codex-multi-auth 2.20.0 → 2.22.0

package/dist/lib/storage/credential-sidecars.js

@@ -1,4 +1,5 @@
 import { promises as fs } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { getApiRoutesPath } from "../api-route-store.js";
 import { withRetry } from "../fs-retry.js";
@@ -13,18 +14,49 @@ const retry = { maxAttempts: 6, backoffMs: 25 };
  */
 export async function clearCredentialSidecars() {
     const routes = getApiRoutesPath();
-    // Same locks as saveApiRoutes, so a concurrent menu save cannot resurrect keys.
-    await withStorageLock(() => withFileTransactionLock(routes, () => withRetry(() => fs.rm(routes, { force: true }), retry)));
     const dir = getCodexMultiAuthDir();
+    // Same locks as saveApiRoutes, so a concurrent menu save cannot resurrect keys.
+    await withStorageLock(() => withFileTransactionLock(routes, async () => {
+        await withRetry(() => fs.rm(routes, { force: true }), retry);
+        const leases = join(dir, "api-probe-locks");
+        try {
+            const stat = await fs.lstat(leases);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                throw Error("Invalid API probe lease directory; manual repair required");
+            // Detach while publication is excluded; never recursively delete a
+            // canonical directory that a replacement owner can populate.
+            await withRetry(() => fs.rename(leases, join(dir, `api-probe-locks.wiped-${randomUUID()}`)), retry);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }));
     // Each writer read-modify-writes under its file lock; deleting under the same
     // lock stops an in-flight refresh or redemption renaming its old state (and a
     // last-resort policy) back after the reset.
     for (const path of [
         join(dir, "reset-credits.json"),
         join(dir, "api-capability-probes.json"),
+        join(dir, "automatic-api-checks.json"),
     ]) {
         await withFileTransactionLock(path, () => withRetry(() => fs.rm(path, { force: true }), retry));
     }
+    // Also finish deletion after an interrupted earlier wipe. These unique paths
+    // can contain old holders/candidates, but never a new canonical lease.
+    let leftovers;
+    try {
+        leftovers = await fs.readdir(dir);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        leftovers = [];
+    }
+    for (const entry of leftovers) {
+        if (/^api-probe-locks\.wiped-[a-f0-9-]{36}$/.test(entry))
+            await withRetry(() => fs.rm(join(dir, entry), { recursive: true, force: true }), retry);
+    }
     // Per-account timestamps only; their writers take no lock and hold no secrets.
     const activity = join(dir, "inference-activity");
     await withRetry(() => fs.rm(activity, { recursive: true, force: true }), retry);

package/dist/lib/storage/file-lock.d.ts

@@ -5,4 +5,6 @@
  */
 export declare function withFileTransactionLock<T>(path: string, action: () => Promise<T>, options?: {
     waitMs?: number;
+    signal?: AbortSignal;
+    guardAcquisition?: <R>(action: () => Promise<R>) => Promise<R>;
 }): Promise<T>;

