codex-multi-auth 2.17.2 → 2.17.3

package/dist/lib/config.js

@@ -1,6 +1,5 @@
 import { existsSync, promises as fs, readFileSync } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { parseBooleanEnv } from "./env-parsing.js";
 import { stripModelEffortSuffix } from "./constants.js";
 import { withRetry, withRetrySync } from "./fs-retry.js";
@@ -8,8 +7,8 @@ import { logWarn } from "./logger.js";
 import { StorageError } from "./errors.js";
 import { getCodexHomeDir, getCodexMultiAuthDir, getLegacyCodexDir, } from "./runtime-paths.js";
 import { getValidationErrors, PluginConfigSchema } from "./schemas.js";
+import { getJsonStoreFileMtimeMs, withJsonStoreCasRetry, withJsonStoreFileLock, withJsonStoreWriteQueue, writeJsonStoreFileAtomicWithRetry, } from "./storage/json-store-lock.js";
 import { getUnifiedSettingsPath, loadUnifiedPluginConfigSync, saveUnifiedPluginConfig, } from "./unified-settings.js";
-import { tempPathFor } from "./temp-path.js";
 const CONFIG_DIR = getCodexMultiAuthDir();
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 const CODEX_HOME_DIR = getCodexHomeDir();
@@ -23,8 +22,6 @@ const TUI_COLOR_PROFILES = new Set(["truecolor", "ansi16", "ansi256"]);
 const TUI_GLYPH_MODES = new Set(["ascii", "unicode", "auto"]);
 const UNSUPPORTED_CODEX_POLICIES = new Set(["strict", "fallback"]);
 const emittedConfigWarnings = new Set();
-const configSaveQueues = new Map();
-const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
 const RETRYABLE_CONFIG_READ_CODES = new Set(["EBUSY", "EPERM", "EAGAIN"]);
 /**
  * Synchronous readFileSync with bounded retry on transient FS-lock codes.
@@ -330,212 +327,14 @@ function stripUtf8Bom(content) {
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function getConfigFileMtimeMs(filePath) {
-    // config-08: the mtime CAS preflight (and savePluginConfig's env-path branch)
-    // run on the Windows-sensitive save path, where a transient EBUSY/EPERM/EAGAIN
-    // from an AV/indexer lock on a single fs.stat would abort the entire save.
-    // Mirror readConfigRecordForSave's bounded transient-FS retry (same code set,
-    // same backoff, 5 attempts). ENOENT still returns null immediately. On
-    // exhaustion the last failure surfaces so the caller treats it as a real
-    // save error rather than a phantom missing file.
-    return withRetry(async () => {
-        try {
-            return (await fs.stat(filePath)).mtimeMs;
-        }
-        catch (error) {
-            if (error?.code === "ENOENT") {
-                return null;
-            }
-            throw error;
-        }
-    }, {
-        maxAttempts: 5,
-        backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
-        retryableCodes: RETRYABLE_CONFIG_READ_CODES,
-    });
-}
-async function writeJsonFileAtomicWithRetry(filePath, payload, options) {
-    const tempPath = tempPathFor(filePath);
-    await fs.mkdir(dirname(filePath), { recursive: true });
-    await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
-    let renamed = false;
-    try {
-        // Compare-and-swap guard: if a concurrent writer changed the target file
-        // since the caller read it (mtime mismatch), abort with ESTALE so the
-        // caller can re-read and merge instead of clobbering the other write.
-        if (options && "expectedMtimeMs" in options) {
-            const currentMtimeMs = await getConfigFileMtimeMs(filePath);
-            if (currentMtimeMs !== options.expectedMtimeMs) {
-                const staleError = new Error(`Config at ${filePath} changed on disk during save; retrying with latest state.`);
-                staleError.code = "ESTALE";
-                throw staleError;
-            }
-        }
-        await withRetry(() => fs.rename(tempPath, filePath), {
-            maxAttempts: 5,
-            backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
-            retryableCodes: RETRYABLE_FS_CODES,
-        });
