+        if (dirty) {
+            await fs.mkdir(getCodexMultiAuthDir(), {
+                recursive: true,
+                mode: 0o700,
+            });
+            await writeJsonStoreFileAtomicWithRetry(path, normalizeStore(store), { expectedMtimeMs, mode: 0o600 });
         }
-    };
-    const queued = writeQueue.catch(() => undefined).then(task);
-    writeQueue = queued.then(() => undefined, () => undefined);
-    await queued;
+        return result;
+    })));
 }
 export function upsertBudgetLimit(store, limit, now = Date.now()) {
     const key = normalizeKey(limit.key);
     if (!key)
         throw new Error("Budget key is required");
-    const next = normalizeLimit(key, { ...limit, key, updatedAt: now });
+    const next = normalizeLimit(key, {
+        ...limit,
+        key,
+        updatedAt: stampUpdatedAt(now, store.limits[key]?.updatedAt),
+    });
     if (!next)
         throw new Error("Invalid budget limit");
-    store.limits[key] = next;
+    writeLimitEntry(store.limits, key, next);
     return next;
 }
 export function getBudgetWindowStart(window, now = Date.now()) {
@@ -207,5 +287,5 @@ export function evaluateBudgetGuard(limit, summary) {
     };
 }
 export function resetBudgetGuardWriteQueueForTests() {
-    writeQueue = Promise.resolve();
+    resetJsonStoreWriteQueuesForTests(getBudgetGuardPath());
 }

package/dist/lib/capability-policy.d.ts

@@ -15,4 +15,3 @@ export declare class CapabilityPolicyStore {
     clearAccount(accountKey: string): number;
     private evictIfNeeded;
 }
-//# sourceMappingURL=capability-policy.d.ts.map

package/dist/lib/circuit-breaker.d.ts

@@ -9,6 +9,20 @@ export type CircuitState = "closed" | "open" | "half-open";
 export declare class CircuitOpenError extends Error {
     constructor(message?: string);
 }
+/**
+ * Non-throwing admission result, for hot paths that would otherwise pay for a
+ * {@link CircuitOpenError} allocation on every rejection during a storm.
+ * `reason` names the gate that rejected so callers can keep their own error
+ * taxonomy without parsing exception messages.
+ */
+export type CircuitAdmissionResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "open" | "half-open";
+    /** Milliseconds until a fresh attempt may be admitted. */
+    retryAfterMs: number;
+};
 export declare class CircuitBreaker {
     private state;
     private failures;
@@ -16,6 +30,12 @@ export declare class CircuitBreaker {
     private halfOpenAttempts;
     private config;
     constructor(config?: Partial<CircuitBreakerConfig>);
+    /**
+     * Same admission decision as {@link canExecute} but returns a result
+     * object instead of throwing, so reject-heavy callers stay exception-free.
+     * Admitting a probe still consumes the half-open attempt slot.
+     */
+    tryCanExecute(): CircuitAdmissionResult;
     canExecute(): boolean;
     isAvailable(now?: number): boolean;
     recordSuccess(): void;
@@ -41,4 +61,3 @@ export declare function clearCircuitBreakers(): void;
  * than inheriting an open one (accounts-02).
  */
 export declare function removeCircuitBreaker(key: string): void;
-//# sourceMappingURL=circuit-breaker.d.ts.map