package/dist/lib/storage/file-lock.js

@@ -145,21 +145,32 @@ async function recoverDeadCandidates(lock) {
  * A reused PID fails closed (bounded contention) rather than risking two writers.
  */
 export async function withFileTransactionLock(path, action, options = {}) {
-    const absolute = resolve(path);
-    await fs.mkdir(dirname(absolute), { recursive: true, mode: 0o700 });
-    // Canonicalize the existing parent so /tmp and its symlink aliases share a lock.
-    const key = join(await fs.realpath(dirname(absolute)), absolute.slice(dirname(absolute).length + 1));
-    if (leases.getStore()?.get(key)?.active)
-        return action();
-    const lock = `${key}.write-lock`;
-    await recoverDeadCandidates(lock);
-    const candidate = await fs.mkdtemp(`${lock}.candidate-`);
+    options.signal?.throwIfAborted();
+    const guard = options.guardAcquisition ?? (async (run) => run());
+    let key = "", lock = "", candidate;
     const owner = `${host}.${process.pid}.${randomUUID()}`;
-    let published = false;
+    let published = false, reentrant = false;
     try {
-        await fs.chmod(candidate, 0o700);
-        await fs.writeFile(join(candidate, owner), "", { flag: "wx", mode: 0o600 });
-        await withRetry(async () => {
+        await guard(async () => {
+            options.signal?.throwIfAborted();
+            const absolute = resolve(path);
+            await fs.mkdir(dirname(absolute), { recursive: true, mode: 0o700 });
+            key = join(await fs.realpath(dirname(absolute)), absolute.slice(dirname(absolute).length + 1));
+            options.signal?.throwIfAborted();
+            if (leases.getStore()?.get(key)?.active) {
+                reentrant = true;
+                return;
+            }
+            lock = `${key}.write-lock`;
+            await recoverDeadCandidates(lock);
+            candidate = await fs.mkdtemp(`${lock}.candidate-`);
+            await fs.chmod(candidate, 0o700);
+            await fs.writeFile(join(candidate, owner), "", { flag: "wx", mode: 0o600 });
+        });
+        if (reentrant)
+            return action();
+        await withRetry(() => guard(async () => {
+            options.signal?.throwIfAborted();
             try {
                 await fs.rename(candidate, lock);
                 published = true;
@@ -179,12 +190,13 @@ export async function withFileTransactionLock(path, action, options = {}) {
                 await recoverDeadOwner(lock);
                 throw Object.assign(Error("Storage is busy with another live writer; retry shortly."), { code: "ELOCKED" });
             }
-        }, {
+        }), {
             maxAttempts: lockMaxAttemptsForWaitMs(options.waitMs ?? 10000),
             backoffMs: lockRetryBaseDelayMs,
             jitterMs: LOCK_RETRY_JITTER_MS,
             retryableCodes: ["ELOCKED", "EBUSY", "EPERM", "EACCES", "EAGAIN"],
         });
+        options.signal?.throwIfAborted();
         const lease = { active: true };
         const context = new Map(leases.getStore());
         context.set(key, lease);
@@ -197,22 +209,24 @@ export async function withFileTransactionLock(path, action, options = {}) {
     }
     finally {
         const directory = published ? lock : candidate;
-        try {
-            await withRetry(async () => {
-                try {
-                    await fs.unlink(join(directory, owner));
-                }
-                catch (error) {
-                    if (code(error) !== "ENOENT")
-                        throw error;
-                }
-                await removeEmpty(directory);
-            }, { maxAttempts: 6, backoffMs: 25 });
-        }
-        catch (error) {
-            abandonedOwners.add(owner);
-            retryAbandonedRelease(directory, owner);
-            logWarn("Storage lock cleanup deferred", { code: code(error) ?? "unknown" });
+        if (directory) {
+            try {
+                await withRetry(async () => {
+                    try {
+                        await fs.unlink(join(directory, owner));
+                    }
+                    catch (error) {
+                        if (code(error) !== "ENOENT")
+                            throw error;
+                    }
+                    await removeEmpty(directory);
+                }, { maxAttempts: 6, backoffMs: 25 });
+            }
+            catch (error) {
+                abandonedOwners.add(owner);
+                retryAbandonedRelease(directory, owner);
+                logWarn("Storage lock cleanup deferred", { code: code(error) ?? "unknown" });
+            }
         }
     }
 }

package/dist/lib/usage/ledger.js

@@ -24,6 +24,7 @@ const VALID_OPERATIONS = new Set([
     "images",
     "models",
     "thread-goal",
+    "transcribe",
     "auth-refresh",
     "diagnostic",
     "unknown",

package/dist/lib/usage/redaction.js

@@ -13,6 +13,7 @@ const VALID_OPERATIONS = new Set([
     "images",
     "models",
     "thread-goal",
+    "transcribe",
     "auth-refresh",
     "diagnostic",
     "unknown",

