codex-multi-auth 2.17.0 → 2.17.3

package/dist/lib/codex-manager/active-account-sync.js

@@ -0,0 +1,336 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { extractAccountEmail, extractAccountId, sanitizeEmail, } from "../accounts.js";
+import { codexCliAccountIdFor } from "../auth/token-utils.js";
+import { getCodexCliAccountsPath, getCodexCliAuthPath, getCodexCliConfigPath, } from "../codex-cli/state.js";
+import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { queuedRefresh } from "../refresh-queue.js";
+import { resolveActiveIndex } from "../runtime/account-status.js";
+import { findMatchingAccountIndex, getStoragePath, loadAccounts, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
+import { applyTokenAccountIdentity, hasUsableAccessToken, } from "./account-credentials.js";
+// Keyed by absolute storage path, mirroring lib/runtime/rotation-storage-meta.ts:
+// the same process can host multiple wrappers/test workers pointed at different
+// storage files, and none may corrupt another's snapshot.
+const ACTIVE_SYNC_FINGERPRINTS = new Map();
+// A cached mtime+size match is only trusted once the file has been quiescent
+// long enough that no *subsequent* write could share the same coarse mtime
+// tick (see rotation-storage-meta.ts / issue #474 — atomic-rename writers can
+// land two rapid bumps on an identical mtimeMs). Inside the window we fall
+// back to the read + sha1 comparison, which stays the source of truth.
+const ACTIVE_SYNC_MTIME_SETTLE_MS = 2_000;
+function hashStorageBytes(bytes) {
+    return createHash("sha1").update(bytes).digest("hex");
+}
+function statFingerprint(storagePath) {
+    if (typeof storagePath !== "string" || storagePath.length === 0) {
+        return null;
+    }
+    try {
+        const stats = statSync(storagePath);
+        return {
+            mtimeMs: stats.mtimeMs,
+            size: stats.size,
+            contentHash: hashStorageBytes(readFileSync(storagePath)),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The official-CLI files `setCodexCliActiveSelection` mirrors into: auth.json
+ * and accounts.json carry the selection/tokens, config.toml carries the
+ * credential-store pin. Resolved per call — every one is env-overridable and
+ * may move between calls. The state module is already in this graph via
+ * `../codex-cli/writer.js`, so these imports add no cold-start weight.
+ */
+function codexCliMirrorPaths() {
+    return [
+        ...new Set([
+            getCodexCliAuthPath(),
+            getCodexCliAccountsPath(),
+            getCodexCliConfigPath(),
+        ]),
+    ];
+}
+function statFingerprints(paths) {
+    const map = new Map();
+    for (const path of paths) {
+        map.set(path, statFingerprint(path));
+    }
+    return map;
+}
+/**
+ * mtime+size(+settle)/sha1 ladder for one file, same contract as
+ * `lib/runtime/rotation-storage-meta.ts`: a stat match is only trusted once
+ * the cached mtime has settled past ACTIVE_SYNC_MTIME_SETTLE_MS (atomic-rename
+ * writers can land two bumps on the same coarse tick — issue #474); anything
+ * else falls back to a content hash, which stays the source of truth. When
+ * the bytes match despite a stat change (same-content rewrite) the cached
+ * stat fields are refreshed in place so the next check can take the fast path.
+ */
+function fingerprintMatchesCurrent(path, cached) {
+    let stats;
+    try {
+        stats = statSync(path);
+    }
+    catch {
+        return false;
+    }
+    if (cached.mtimeMs === stats.mtimeMs &&
+        cached.size === stats.size &&
+        Date.now() - stats.mtimeMs > ACTIVE_SYNC_MTIME_SETTLE_MS) {
+        return true;
+    }
+    let contentHash;