package/dist/lib/circuit-breaker.js

@@ -19,14 +19,23 @@ export class CircuitBreaker {
     constructor(config = {}) {
         this.config = { ...DEFAULT_CIRCUIT_BREAKER_CONFIG, ...config };
     }
-    canExecute() {
+    /**
+     * Same admission decision as {@link canExecute} but returns a result
+     * object instead of throwing, so reject-heavy callers stay exception-free.
+     * Admitting a probe still consumes the half-open attempt slot.
+     */
+    tryCanExecute() {
         const now = Date.now();
         if (this.state === "open") {
             if (now - this.lastStateChange >= this.config.resetTimeoutMs) {
                 this.transitionToHalfOpen(now);
             }
             else {
-                throw new CircuitOpenError();
+                return {
+                    ok: false,
+                    reason: "open",
+                    retryAfterMs: Math.max(0, this.config.resetTimeoutMs - (now - this.lastStateChange)),
+                };
             }
         }
         if (this.state === "half-open") {
@@ -35,13 +44,23 @@ export class CircuitBreaker {
                     this.resetHalfOpenProbeWindow(now);
                 }
                 else {
-                    throw new CircuitOpenError("Circuit is half-open");
+                    return {
+                        ok: false,
+                        reason: "half-open",
+                        retryAfterMs: Math.max(0, this.config.resetTimeoutMs - (now - this.lastStateChange)),
+                    };
                 }
             }
             this.halfOpenAttempts += 1;
-            return true;
+            return { ok: true };
         }
-        return true;
+        return { ok: true };
+    }
+    canExecute() {
+        const result = this.tryCanExecute();
+        if (result.ok)
+            return true;
+        throw new CircuitOpenError(result.reason === "half-open" ? "Circuit is half-open" : "Circuit is open");
     }
     isAvailable(now = Date.now()) {
         if (this.state === "open") {

package/dist/lib/cli.d.ts

@@ -68,4 +68,3 @@ export interface AccountSelectionOptions {
 export declare function promptAccountSelection(candidates: AccountSelectionCandidate[], options?: AccountSelectionOptions): Promise<AccountSelectionCandidate | null>;
 export { isTTY };
 export type { AccountStatus };
-//# sourceMappingURL=cli.d.ts.map

package/dist/lib/codex-cli/index.d.ts

@@ -2,4 +2,3 @@ export * from "./observability.js";
 export * from "./state.js";
 export * from "./sync.js";
 export * from "./writer.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/codex-cli/observability.d.ts

@@ -19,4 +19,3 @@ export declare function makeAccountFingerprint(input: {
     accountId?: string;
     email?: string;
 }): string | undefined;
-//# sourceMappingURL=observability.d.ts.map

package/dist/lib/codex-cli/state.d.ts

@@ -99,4 +99,3 @@ export declare function loadCodexCliState(options?: {
 export declare function lookupCodexCliTokensByEmail(email: string | undefined): Promise<CodexCliTokenCacheEntry | null>;
 export declare function clearCodexCliStateCache(): void;
 export declare function __resetCodexCliWarningCacheForTests(): void;
-//# sourceMappingURL=state.d.ts.map

package/dist/lib/codex-cli/sync.d.ts

@@ -17,4 +17,3 @@ export declare function syncAccountStorageFromCodexCli(current: AccountStorageV3
     changed: boolean;
 }>;
 export declare function getActiveSelectionForFamily(storage: AccountStorageV3, family: ModelFamily): number;
-//# sourceMappingURL=sync.d.ts.map

package/dist/lib/codex-cli/writer.d.ts

@@ -60,4 +60,3 @@ export declare function ensureCodexCliFileAuthStore(configPath?: string): Promis
 export declare function setCodexCliActiveSelection(selection: ActiveSelection): Promise<boolean>;
 export declare function getLastCodexCliSelectionWriteTimestamp(): number;
 export {};
-//# sourceMappingURL=writer.d.ts.map

package/dist/lib/codex-manager/account-credentials.d.ts

@@ -10,4 +10,3 @@ export declare function applyTokenAccountIdentity(account: {
     accountId?: string;
     accountIdSource?: AccountIdSource;
 }, tokenAccountId: string | undefined): boolean;
-//# sourceMappingURL=account-credentials.d.ts.map

package/dist/lib/codex-manager/account-manager-commands.d.ts

@@ -11,4 +11,3 @@
  * @internal
  */
 export declare const ACCOUNT_MANAGER_COMMANDS: Set<string>;
-//# sourceMappingURL=account-manager-commands.d.ts.map

package/dist/lib/codex-manager/account-pool-write.d.ts

@@ -102,4 +102,3 @@ export declare function applyAccountPoolResults(params: {
     activeIndex: number;
     outcome: AccountPoolWriteOutcome | null;
 };
-//# sourceMappingURL=account-pool-write.d.ts.map

package/dist/lib/codex-manager/active-account-sync.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Test-only: clear the storage-fingerprint cache so each test re-reads from
+ * disk instead of inheriting a previous scenario's "already synced" state.
+ */
+export declare function resetActiveAccountSyncMetaForTests(): void;
+export declare function autoSyncActiveAccountToCodex(): Promise<boolean>;