codex-multi-auth 2.17.2 → 2.18.0

package/dist/lib/schemas.js

@@ -202,8 +202,16 @@ export const AccountStorageV3Schema = z.object({
 });
 /**
  * Legacy V1 account metadata for migration support.
+ *
+ * Uses `passthrough` so V3-compatible extra fields (workspaces,
+ * rateLimitResetTimes, authInvalidatedAt, …) survive the schema boundary:
+ * version:1 files with V3-era rows are real (the flagged-accounts store is
+ * `version: 1` with full V3 rows) and migrateV1ToV3 now carries unknown
+ * fields forward — stripping them here would make that preservation a no-op
+ * for every schema-valid file. Same rationale as FlaggedAccountMetadataV1Schema.
  */
-const AccountMetadataV1Schema = z.object({
+const AccountMetadataV1Schema = z
+    .object({
     accountId: z.string().optional(),
     accountIdSource: AccountIdSourceSchema.optional(),
     accountLabel: z.string().optional(),
@@ -218,14 +226,23 @@ const AccountMetadataV1Schema = z.object({
     rateLimitResetTime: z.number().optional(), // V1 used single value
     coolingDownUntil: z.number().optional(),
     cooldownReason: CooldownReasonSchema.optional(),
-});
+})
+    .passthrough();
 /**
  * Legacy V1 storage format for migration support.
+ *
+ * The V3-era top-level fields are accepted too: a hybrid file (version:1 but
+ * written by newer code) must not lose `activeIndexByFamily` /
+ * `pinnedAccountIndex` / `affinityGeneration` at the schema boundary before
+ * normalizeAccountStorage can consume them.
  */
 export const AccountStorageV1Schema = z.object({
     version: z.literal(1),
     accounts: z.array(AccountMetadataV1Schema),
     activeIndex: z.number().min(0),
+    activeIndexByFamily: ActiveIndexByFamilySchema.optional(),
+    pinnedAccountIndex: z.number().int().min(0).optional(),
+    affinityGeneration: z.number().int().min(0).optional(),
 });
 /**
  * Union of V1 and V3 storage formats for migration detection.

package/dist/lib/session-affinity.d.ts

@@ -40,4 +40,3 @@ export declare class SessionAffinityStore {
     private findOldestKey;
     private normalizeWriteVersion;
 }
-//# sourceMappingURL=session-affinity.d.ts.map

package/dist/lib/shutdown.d.ts

@@ -4,4 +4,3 @@ export declare function unregisterCleanup(fn: CleanupFn): void;
 export declare function runCleanup(): Promise<void>;
 export declare function getCleanupCount(): number;
 export {};
-//# sourceMappingURL=shutdown.d.ts.map

package/dist/lib/storage/account-clear-entry.d.ts

@@ -13,4 +13,3 @@ export declare function clearAccountsEntry(params: {
     }) => Promise<void>;
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=account-clear-entry.d.ts.map

package/dist/lib/storage/account-clear.d.ts

@@ -5,4 +5,3 @@ export declare function clearAccountStorageArtifacts(params: {
     backupPaths: string[];
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=account-clear.d.ts.map

package/dist/lib/storage/account-match-utils.d.ts

@@ -6,4 +6,3 @@ export declare function selectNewestAccount<T extends AccountLike>(current: T |
 export declare function collectDistinctIdentityValues(values: Array<string | undefined>): Set<string>;
 export declare function findNewestMatchingIndex<T, TRef>(accounts: readonly T[], toRef: (account: T) => TRef, predicate: (ref: TRef) => boolean, selectNewest: (current: T | undefined, candidate: T) => T): number | undefined;
 export {};
-//# sourceMappingURL=account-match-utils.d.ts.map

package/dist/lib/storage/account-persistence.d.ts

@@ -1,3 +1,2 @@
 import type { AccountStorageV3 } from "./public-types.js";
 export declare function cloneAccountStorageForPersistence(storage: AccountStorageV3 | null | undefined): AccountStorageV3;
-//# sourceMappingURL=account-persistence.d.ts.map

package/dist/lib/storage/account-port.d.ts

@@ -49,4 +49,3 @@ export declare function importAccountsSnapshot(params: {
     total: number;
     skipped: number;
 }>;
-//# sourceMappingURL=account-port.d.ts.map

package/dist/lib/storage/account-save-entry.d.ts

@@ -4,4 +4,3 @@ export declare function saveAccountsEntry(params: {
     withStorageLock: <T>(fn: () => Promise<T>) => Promise<T>;
     saveUnlocked: (storage: AccountStorageV3) => Promise<void>;
 }): Promise<void>;
-//# sourceMappingURL=account-save-entry.d.ts.map