-        renamed = true;
-    }
-    finally {
-        if (!renamed) {
-            try {
-                await fs.unlink(tempPath);
-            }
-            catch {
-                // Best-effort temp cleanup.
-            }
-        }
-    }
-}
-async function withConfigSaveLock(path, task) {
-    const previous = configSaveQueues.get(path) ?? Promise.resolve();
-    const queued = previous.catch(() => { }).then(task);
-    configSaveQueues.set(path, queued);
-    try {
-        await queued;
-    }
-    finally {
-        if (configSaveQueues.get(path) === queued) {
-            configSaveQueues.delete(path);
-        }
-    }
-}
-// Cross-process config-save lock. withConfigSaveLock only serializes saves
-// within THIS process (a per-path promise queue); it does nothing against a
-// second process. The mtime CAS in writeJsonFileAtomicWithRetry narrows but does
-// not close the read→check→merge→rename TOCTOU window (another process can still
-// land a write between the CAS stat and the rename). This file lock provides the
-// cross-process mutual exclusion that closes that window. It deliberately mirrors
-// RefreshLeaseCoordinator (lib/refresh-lease.ts): exclusive `wx` lockfile create,
-// JSON payload carrying pid + expiry, stale-takeover via expiry/mtime, and a
-// best-effort retrying release in a finally. The mtime CAS stays as a second-line
-// guard for any non-participating writer.
-const CONFIG_LOCK_TTL_MS = 10_000;
-const CONFIG_LOCK_WAIT_TIMEOUT_MS = 10_000;
-const CONFIG_LOCK_POLL_MS = 50;
-async function unlinkConfigLockWithRetry(lockPath) {
-    try {
-        await withRetry(() => fs.unlink(lockPath), {
-            maxAttempts: 5,
-            backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
-            retryableCodes: RETRYABLE_FS_CODES,
-        });
-    }
-    catch {
-        // ENOENT (already released) or best-effort release failure: a leftover
-        // lockfile is recovered as stale by the next acquirer via its
-        // expiry/mtime, so never fail the save over this.
-    }
-}
-// Owner-safe release: only unlink the lockfile if it still carries OUR owner
-// token. If a slow save was deemed stale and a second process stole the lock,
-// the lockfile now holds the new owner's token — deleting it would reopen
-// concurrent saves, so we leave it alone.
-async function releaseConfigLockIfOwner(lockPath, owner) {
-    try {
-        const content = await fs.readFile(lockPath, "utf-8");
-        const parsed = JSON.parse(stripUtf8Bom(content));
-        if (parsed?.owner && parsed.owner !== owner) {
-            // Lock was taken over by another holder; do not delete their lock.
-            return;
-        }
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT")
-            return;
-        // Unreadable/malformed: fall through and attempt our best-effort unlink.
-    }
-    await unlinkConfigLockWithRetry(lockPath);
-}
-async function isConfigLockStale(lockPath) {
-    try {
-        const content = await fs.readFile(lockPath, "utf-8");
-        const parsed = JSON.parse(stripUtf8Bom(content));
-        if (typeof parsed?.expiresAt === "number" &&
-            Number.isFinite(parsed.expiresAt)) {
-            return parsed.expiresAt <= Date.now();
-        }
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT")
-            return true;
-        // Unreadable/malformed payload: fall through to the mtime heuristic.
-    }
-    try {
-        const stat = await fs.stat(lockPath);
-        return Date.now() - stat.mtimeMs > CONFIG_LOCK_TTL_MS;
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT")
-            return true;
-        return false;
-    }
-}
-async function withConfigFileLock(targetPath, task) {
-    const lockPath = `${targetPath}.lock`;
-    const owner = randomUUID();
-    await fs.mkdir(dirname(lockPath), { recursive: true });
-    const deadline = Date.now() + CONFIG_LOCK_WAIT_TIMEOUT_MS;