+    try {
+        contentHash = hashStorageBytes(readFileSync(path));
+    }
+    catch {
+        return false;
+    }
+    if (contentHash !== cached.contentHash) {
+        return false;
+    }
+    cached.mtimeMs = stats.mtimeMs;
+    cached.size = stats.size;
+    return true;
+}
+/**
+ * Returns true only when the whole synced state is unchanged: the on-disk
+ * accounts file is byte-identical to the one we last mirrored AND every Codex
+ * CLI mirror file still matches what our write left behind. The mirror side is
+ * what lets the post-forward call keep working — a forwarded `codex login`
+ * rewrites auth.json without touching the accounts file, so an input-only
+ * check would skip the very pass that re-asserts the canonical selection.
+ */
+function isActiveSelectionSyncCurrent(storagePath) {
+    if (typeof storagePath !== "string" || storagePath.length === 0) {
+        return false;
+    }
+    if (!existsSync(storagePath)) {
+        ACTIVE_SYNC_FINGERPRINTS.delete(storagePath);
+        return false;
+    }
+    const cached = ACTIVE_SYNC_FINGERPRINTS.get(storagePath);
+    if (!cached) {
+        return false;
+    }
+    if (!fingerprintMatchesCurrent(storagePath, cached.storage)) {
+        return false;
+    }
+    const mirrorPaths = codexCliMirrorPaths();
+    if (mirrorPaths.length !== cached.mirror.size) {
+        return false;
+    }
+    for (const path of mirrorPaths) {
+        const expected = cached.mirror.get(path);
+        if (expected === undefined) {
+            // Mirror path set changed between calls (env override moved).
+            return false;
+        }
+        if (expected === null) {
+            // Recorded as absent — e.g. `codex logout` deleted it. Any file now
+            // present is drift the sync pass must reconcile.
+            if (existsSync(path)) {
+                return false;
+            }
+            continue;
+        }
+        if (!fingerprintMatchesCurrent(path, expected)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Cache the synced state, but only when the bytes on disk are still the exact
+ * bytes this pass mirrored (`syncedContentHash`). A concurrent switch or
+ * migration landing between our load and this record would otherwise leave the
+ * cache describing file content the mirror never saw, and the next call would
+ * skip the sync that corrects it. Mirror outputs are fingerprinted the same
+ * way; an output that existed before this pass (`preMirrorFingerprints`) or
+ * that the writer must have produced (`requiredMirrorPaths`) but is now absent
+ * means the mirror was torn down mid-pass — that state is never blessed.
+ */
+function recordActiveSelectionSync(storagePath, syncedContentHash, preMirrorFingerprints, requiredMirrorPaths) {
+    const storage = statFingerprint(storagePath);
+    if (!storage || storage.contentHash !== syncedContentHash) {
+        ACTIVE_SYNC_FINGERPRINTS.delete(storagePath);
+        return;
+    }
+    const mirror = new Map();
+    for (const path of codexCliMirrorPaths()) {
+        const fingerprint = statFingerprint(path);
+        const fingerprintBeforePass = preMirrorFingerprints.get(path);
+        const existedBeforePass = fingerprintBeforePass !== undefined && fingerprintBeforePass !== null;
+        if (fingerprint === null &&
+            (existedBeforePass || requiredMirrorPaths.has(path))) {
+            ACTIVE_SYNC_FINGERPRINTS.delete(storagePath);
+            return;
+        }
+        mirror.set(path, fingerprint);
+    }
+    ACTIVE_SYNC_FINGERPRINTS.set(storagePath, { storage, mirror });
+}
+/**
+ * Test-only: clear the storage-fingerprint cache so each test re-reads from