package/dist/lib/storage/account-save.d.ts

@@ -15,16 +15,23 @@ export declare function saveAccountsToDisk(storage: AccountStorageV3, params: {
     writeTemp: (tempPath: string, content: string) => Promise<void>;
     statTemp: (tempPath: string) => Promise<{
         size: number;
+        mtimeMs?: number;
+        ctimeMs?: number;
+        ino?: number;
     }>;
     renameTempToPath: (tempPath: string) => Promise<void>;
     cleanupResetMarker: () => Promise<void>;
     cleanupWal: () => Promise<void>;
     cleanupTemp: (tempPath: string) => Promise<void>;
-    onSaved: () => void;
+    onSaved: (stats: {
+        size: number;
+        mtimeMs?: number;
+        ctimeMs?: number;
+        ino?: number;
+    }, contentSha256: string) => void;
     logWarn: (message: string, details: Record<string, unknown>) => void;
     logError: (message: string, details: Record<string, unknown>) => void;
     createStorageError: (error: unknown) => Error;
     backupPath: string;
     createTempPath: () => string;
 }): Promise<void>;
-//# sourceMappingURL=account-save.d.ts.map

package/dist/lib/storage/account-save.js

@@ -34,7 +34,10 @@ export async function saveAccountsToDisk(storage, params) {
         }
         await params.renameTempToPath(tempPath);
         await params.cleanupResetMarker();
-        params.onSaved();
+        // The temp file's stat fields survive the rename onto the primary path,
+        // so together with the content hash they are a free record of what this
+        // process last wrote — no extra stat of the destination is needed.
+        params.onSaved(stats, params.computeSha256(content));
         await params.cleanupWal();
     }
     catch (error) {

package/dist/lib/storage/account-snapshot.d.ts

@@ -22,4 +22,3 @@ export declare function describeAccountSnapshot(path: string, kind: BackupSnapsh
     }>;
     logWarn: (message: string, meta: Record<string, unknown>) => void;
 }): Promise<BackupSnapshotMetadata>;
-//# sourceMappingURL=account-snapshot.d.ts.map

package/dist/lib/storage/backup-metadata-builder.d.ts

@@ -29,4 +29,3 @@ export declare function buildBackupMetadata(params: {
     };
 }): Promise<BackupMetadata>;
 export {};
-//# sourceMappingURL=backup-metadata-builder.d.ts.map

package/dist/lib/storage/backup-metadata.d.ts

@@ -39,4 +39,3 @@ export type SnapshotStats = {
     mtimeMs?: number;
 };
 export {};
-//# sourceMappingURL=backup-metadata.d.ts.map

package/dist/lib/storage/backup-paths.d.ts

@@ -7,4 +7,3 @@ export declare function getAccountsBackupRecoveryCandidates(path: string, depth:
 export declare function getAccountsWalPath(path: string): string;
 export declare function getIntentionalResetMarkerPath(path: string): string;
 export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, RESET_MARKER_SUFFIX };
-//# sourceMappingURL=backup-paths.d.ts.map

package/dist/lib/storage/backup-restore.d.ts

@@ -8,4 +8,3 @@ export declare function restoreAccountsFromBackupPath(path: string, options: {
     }>;
     saveAccounts: (storage: AccountStorageV3) => Promise<void>;
 }): Promise<AccountStorageV3>;
-//# sourceMappingURL=backup-restore.d.ts.map

package/dist/lib/storage/cache-artifacts.d.ts

@@ -1,2 +1 @@
 export declare function isCacheLikeBackupArtifactName(entryName: string): boolean;
-//# sourceMappingURL=cache-artifacts.d.ts.map

package/dist/lib/storage/credential-sidecars.d.ts

@@ -10,4 +10,3 @@ export declare function clearCredentialSidecars(): Promise<void>;
  * keys never survive a reset; the first failure is rethrown afterwards.
  */
 export declare function clearAccountsAndCredentialSidecars(clearPool: () => Promise<void>): Promise<void>;
-//# sourceMappingURL=credential-sidecars.d.ts.map

package/dist/lib/storage/error-hints.d.ts

@@ -7,4 +7,3 @@ export declare function formatStorageErrorHint(error: unknown, path: string): st
  * Wrap an arbitrary storage failure in a StorageError with a derived hint.
  */
 export declare function toStorageError(message: string, error: unknown, path: string): StorageError;
-//# sourceMappingURL=error-hints.d.ts.map