-    let acquired = false;
-    while (!acquired) {
-        try {
-            const now = Date.now();
-            const payload = {
-                pid: process.pid,
-                owner,
-                acquiredAt: now,
-                expiresAt: now + CONFIG_LOCK_TTL_MS,
-            };
-            const handle = await fs.open(lockPath, "wx", 0o600);
-            try {
-                await handle.writeFile(`${JSON.stringify(payload)}\n`, "utf8");
-            }
-            finally {
-                await handle.close();
-            }
-            acquired = true;
-        }
-        catch (error) {
-            const code = error?.code;
-            if (code !== "EEXIST") {
-                // A transient FS lock on the lockfile itself: retry until the deadline,
-                // matching the bounded backoff used elsewhere on the Windows save path.
-                if (typeof code === "string" &&
-                    RETRYABLE_FS_CODES.has(code) &&
-                    Date.now() < deadline) {
-                    await sleep(CONFIG_LOCK_POLL_MS);
-                    continue;
-                }
-                throw error;
-            }
-            // Lock is held. Take it over if the holder expired/crashed; otherwise wait.
-            if (await isConfigLockStale(lockPath)) {
-                await unlinkConfigLockWithRetry(lockPath);
-                continue;
-            }
-            if (Date.now() >= deadline) {
-                const timeoutError = new Error(`Timed out acquiring config save lock at ${lockPath}.`);
-                timeoutError.code = "ELOCKTIMEOUT";
-                throw timeoutError;
-            }
-            await sleep(CONFIG_LOCK_POLL_MS);
-        }
-    }
-    try {
-        return await task();
-    }
-    finally {
-        await releaseConfigLockIfOwner(lockPath, owner);
-    }
-}
+// Cross-process save safety lives in lib/storage/json-store-lock.ts:
+// withJsonStoreWriteQueue (per-path in-process queue), withJsonStoreFileLock
+// (candidate-directory lock + dead-owner recovery), and the mtime CAS
+// trio (getJsonStoreFileMtimeMs / writeJsonStoreFileAtomicWithRetry /
+// withJsonStoreCasRetry). The file lock provides the cross-process mutual
+// exclusion that closes the read→check→merge→rename TOCTOU window against
+// OTHER processes; the mtime CAS stays on as a second-line guard for any
+// non-participating writer.
 /**
  * Read and parse a JSON configuration file and return its top-level object when present and valid.
  *
@@ -718,19 +517,19 @@ export async function savePluginConfig(configPatch) {
     }
     const envPath = (process.env.CODEX_MULTI_AUTH_CONFIG_PATH ?? "").trim();
     if (envPath.length > 0) {
-        await withConfigSaveLock(envPath, async () => {
+        await withJsonStoreWriteQueue(envPath, async () => {
             // In-process queue (above) is the cheap fast path; the cross-process file
             // lock (below) closes the read→merge→rename TOCTOU window against OTHER
             // processes. Acquire the file lock for the full critical section, then run
             // the same mtime CAS retry as a second-line guard for any non-participating
             // writer. Mirrors the unified-settings save path (writeSettingsRecordAsync
             // CAS).
-            await withConfigFileLock(envPath, async () => {
+            await withJsonStoreFileLock(envPath, async () => {
                 // CAS retry: ESTALE means the file's mtime moved between our stat and
                 // the write, so each attempt re-stats, re-reads, and re-merges against
                 // the latest on-disk state before writing again.
-                await withRetry(async () => {
-                    const expectedMtimeMs = await getConfigFileMtimeMs(envPath);
+                await withJsonStoreCasRetry(async () => {
+                    const expectedMtimeMs = await getJsonStoreFileMtimeMs(envPath);