+ * disk instead of inheriting a previous scenario's "already synced" state.
+ */
+export function resetActiveAccountSyncMetaForTests() {
+    ACTIVE_SYNC_FINGERPRINTS.clear();
+}
+export async function autoSyncActiveAccountToCodex() {
+    setStoragePath(null);
+    // Fast path: the wrapper calls this before AND after every forwarded
+    // command — skip the load/refresh/write pass when neither the canonical
+    // accounts file nor the mirror files the last pass produced have moved.
+    // Only ever recorded after a successful mirror write over the fingerprinted
+    // bytes, so a transient refresh failure, a torn mirror, or a mid-pass
+    // mutation is retried on the next call.
+    const storagePath = getStoragePath();
+    if (isActiveSelectionSyncCurrent(storagePath)) {
+        return true;
+    }
+    // Snapshot the inputs before loading: the record step only caches when the
+    // file at record time is byte-identical to what this pass mirrored, so a
+    // concurrent switch landing mid-pass can never produce a cache entry that
+    // claims the mirror reflects content it does not.
+    const prePassFingerprint = statFingerprint(storagePath);
+    const preMirrorFingerprints = statFingerprints(codexCliMirrorPaths());
+    const storage = await loadAccounts();
+    if (!storage || storage.accounts.length === 0) {
+        return false;
+    }
+    const activeIndex = resolveActiveIndex(storage, "codex");
+    if (activeIndex < 0 || activeIndex >= storage.accounts.length) {
+        return false;
+    }
+    const account = storage.accounts[activeIndex];
+    if (!account) {
+        return false;
+    }
+    const accountMatch = {
+        accountId: account.accountId,
+        email: account.email,
+        refreshToken: account.refreshToken,
+    };
+    const now = Date.now();
+    let syncAccessToken = account.accessToken;
+    let syncRefreshToken = account.refreshToken;
+    let syncExpiresAt = account.expiresAt;
+    let syncIdToken;
+    let syncEmail = account.email;
+    let changed = false;
+    let nextStoredAccount = null;
+    let selectionDrifted = false;
+    if (!hasUsableAccessToken(account, now)) {
+        const refreshResult = await queuedRefresh(account.refreshToken);
+        if (refreshResult.type !== "success") {
+            return false;
+        }
+        nextStoredAccount = structuredClone(account);
+        const tokenAccountId = extractAccountId(refreshResult.access);
+        const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
+        if (nextStoredAccount.refreshToken !== refreshResult.refresh) {
+            nextStoredAccount.refreshToken = refreshResult.refresh;
+            changed = true;
+        }
+        if (nextStoredAccount.accessToken !== refreshResult.access) {
+            nextStoredAccount.accessToken = refreshResult.access;
+            changed = true;
+        }
+        if (nextStoredAccount.expiresAt !== refreshResult.expires) {
+            nextStoredAccount.expiresAt = refreshResult.expires;
+            changed = true;
+        }
+        if (nextEmail && nextEmail !== nextStoredAccount.email) {
+            nextStoredAccount.email = nextEmail;
+            changed = true;
+        }
+        if (applyTokenAccountIdentity(nextStoredAccount, tokenAccountId)) {
+            changed = true;
+        }
+        syncAccessToken = refreshResult.access;
+        syncRefreshToken = refreshResult.refresh;
+        syncExpiresAt = refreshResult.expires;
+        syncIdToken = refreshResult.idToken;
+        syncEmail = nextStoredAccount.email;
+    }
+    let persistedFingerprint = null;
+    if (changed && nextStoredAccount) {