package/dist/lib/storage/file-lock.d.ts

@@ -6,4 +6,3 @@
 export declare function withFileTransactionLock<T>(path: string, action: () => Promise<T>, options?: {
     waitMs?: number;
 }): Promise<T>;
-//# sourceMappingURL=file-lock.d.ts.map

package/dist/lib/storage/file-lock.js

@@ -9,6 +9,33 @@ const abandonedOwners = new Set();
 const leases = new AsyncLocalStorage();
 const host = createHash("sha256").update(hostname()).digest("hex").slice(0, 16);
 const ownerPattern = /^([a-f0-9]{16})\.([1-9][0-9]*)\.([a-f0-9-]{36})$/;
+// Contended acquisition retries once ran on a fixed 25ms delay: every waiter
+// woke on the same cadence and re-collided on the rename (p99 ~1.8s under ~200
+// waiters). The base delay now grows mildly from 15ms toward 40ms with up to
+// 10ms of uniform jitter, so each retry lands in ~[15,50)ms and waiters
+// decorrelate instead of stampeding the lock together.
+const LOCK_RETRY_MIN_DELAY_MS = 15;
+const LOCK_RETRY_MAX_BASE_DELAY_MS = 40;
+const LOCK_RETRY_GROWTH_FACTOR = 1.2;
+const LOCK_RETRY_JITTER_MS = 10;
+function lockRetryBaseDelayMs(failedAttempt) {
+    return Math.min(LOCK_RETRY_MIN_DELAY_MS * LOCK_RETRY_GROWTH_FACTOR ** (failedAttempt - 1), LOCK_RETRY_MAX_BASE_DELAY_MS);
+}
+// Derive the attempt cap from the delay schedule itself, not a flat ~40ms
+// guess: the first retries are cheaper than steady state (15ms, 18ms, …), so
+// ceil(waitMs / expected) let a short budget expire after roughly half the
+// requested wait — a 70ms budget could return ELOCKED in ~33ms. Summing the
+// zero-jitter base delays keeps retrying until the schedule has slept at
+// least waitMs; jitter only ever extends the wait, never shortens it.
+function lockMaxAttemptsForWaitMs(waitMs) {
+    let attempts = 1;
+    let coveredMs = 0;
+    while (coveredMs < waitMs) {
+        coveredMs += lockRetryBaseDelayMs(attempts);
+        attempts += 1;
+    }
+    return attempts;
+}
 function code(error) {
     return error?.code;
 }
@@ -152,7 +179,12 @@ export async function withFileTransactionLock(path, action, options = {}) {
                 await recoverDeadOwner(lock);
                 throw Object.assign(Error("Storage is busy with another live writer; retry shortly."), { code: "ELOCKED" });
             }
-        }, { maxAttempts: Math.max(1, Math.ceil((options.waitMs ?? 10000) / 25) + 1), backoffMs: 25, retryableCodes: ["ELOCKED", "EBUSY", "EPERM", "EACCES", "EAGAIN"] });
+        }, {
+            maxAttempts: lockMaxAttemptsForWaitMs(options.waitMs ?? 10000),
+            backoffMs: lockRetryBaseDelayMs,
+            jitterMs: LOCK_RETRY_JITTER_MS,
+            retryableCodes: ["ELOCKED", "EBUSY", "EPERM", "EACCES", "EAGAIN"],
+        });
         const lease = { active: true };
         const context = new Map(leases.getStore());
         context.set(key, lease);

package/dist/lib/storage/file-paths.d.ts

@@ -3,4 +3,3 @@ export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, get
 export declare function getAccountsBackupRecoveryCandidates(path: string): string[];
 export declare function getFlaggedAccountsPath(storagePath: string, fileName: string): string;
 export declare function getLegacyFlaggedAccountsPath(storagePath: string, legacyFileName: string): string;
-//# sourceMappingURL=file-paths.d.ts.map

package/dist/lib/storage/fixture-guards.d.ts

@@ -1,4 +1,3 @@
 import type { AccountMetadataV3, AccountStorageV3 } from "./public-types.js";
 export declare function looksLikeSyntheticFixtureAccount(account: AccountMetadataV3): boolean;
 export declare function looksLikeSyntheticFixtureStorage(storage: AccountStorageV3 | null): boolean;
-//# sourceMappingURL=fixture-guards.d.ts.map

package/dist/lib/storage/flagged-entry.d.ts

@@ -12,4 +12,3 @@ export declare function clearFlaggedAccountsEntry(params: {
     }) => Promise<void>;
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=flagged-entry.d.ts.map