                     const envConfigState = await readConfigRecordForSave(envPath);
                     if (envConfigState.status === "unreadable") {
                         throw unreadableConfigSaveError(envPath, envConfigState.errorMessage);
@@ -742,39 +541,45 @@ export async function savePluginConfig(configPatch) {
                         ...(existingConfig ?? {}),
                         ...sanitizedPatch,
                     };
-                    await writeJsonFileAtomicWithRetry(envPath, merged, {
+                    await writeJsonStoreFileAtomicWithRetry(envPath, merged, {
                         expectedMtimeMs,
                     });
-                }, { maxAttempts: 3, backoffMs: 0, retryableCodes: ["ESTALE"] });
+                });
             });
         });
         return;
     }
     const unifiedPath = getUnifiedSettingsPath();
-    await withConfigSaveLock(unifiedPath, async () => {
-        const unifiedConfigState = await readConfigRecordForSave(unifiedPath);
-        if (unifiedConfigState.status === "unreadable") {
-            throw unreadableConfigSaveError(unifiedPath, unifiedConfigState.errorMessage);
-        }
-        const unifiedConfigRecord = unifiedConfigState.status === "ok"
-            ? unifiedConfigState.record.pluginConfig
-            : loadUnifiedPluginConfigSync();
-        const unifiedConfig = sanitizeStoredPluginConfigRecord(unifiedConfigRecord);
-        const legacyPath = unifiedConfig === null ? resolvePluginConfigPath() : null;
-        const legacyConfigState = legacyPath
-            ? await readConfigRecordForSave(legacyPath)
-            : null;
-        if (legacyConfigState?.status === "unreadable") {
-            throw unreadableConfigSaveError(legacyPath, legacyConfigState.errorMessage);
-        }
-        const legacyConfig = legacyConfigState?.status === "ok"
-            ? sanitizeStoredPluginConfigRecord(legacyConfigState.record)
-            : null;
-        const merged = {
-            ...(unifiedConfig ?? legacyConfig ?? {}),
-            ...sanitizedPatch,
-        };
-        await saveUnifiedPluginConfig(merged);
+    await withJsonStoreWriteQueue(unifiedPath, async () => {
+        // Hold the same cross-process lockfile for the read→merge portion, not
+        // just the write: saveUnifiedPluginConfig re-acquires both primitives
+        // re-entrantly inside this critical section, so the merged pluginConfig
+        // cannot interleave with another process's write to the same file.
+        await withJsonStoreFileLock(unifiedPath, async () => {
+            const unifiedConfigState = await readConfigRecordForSave(unifiedPath);
+            if (unifiedConfigState.status === "unreadable") {
+                throw unreadableConfigSaveError(unifiedPath, unifiedConfigState.errorMessage);
+            }
+            const unifiedConfigRecord = unifiedConfigState.status === "ok"
+                ? unifiedConfigState.record.pluginConfig
+                : loadUnifiedPluginConfigSync();
+            const unifiedConfig = sanitizeStoredPluginConfigRecord(unifiedConfigRecord);
+            const legacyPath = unifiedConfig === null ? resolvePluginConfigPath() : null;
+            const legacyConfigState = legacyPath
+                ? await readConfigRecordForSave(legacyPath)
+                : null;
+            if (legacyConfigState?.status === "unreadable") {
+                throw unreadableConfigSaveError(legacyPath, legacyConfigState.errorMessage);
+            }
+            const legacyConfig = legacyConfigState?.status === "ok"
+                ? sanitizeStoredPluginConfigRecord(legacyConfigState.record)
+                : null;
+            const merged = {
+                ...(unifiedConfig ?? legacyConfig ?? {}),
+                ...sanitizedPatch,
+            };
+            await saveUnifiedPluginConfig(merged);
+        });
     });
 }
 function parseNumberEnv(value) {