+        let persisted = false;
+        persistedFingerprint = await withAccountStorageTransaction(async (loadedStorage, persist) => {
+            if (!loadedStorage) {
+                return null;
+            }
+            const nextStorage = structuredClone(loadedStorage);
+            const targetIndex = findMatchingAccountIndex(nextStorage.accounts, accountMatch, {
+                allowUniqueAccountIdFallbackWithoutEmail: true,
+            }) ??
+                findMatchingAccountIndex(nextStorage.accounts, nextStoredAccount, {
+                    allowUniqueAccountIdFallbackWithoutEmail: true,
+                });
+            if (targetIndex === undefined) {
+                return null;
+            }
+            // This under-lock re-read is the first point that sees a selection a
+            // concurrent process may have switched to since our loadAccounts().
+            // Persisting the refreshed tokens is still correct, but the mirror
+            // write below would re-select the stale account — skip it and let
+            // the next call mirror the selection that won the race.
+            if (resolveActiveIndex(nextStorage, "codex") !== targetIndex) {
+                selectionDrifted = true;
+            }
+            nextStorage.accounts[targetIndex] = structuredClone(nextStoredAccount);
+            await persist(nextStorage);
+            persisted = true;
+            // Still inside the file lock: this fingerprint is provably the exact
+            // bytes this pass persisted, i.e. what the mirror is built from.
+            return statFingerprint(storagePath);
+        });
+        if (!persisted) {
+            return false;
+        }
+    }
+    if (selectionDrifted) {
+        ACTIVE_SYNC_FINGERPRINTS.delete(storagePath);
+        return false;
+    }
+    // The mirrored selection is derived from `baseContentHash` bytes: the
+    // pre-pass content when storage was untouched, or the under-lock post-persist
+    // content when this pass refreshed tokens. If the file moved past that in
+    // between (concurrent switch, restore, migration), writing the mirror now
+    // would re-select a stale account — skip it and keep the cache cold so the
+    // next call re-reads and corrects.
+    const baseContentHash = changed
+        ? (persistedFingerprint?.contentHash ?? null)
+        : (prePassFingerprint?.contentHash ?? null);
+    const liveFingerprint = statFingerprint(storagePath);
+    if ((liveFingerprint?.contentHash ?? null) !== baseContentHash) {
+        ACTIVE_SYNC_FINGERPRINTS.delete(storagePath);
+        return false;
+    }
+    const synced = await setCodexCliActiveSelection({
+        accountId: codexCliAccountIdFor(nextStoredAccount ?? account, syncAccessToken, syncIdToken),
+        email: syncEmail,
+        accessToken: syncAccessToken,
+        refreshToken: syncRefreshToken,
+        expiresAt: syncExpiresAt,
+        ...(syncIdToken ? { idToken: syncIdToken } : {}),
+    });
+    if (synced) {
+        // The writer always (re)writes auth.json when the selection carries a
+        // token pair; treat its disappearance before the record as a torn
+        // mirror rather than a cacheable "absent" state.
+        const requiredMirrorPaths = new Set();
+        if (typeof syncAccessToken === "string" &&
+            syncAccessToken.trim().length > 0 &&
+            typeof syncRefreshToken === "string" &&
+            syncRefreshToken.trim().length > 0) {
+            requiredMirrorPaths.add(getCodexCliAuthPath());
+        }
+        recordActiveSelectionSync(storagePath, baseContentHash, preMirrorFingerprints, requiredMirrorPaths);
+    }
+    return synced;
+}