package/dist/lib/storage/flagged-load-entry.d.ts

@@ -19,4 +19,3 @@ export declare function loadFlaggedAccountsEntry(params: {
     logError: (message: string, details: Record<string, unknown>) => void;
     logInfo: (message: string, details: Record<string, unknown>) => void;
 }): Promise<FlaggedAccountStorageV1>;
-//# sourceMappingURL=flagged-load-entry.d.ts.map

package/dist/lib/storage/flagged-save-entry.d.ts

@@ -4,4 +4,3 @@ export declare function saveFlaggedAccountsEntry(params: {
     withStorageLock: <T>(fn: () => Promise<T>) => Promise<T>;
     saveUnlocked: (storage: FlaggedAccountStorageV1) => Promise<void>;
 }): Promise<void>;
-//# sourceMappingURL=flagged-save-entry.d.ts.map

package/dist/lib/storage/flagged-storage-file.d.ts

@@ -8,4 +8,3 @@ export declare function loadFlaggedAccountsFromFile(path: string, deps: {
     normalizeFlaggedStorage: (data: unknown) => FlaggedAccountStorageV1;
     sleep?: (ms: number) => Promise<void>;
 }): Promise<FlaggedAccountStorageV1>;
-//# sourceMappingURL=flagged-storage-file.d.ts.map

package/dist/lib/storage/flagged-storage-io.d.ts

@@ -26,4 +26,3 @@ export declare function clearFlaggedAccountsOnDisk(params: {
     backupPaths: string[];
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=flagged-storage-io.d.ts.map

package/dist/lib/storage/flagged-storage.d.ts

@@ -3,4 +3,3 @@ export declare function normalizeFlaggedStorage(data: unknown, deps: {
     isRecord: (value: unknown) => value is Record<string, unknown>;
     now: () => number;
 }): FlaggedAccountStorageV1;
-//# sourceMappingURL=flagged-storage.d.ts.map

package/dist/lib/storage/gitignore.d.ts

@@ -4,4 +4,3 @@ export declare function ensureCodexGitignoreEntry(params: {
     logDebug: (message: string, details: Record<string, unknown>) => void;
     logWarn: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=gitignore.d.ts.map

package/dist/lib/storage/hash.d.ts

@@ -1,2 +1 @@
 export declare function computeSha256(value: string): string;
-//# sourceMappingURL=hash.d.ts.map

package/dist/lib/storage/health.d.ts

@@ -19,4 +19,3 @@ export declare function createStorageHealthSummary(params: {
     schemaErrors?: string[];
     recoverySource?: "wal";
 }): StorageHealthSummary;
-//# sourceMappingURL=health.d.ts.map

package/dist/lib/storage/identity.d.ts

@@ -18,4 +18,3 @@ export declare function toAccountIdentityRef(account: Pick<AccountLike, "account
 export declare function getAccountIdentityKey(account: Pick<AccountLike, "accountId" | "email" | "refreshToken">): string | undefined;
 export declare function getRuntimeAccountIdentityKey(account: Pick<RuntimeAccountLike, "accountId" | "email" | "index">): string | number | undefined;
 export {};
-//# sourceMappingURL=identity.d.ts.map

package/dist/lib/storage/import-export.d.ts

@@ -22,4 +22,3 @@ export declare function mergeImportedAccounts(params: {
     total: number;
     skipped: number;
 };
-//# sourceMappingURL=import-export.d.ts.map