package/dist/lib/constants.d.ts

@@ -113,4 +113,3 @@ export type WireReasoningEffort = Exclude<ModelReasoningEffort, "ultra">;
  * untouched.
  */
 export declare function stripModelEffortSuffix(modelId: string): string;
-//# sourceMappingURL=constants.d.ts.map

package/dist/lib/context-budget/model-context-windows.d.ts

@@ -22,4 +22,3 @@ export interface EffectiveContextWindow {
  */
 export declare function getEffectiveContextWindow(model: string | null | undefined, overrides: Record<string, number> | undefined): EffectiveContextWindow | null;
 export declare function listEstimatedModelContextWindows(): Record<string, number>;
-//# sourceMappingURL=model-context-windows.d.ts.map

package/dist/lib/context-budget-guard.d.ts

@@ -97,4 +97,3 @@ export declare class ContextBudgetGuard {
     noteHardPauseEmitted(key: string): void;
 }
 export {};
-//# sourceMappingURL=context-budget-guard.d.ts.map

package/dist/lib/context-budget-response.d.ts

@@ -22,4 +22,3 @@ export declare function createContextBudgetPauseResponse(advisory: Extract<Conte
 export declare function buildContextBudgetHeaders(advisory: Extract<ContextBudgetAdvisory, {
     level: "soft" | "hard";
 }>): Record<string, string>;
-//# sourceMappingURL=context-budget-response.d.ts.map

package/dist/lib/context-overflow.d.ts

@@ -29,4 +29,3 @@ export declare function handleContextOverflow(response: Response, model?: string
 } | {
     handled: false;
 }>;
-//# sourceMappingURL=context-overflow.d.ts.map

package/dist/lib/dashboard-settings.d.ts

@@ -87,4 +87,3 @@ export declare function loadDashboardDisplaySettings(): Promise<DashboardDisplay
  */
 export declare function saveDashboardDisplaySettings(settings: DashboardDisplaySettings): Promise<void>;
 export {};
-//# sourceMappingURL=dashboard-settings.d.ts.map

package/dist/lib/entitlement-cache.d.ts

@@ -41,4 +41,3 @@ export declare class EntitlementCache {
     prune(now?: number): number;
     snapshot(now?: number): EntitlementCacheSnapshot;
 }
-//# sourceMappingURL=entitlement-cache.d.ts.map

package/dist/lib/env-parsing.d.ts

@@ -18,4 +18,16 @@
  * @returns `true`/`false` for recognised literals, otherwise `undefined`.
  */
 export declare function parseBooleanEnv(value: string | undefined): boolean | undefined;
-//# sourceMappingURL=env-parsing.d.ts.map
+/**
+ * Parses an integer environment-variable string.
+ *
+ * Returns `undefined` for `undefined` input, an empty/whitespace-only string,
+ * or any value that does not start with a parseable integer — letting callers
+ * fall back through nullish coalescing to their default. Matches the semantics
+ * of the local `parseEnvInt` copies in lib/refresh-lease.ts and
+ * lib/request/failover-config.ts.
+ *
+ * @param value - Raw env-variable value (or `undefined` when unset).
+ * @returns The parsed integer, otherwise `undefined`.
+ */
+export declare function parseIntegerEnv(value: string | undefined): number | undefined;

package/dist/lib/env-parsing.js

@@ -31,3 +31,24 @@ export function parseBooleanEnv(value) {
         return false;
     return undefined;
 }
+/**
+ * Parses an integer environment-variable string.
+ *
+ * Returns `undefined` for `undefined` input, an empty/whitespace-only string,
+ * or any value that does not start with a parseable integer — letting callers
+ * fall back through nullish coalescing to their default. Matches the semantics
+ * of the local `parseEnvInt` copies in lib/refresh-lease.ts and
+ * lib/request/failover-config.ts.
+ *
+ * @param value - Raw env-variable value (or `undefined` when unset).
+ * @returns The parsed integer, otherwise `undefined`.
+ */
+export function parseIntegerEnv(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    if (trimmed.length === 0)
+        return undefined;
+    const parsed = Number.parseInt(trimmed, 10);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}