package/dist/lib/codex-manager/api-login-menu.d.ts

@@ -11,4 +11,3 @@ interface MenuDeps {
 }
 export declare function runApiLoginMenu(overrides?: Partial<MenuDeps>): Promise<number>;
 export {};
-//# sourceMappingURL=api-login-menu.d.ts.map

package/dist/lib/codex-manager/backend-category-entry.d.ts

@@ -100,4 +100,3 @@ export declare function promptBackendCategorySettingsEntry(params: {
     draft: PluginConfig;
     focusKey: BackendSettingFocusKey;
 }>;
-//# sourceMappingURL=backend-category-entry.d.ts.map

package/dist/lib/codex-manager/backend-category-helpers.d.ts

@@ -7,4 +7,3 @@ export declare function applyBackendCategoryDefaults(draft: PluginConfig, catego
     backendDefaults: PluginConfig;
     numberOptionByKey: ReadonlyMap<BackendNumberSettingKey, BackendNumberSettingOption>;
 }): PluginConfig;
-//# sourceMappingURL=backend-category-helpers.d.ts.map

package/dist/lib/codex-manager/backend-category-prompt.d.ts

@@ -52,4 +52,3 @@ export declare function promptBackendCategorySettingsMenu(params: {
     draft: PluginConfig;
     focusKey: BackendSettingFocusKey;
 }>;
-//# sourceMappingURL=backend-category-prompt.d.ts.map

package/dist/lib/codex-manager/backend-settings-controller.d.ts

@@ -8,4 +8,3 @@ export declare function configureBackendSettingsController(currentConfig: Plugin
     isInteractive: () => boolean;
     writeLine: (message: string) => void;
 }): Promise<PluginConfig>;
-//# sourceMappingURL=backend-settings-controller.d.ts.map

package/dist/lib/codex-manager/backend-settings-entry.d.ts

@@ -17,4 +17,3 @@ export declare function configureBackendSettingsEntry(currentConfig: PluginConfi
     isInteractive: () => boolean;
     writeLine: (message: string) => void;
 }): Promise<PluginConfig>;
-//# sourceMappingURL=backend-settings-entry.d.ts.map

package/dist/lib/codex-manager/backend-settings-helpers.d.ts

@@ -12,4 +12,3 @@ export declare function buildBackendSettingsPreview(config: PluginConfig, ui: Re
 };
 export declare function buildBackendConfigPatch(config: PluginConfig): Partial<PluginConfig>;
 export declare function clampBackendNumberForTests(settingKey: string, value: number): number;
-//# sourceMappingURL=backend-settings-helpers.d.ts.map

package/dist/lib/codex-manager/backend-settings-prompt.d.ts

@@ -46,4 +46,3 @@ export declare function promptBackendSettingsMenu(params: {
         backendHelp: string;
     };
 }): Promise<PluginConfig | null>;
-//# sourceMappingURL=backend-settings-prompt.d.ts.map

package/dist/lib/codex-manager/backend-settings-schema.d.ts

@@ -70,4 +70,3 @@ export declare const BACKEND_CATEGORY_OPTIONS: BackendCategoryOption[];
 export declare const BACKEND_DEFAULTS: PluginConfig;
 export declare const BACKEND_TOGGLE_OPTION_BY_KEY: Map<BackendToggleSettingKey, BackendToggleSettingOption>;
 export declare const BACKEND_NUMBER_OPTION_BY_KEY: Map<BackendNumberSettingKey, BackendNumberSettingOption>;
-//# sourceMappingURL=backend-settings-schema.d.ts.map

package/dist/lib/codex-manager/behavior-settings-panel.d.ts

@@ -11,4 +11,3 @@ export interface BehaviorSettingsPanelDeps {
     UI_COPY: typeof UI_COPY;
 }
 export declare function promptBehaviorSettingsPanel(initial: DashboardDisplaySettings, deps: BehaviorSettingsPanelDeps): Promise<DashboardDisplaySettings | null>;
-//# sourceMappingURL=behavior-settings-panel.d.ts.map

package/dist/lib/codex-manager/commands/account.d.ts

@@ -1,13 +1,18 @@
-import { loadAccountPolicyStore, saveAccountPolicyStore } from "../../account-policy.js";
+import { loadAccountPolicyStore, updateAccountPolicyStore } from "../../account-policy.js";
 import type { AccountStorageV3 } from "../../storage.js";
 export interface AccountCommandDeps {
     setStoragePath: (path: string | null) => void;
     loadAccounts: () => Promise<AccountStorageV3 | null>;
     loadPolicyStore?: typeof loadAccountPolicyStore;
-    savePolicyStore?: typeof saveAccountPolicyStore;
+    /**
+     * Mutation seam: each mutation re-applies under the cross-process lock
+     * against the freshest store, so concurrent commands editing different
+     * fields of the same policy both land. Defaults to the real
+     * updateAccountPolicyStore.
+     */
+    updatePolicyStore?: typeof updateAccountPolicyStore;
     logInfo?: (message: string) => void;
     logError?: (message: string) => void;
     getNow?: () => number;
 }
 export declare function runAccountCommand(args: string[], deps: AccountCommandDeps): Promise<number>;
-//# sourceMappingURL=account.d.ts.map