package/dist/lib/storage/json-store-lock.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Stamp `updatedAt` for a per-key governance entry with a hybrid logical
+ * floor: when the wall clock regressed below the timestamp the entry being
+ * overwritten already carries, stamp `prior + 1` instead of `now`. Every
+ * upsert-only store merges with `updatedAt >=`, so a backward clock jump
+ * would otherwise stamp a semantically-newer write below its own
+ * predecessor and the merge would silently drop it. Equal or forward wall
+ * times pass through unchanged — ties already resolve to the caller's
+ * write under `>=`.
+ *
+ * `prior` is the entry the writer saw, which can trail the freshest on-disk
+ * entry when a concurrent writer lands between the caller's load and its
+ * save; baseline-aware save merges re-apply this same floor against the
+ * on-disk entry at merge time so the edit still cannot be lost.
+ */
+export declare function stampUpdatedAt(now: number, prior: number | undefined): number;
+/**
+ * Serialize `task` behind the previous write queued for `path`, so same-file
+ * writers inside this process run one at a time in submission order. A failed
+ * predecessor never blocks or fails successors. Re-entrant for the same path
+ * within one async context.
+ *
+ * This is the per-path generalization of the module-local `writeQueue`
+ * variables the governance stores used to keep by hand.
+ */
+export declare function withJsonStoreWriteQueue<T>(path: string, task: () => Promise<T>): Promise<T>;
+/** Test helper: drop queued-write bookkeeping (all paths, or one when given). */
+export declare function resetJsonStoreWriteQueuesForTests(path?: string): void;
+/**
+ * Stat `filePath` for its mtime with bounded transient-FS retry (the save
+ * path is Windows-sensitive: a single transient EBUSY/EPERM/EAGAIN from an
+ * AV/indexer lock must not abort the whole save). ENOENT returns `null`
+ * immediately; on exhaustion the last failure surfaces so the caller treats
+ * it as a real save error rather than a phantom missing file.
+ */
+export declare function getJsonStoreFileMtimeMs(filePath: string): Promise<number | null>;
+/**
+ * The `ESTALE` signal used by the CAS retry loop: the file's mtime moved
+ * between the caller's stat and its write, so the attempt must re-read and
+ * re-merge against the latest on-disk state instead of clobbering it.
+ */
+export declare function createJsonStoreStaleError(filePath: string): NodeJS.ErrnoException;
+/**
+ * Throw `ESTALE` when `filePath`'s current mtime differs from
+ * `expectedMtimeMs` (`null` means "file must still be absent"). Writers that
+ * keep their own temp+rename flow call this just before the rename, matching
+ * {@link writeJsonStoreFileAtomicWithRetry}'s inline check.
+ */
+export declare function assertJsonStoreFileMtimeUnchanged(filePath: string, expectedMtimeMs: number | null): Promise<void>;
+export interface JsonStoreAtomicWriteOptions {
+    /**
+     * When present (including explicit `null` = "expect the file to be
+     * absent"), compare-and-swap guard: abort with `ESTALE` if the target's
+     * mtime moved since the caller read it, so the caller can re-read and
+     * merge instead of clobbering a concurrent write. Omit the key entirely
+     * to skip the check.
+     */
+    expectedMtimeMs?: number | null;
+    /** Temp file mode (and therefore the final file's mode when created). */
+    mode?: number;
+    /** fsync the temp file before rename so a crash/power-loss cannot leave a truncated store. */
+    fsync?: boolean;
+    /** Rename retry codes; defaults to EBUSY/EPERM. */
+    retryableCodes?: ReadonlySet<string>;
+}
+/**
+ * Atomic JSON write: serialize `payload` pretty-printed with a trailing
+ * newline to a crypto-random sibling temp file, then rename it over
+ * `filePath` with bounded transient-FS retry. Optionally CAS-checks the
+ * target mtime first and fsyncs the temp file; on failure the temp is
+ * removed best-effort.
+ */
+export declare function writeJsonStoreFileAtomicWithRetry(filePath: string, payload: unknown, options?: JsonStoreAtomicWriteOptions): Promise<void>;
+/**
+ * Run `task`, retrying `ESTALE` CAS aborts so each attempt can re-read and
+ * re-merge against the latest on-disk state (matches the config save loop:
+ * 3 attempts, immediate retry, ESTALE-only).
+ */
+export declare function withJsonStoreCasRetry<T>(task: () => Promise<T>): Promise<T>;
+export interface JsonStoreFileLockOptions {
+    /**
+     * How long to wait for a lock held by a LIVE foreign process before
+     * failing with `ELOCKTIMEOUT` (default 10s). A crashed holder's lock is
+     * reclaimed as soon as its dead PID is observed; a live holder is never
+     * evicted — including a reused PID, which fails closed here rather than
+     * risking two writers in the critical section.
+     */
+    waitTimeoutMs?: number;
+}
+/**
+ * Cross-process mutex for a JSON store file, delegated to the proven
+ * candidate-directory transaction lock in lib/storage/file-lock.ts: each
+ * acquirer stages `<path>.write-lock.candidate-*` containing its unique
+ * `<host>.<pid>.<uuid>` owner file, then publishes it with a single atomic
+ * `rename` (which only succeeds while the lock directory is absent or empty,
+ * so there is no ownerless acquisition window). A crashed holder's lock is
+ * recovered by unlinking exactly that dead owner's unique filename and
+ * removing the directory only while it is still empty — an `rmdir` can never
+ * erase a lock that was republished in the meantime, so takeover can never
+ * delete another owner's live lock. Waiters on a live holder retry inside
+ * `waitTimeoutMs` (default 10s), then this wrapper surfaces the exhaustion
+ * as `ELOCKTIMEOUT`. Re-entrant for the same resolved path within one async
+ * context.
+ */
+export declare function withJsonStoreFileLock<T>(targetPath: string, task: () => Promise<T>, options?: JsonStoreFileLockOptions): Promise<T>;