package/dist/lib/errors.d.ts

@@ -134,4 +134,3 @@ export declare class CodexUnavailableError extends CodexError {
  * boundaries by also matching on the structural `code` marker.
  */
 export declare function isCodexUnavailableError(error: unknown): error is CodexUnavailableError;
-//# sourceMappingURL=errors.d.ts.map

package/dist/lib/forecast.d.ts

@@ -80,4 +80,3 @@ export declare function recommendForecastAccount(results: ForecastAccountResult[
 export declare function summarizeForecast(results: ForecastAccountResult[]): ForecastSummary;
 export declare function buildForecastExplanation(results: ForecastAccountResult[], recommendation: ForecastRecommendation): ForecastExplanation;
 export {};
-//# sourceMappingURL=forecast.d.ts.map

package/dist/lib/fs-retry.d.ts

@@ -47,4 +47,3 @@ export declare function withRetry<T>(operation: () => Promise<T> | T, options: R
  */
 export declare function withRetrySync<T>(operation: () => T, options: RetryOptions): T;
 export declare function withFileOperationRetry<T>(operation: () => Promise<T>): Promise<T>;
-//# sourceMappingURL=fs-retry.d.ts.map

package/dist/lib/health.d.ts

@@ -31,4 +31,3 @@ export declare function getAccountHealth(accounts: Array<{
     lastUsedAt?: number;
 }>, now?: number): PluginHealth;
 export declare function formatHealthReport(health: PluginHealth): string;
-//# sourceMappingURL=health.d.ts.map

package/dist/lib/index.d.ts

@@ -41,4 +41,3 @@ export * from "./local-bridge.js";
 export * from "./local-client-tokens.js";
 export * from "./integration-generators.js";
 export * from "./temp-path.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/integration-generators.d.ts

@@ -11,4 +11,3 @@ export interface IntegrationSnippet {
 }
 export declare function generateIntegrationSnippet(kind: IntegrationSnippetKind, input?: IntegrationSnippetInput): IntegrationSnippet;
 export declare function generateIntegrationSnippets(kinds?: IntegrationSnippetKind[], input?: IntegrationSnippetInput): IntegrationSnippet[];
-//# sourceMappingURL=integration-generators.d.ts.map

package/dist/lib/live-account-sync.d.ts

@@ -36,4 +36,3 @@ export declare class LiveAccountSync {
     private pollOnce;
     private runReload;
 }
-//# sourceMappingURL=live-account-sync.d.ts.map

package/dist/lib/local-bridge.d.ts

@@ -22,4 +22,3 @@ export interface LocalBridgeOptions {
     runtimeClientApiKey?: string;
 }
 export declare function startLocalBridge(options: LocalBridgeOptions): Promise<LocalBridgeServer>;
-//# sourceMappingURL=local-bridge.d.ts.map

package/dist/lib/local-bridge.js

@@ -195,10 +195,13 @@ export async function startLocalBridge(options) {
         throw new Error("Local bridge requires requireAuth=true when runtimeClientApiKey is configured.");
     }
     const app = new Hono();
+    // Deliberately minimal payload: /health is reachable without a bearer (it is
+    // the liveness probe), so it must not echo runtimeBaseUrl back — that value
+    // describes where the bridge forwards local client tokens and is internal
+    // routing detail, not something to hand unauthenticated callers.
     app.get("/health", (context) => context.json({
         ok: true,
         service: "codex-multi-auth-local-bridge",
-        runtimeBaseUrl,
     }));
     const forward = async (request, targetPath) => {
         const startedAt = Date.now();

package/dist/lib/local-client-tokens.d.ts

@@ -34,4 +34,3 @@ export declare function rotateLocalClientToken(input: {
 export declare function revokeLocalClientToken(id: string, now?: number): Promise<boolean>;
 export declare function verifyLocalClientBearerToken(authorizationHeader: string | null, now?: number): Promise<LocalClientTokenRecord | null>;
 export declare function resetLocalClientTokenWriteQueueForTests(): void;
-//# sourceMappingURL=local-client-tokens.d.ts.map