package/dist/lib/codex-manager/commands/account.js

@@ -1,4 +1,4 @@
-import { getAccountPolicyKey, loadAccountPolicyStore, normalizeAccountPolicyTag, saveAccountPolicyStore, upsertAccountPolicy, } from "../../account-policy.js";
+import { getAccountPolicyKey, loadAccountPolicyStore, normalizeAccountPolicyTag, updateAccountPolicyStore, upsertAccountPolicy, } from "../../account-policy.js";
 function printAccountUsage(logInfo) {
     logInfo([
         "Usage:",
@@ -54,9 +54,9 @@ export async function runAccountCommand(args, deps) {
     deps.setStoragePath(null);
     const storage = await deps.loadAccounts();
     const loadStore = deps.loadPolicyStore ?? loadAccountPolicyStore;
-    const saveStore = deps.savePolicyStore ?? saveAccountPolicyStore;
-    const store = await loadStore();
+    const updateStore = deps.updatePolicyStore ?? updateAccountPolicyStore;
     if (command === "policy") {
+        const store = await loadStore();
         const [subcommand, ...policyArgs] = rest;
         if (subcommand !== "list") {
             logError(`Unknown account policy command: ${subcommand ?? "(missing)"}`);
@@ -107,14 +107,16 @@ export async function runAccountCommand(args, deps) {
             logError(`${command} requires a tag value.`);
             return 1;
         }
-        const policy = upsertAccountPolicy(store, accountKey, (next) => {
-            if (command === "tag" && !next.tags.includes(tag))
-                next.tags.push(tag);
-            if (command === "untag") {
-                next.tags = next.tags.filter((existing) => existing !== tag);
-            }
-        }, now);
-        await saveStore(store);
+        const policy = await updateStore((store) => ({
+            result: upsertAccountPolicy(store, accountKey, (next) => {
+                if (command === "tag" && !next.tags.includes(tag))
+                    next.tags.push(tag);
+                if (command === "untag") {
+                    next.tags = next.tags.filter((existing) => existing !== tag);
+                }
+            }, now),
+            dirty: true,
+        }));
         logInfo(`${command === "tag" ? "Tagged" : "Removed tag from"} account ${resolved.index + 1}: ${policy.tags.join(",") || "none"}`);
         return 0;
     }
@@ -123,8 +125,10 @@ export async function runAccountCommand(args, deps) {
             logError("auto-prime requires on or off.");
             return 1;
         }
-        upsertAccountPolicy(store, accountKey, next => { next.autoPrime = rest[1] === "on"; }, now);
-        await saveStore(store);
+        await updateStore((store) => ({
+            result: upsertAccountPolicy(store, accountKey, next => { next.autoPrime = rest[1] === "on"; }, now),
+            dirty: true,
+        }));
         logInfo(`Automatic priming ${rest[1]} for account ${resolved.index + 1}. ${rest[1] === "on" ? "The running router checks every 15 minutes; first-use completion consumes subscription quota." : "Future automatic checks are disabled."}`);
         return 0;
     }
@@ -134,8 +138,10 @@ export async function runAccountCommand(args, deps) {
             return 1;
         }
         const priority = Number(rest[1]);
-        upsertAccountPolicy(store, accountKey, next => { next.priority = priority; }, now);
-        await saveStore(store);
+        await updateStore((store) => ({
+            result: upsertAccountPolicy(store, accountKey, next => { next.priority = priority; }, now),
+            dirty: true,
+        }));
         logInfo(`Set account ${resolved.index + 1} priority to ${priority}.`);
         return 0;
     }
@@ -145,34 +151,40 @@ export async function runAccountCommand(args, deps) {
             logError("weight requires a number from 0 to 10.");
             return 1;
         }
-        upsertAccountPolicy(store, accountKey, (next) => {
-            next.weight = weight;
-        }, now);
-        await saveStore(store);
+        await updateStore((store) => ({
+            result: upsertAccountPolicy(store, accountKey, (next) => {
+                next.weight = weight;
+            }, now),
+            dirty: true,
+        }));
         logInfo(`Set account ${resolved.index + 1} weight to ${weight}.`);
         return 0;
     }
     if (["pause", "unpause", "drain", "undrain"].includes(command)) {
-        upsertAccountPolicy(store, accountKey, (next) => {
-            if (command === "pause")
-                next.paused = true;
-            if (command === "unpause")
-                next.paused = false;
-            if (command === "drain")
-                next.drained = true;
-            if (command === "undrain")
-                next.drained = false;
-        }, now);
-        await saveStore(store);
+        await updateStore((store) => ({
+            result: upsertAccountPolicy(store, accountKey, (next) => {
+                if (command === "pause")
+                    next.paused = true;
+                if (command === "unpause")
+                    next.paused = false;
+                if (command === "drain")
+                    next.drained = true;
+                if (command === "undrain")
+                    next.drained = false;
+            }, now),
+            dirty: true,
+        }));
         logInfo(`Updated account ${resolved.index + 1}: ${command}.`);
         return 0;
     }
     if (command === "note") {
         const note = rest.slice(1).join(" ").trim();
-        upsertAccountPolicy(store, accountKey, (next) => {
-            next.note = note.length > 0 ? note.slice(0, 500) : null;
-        }, now);
-        await saveStore(store);
+        await updateStore((store) => ({
+            result: upsertAccountPolicy(store, accountKey, (next) => {
+                next.note = note.length > 0 ? note.slice(0, 500) : null;
+            }, now),
+            dirty: true,
+        }));
         logInfo(`Updated account ${resolved.index + 1} note.`);
         return 0;
     }

package/dist/lib/codex-manager/commands/best.d.ts

@@ -92,4 +92,3 @@ export interface BestCommandDeps {
 }
 export declare function runBestCommand(args: string[], deps: BestCommandDeps): Promise<number>;
 export {};
-//# sourceMappingURL=best.d.ts.map

package/dist/lib/codex-manager/commands/bridge.d.ts

@@ -3,4 +3,3 @@ export interface BridgeCommandDeps {
     logError?: (message: string) => void;
 }
 export declare function runBridgeCommand(args: string[], deps?: BridgeCommandDeps): Promise<number>;
-//# sourceMappingURL=bridge.d.ts.map

package/dist/lib/codex-manager/commands/budget.d.ts

@@ -1,12 +1,17 @@
-import { loadBudgetGuardStore, saveBudgetGuardStore } from "../../budget-guard.js";
+import { loadBudgetGuardStore, updateBudgetGuardStore } from "../../budget-guard.js";
 import { summarizeUsageLedger } from "../../usage/index.js";
 export interface BudgetCommandDeps {
     loadStore?: typeof loadBudgetGuardStore;
-    saveStore?: typeof saveBudgetGuardStore;
+    /**
+     * Mutation seam: each mutation re-applies under the cross-process lock
+     * against the freshest store, so a concurrent `budget limit` on the same
+     * key is not silently dropped by the whole-record timestamp merge.
+     * Defaults to the real updateBudgetGuardStore.
+     */
+    updateStore?: typeof updateBudgetGuardStore;
     summarizeUsage?: typeof summarizeUsageLedger;
     logInfo?: (message: string) => void;
     logError?: (message: string) => void;
     getNow?: () => number;
 }
 export declare function runBudgetCommand(args: string[], deps?: BudgetCommandDeps): Promise<number>;
-//# sourceMappingURL=budget.d.ts.map

package/dist/lib/codex-manager/commands/budget.js

@@ -1,4 +1,4 @@
-import { evaluateBudgetGuard, getBudgetWindowStart, loadBudgetGuardStore, normalizeBudgetKey, saveBudgetGuardStore, upsertBudgetLimit, } from "../../budget-guard.js";
+import { evaluateBudgetGuard, getBudgetWindowStart, loadBudgetGuardStore, normalizeBudgetKey, updateBudgetGuardStore, upsertBudgetLimit, } from "../../budget-guard.js";
 import { summarizeUsageLedger } from "../../usage/index.js";
 const VALID_WINDOWS = new Set(["hour", "day", "week", "month"]);
 function printBudgetUsage(logInfo) {
@@ -24,7 +24,7 @@ export async function runBudgetCommand(args, deps = {}) {
         return 0;
     }
     const loadStore = deps.loadStore ?? loadBudgetGuardStore;
-    const saveStore = deps.saveStore ?? saveBudgetGuardStore;
+    const updateStore = deps.updateStore ?? updateBudgetGuardStore;
     const store = await loadStore();
     const now = deps.getNow?.() ?? Date.now();
     if (command === "list") {
@@ -91,8 +91,10 @@ export async function runBudgetCommand(args, deps = {}) {
             logError("At least one of --requests, --tokens, or --cost is required.");
             return 1;
         }
-        const limit = upsertBudgetLimit(store, { key, window, maxRequests, maxTokens, maxCostUsd }, now);
-        await saveStore(store);
+        const limit = await updateStore((store) => ({
+            result: upsertBudgetLimit(store, { key, window, maxRequests, maxTokens, maxCostUsd }, now),
+            dirty: true,
+        }));
         logInfo(`Saved budget limit ${limit.key} (${limit.window}).`);
         return 0;
     }

package/dist/lib/codex-manager/commands/check.d.ts

@@ -10,4 +10,3 @@ export interface CheckCommandDeps {
     logError?: (message: string) => void;
 }
 export declare function runCheckCommand(deps: CheckCommandDeps, args?: string[]): Promise<number>;
-//# sourceMappingURL=check.d.ts.map

package/dist/lib/codex-manager/commands/config-explain.d.ts

@@ -4,4 +4,3 @@ export declare function runConfigExplainCommand(args: string[], deps: {
     logInfo?: (message: string) => void;
     logError?: (message: string) => void;
 }): number;
-//# sourceMappingURL=config-explain.d.ts.map

package/dist/lib/codex-manager/commands/debug-bundle.d.ts

@@ -41,4 +41,3 @@ export declare function runDebugBundleCommand(args: string[], deps: {
     logInfo?: (message: string) => void;
     logError?: (message: string) => void;
 }): Promise<number>;
-//# sourceMappingURL=debug-bundle.d.ts.map

package/dist/lib/codex-manager/commands/forecast.d.ts

@@ -17,7 +17,7 @@ export interface ForecastCommandDeps {
     loadDashboardDisplaySettings?: () => Promise<DashboardDisplaySettings>;
     resolveActiveIndex: (storage: AccountStorageV3, family?: "codex") => number;
     loadQuotaCache: () => Promise<QuotaCacheData | null>;
-    saveQuotaCache: (cache: QuotaCacheData) => Promise<void>;
+    saveQuotaCache: (cache: QuotaCacheData, baseline?: QuotaCacheData) => Promise<void>;
     cloneQuotaCacheData: (cache: QuotaCacheData) => QuotaCacheData;
     buildQuotaEmailFallbackState: (accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[]) => QuotaEmailFallbackState;
     updateQuotaCacheForAccount: (cache: QuotaCacheData, account: Pick<AccountMetadataV3, "accountId" | "email">, snapshot: CodexQuotaSnapshot, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], emailFallbackState?: QuotaEmailFallbackState) => boolean;
@@ -75,4 +75,3 @@ export declare function runForecastCommand(args: string[], deps: ForecastCommand
     formatQuotaSnapshotLine: (snapshot: CodexQuotaSnapshot) => string;
 }): Promise<number>;
 export {};
-//# sourceMappingURL=forecast.d.ts.map