package/dist/lib/usage/types.d.ts

@@ -1,5 +1,5 @@
 export type UsageLedgerSource = "runtime-proxy" | "plugin-host" | "local-bridge" | "cli" | "unknown";
-export type UsageLedgerOperation = "responses" | "images" | "models" | "thread-goal" | "auth-refresh" | "diagnostic" | "unknown";
+export type UsageLedgerOperation = "responses" | "images" | "models" | "thread-goal" | "transcribe" | "auth-refresh" | "diagnostic" | "unknown";
 export type UsageLedgerOutcome = "success" | "failure" | "blocked" | "cancelled";
 /**
  * The service tier a response was actually billed at.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.20.0",
+	"version": "2.22.0",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",

package/scripts/codex-app-router.js

@@ -139,6 +139,27 @@ function writeStatus(statusPath, payload) {
 	}
 }
 
+// Status history is untrusted local JSON; retain only safe operational fields.
+function readDisconnect(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const { at, cause, stage, closeCode, routeKind, connectionAgeMs, eventCount } = value;
+	if (typeof at !== "number" || !Number.isFinite(at) || at < 0 || at > 8.64e15) return null;
+	if (!["close", "transport_error", "invalid_event", "buffer_limit", "send_error"].includes(cause)) return null;
+	if (!["awaiting_first_event", "streaming"].includes(stage)) return null;
+	if (routeKind !== undefined && !["oauth", "api", "zdr"].includes(routeKind)) return null;
+	if (closeCode !== undefined && (!Number.isInteger(closeCode) || closeCode < 1000 || closeCode > 4999)) return null;
+	for (const count of [connectionAgeMs, eventCount]) {
+		if (count !== undefined && (!Number.isSafeInteger(count) || count < 0)) return null;
+	}
+	return {
+		at, cause, stage,
+		...(closeCode !== undefined ? { closeCode } : {}),
+		...(routeKind !== undefined ? { routeKind } : {}),
+		...(connectionAgeMs !== undefined ? { connectionAgeMs } : {}),
+		...(eventCount !== undefined ? { eventCount } : {}),
+	};
+}
+
 function createStatusPayload({
 	state,
 	proxyServer,
@@ -148,9 +169,13 @@ function createStatusPayload({
 	statusPath,
 	routerScriptPath,
 	identityToken,
+	previousDisconnect = null,
 }) {
 	const proxyStatus =
 		typeof proxyServer?.getStatus === "function" ? proxyServer.getStatus() : {};
+	const currentDisconnect = readDisconnect(proxyStatus.lastWebsocketDisconnect);
+	// A current-process event is newer history even after wall-clock rollback.
+	const lastDisconnect = currentDisconnect ?? previousDisconnect;
 	const lastAccountIndex = proxyStatus.lastAccountIndex ?? null;
 	const lastAccountLabel =
 		typeof proxyStatus.lastAccountLabel === "string" &&
@@ -175,10 +200,12 @@ function createStatusPayload({
 			null,
 		updatedAt: Date.now(),
 		baseUrl: proxyServer?.baseUrl ?? stateRecord?.baseUrl ?? null,
+		schedulingStrategy: proxyStatus.schedulingStrategy,
 		totalRequests: proxyStatus.totalRequests ?? 0,
 		upstreamRequests: proxyStatus.upstreamRequests ?? 0,
 		websocketConnections: proxyStatus.websocketConnections ?? 0,
 		websocketUpstreamRequests: proxyStatus.websocketUpstreamRequests ?? 0,
+		lastWebsocketDisconnect: lastDisconnect,
 		streamQuotaUpdates: proxyStatus.streamQuotaUpdates ?? 0,
 		lastStreamQuotaUpdateAt: proxyStatus.lastStreamQuotaUpdateAt ?? null,
 		retries: proxyStatus.retries ?? 0,
@@ -266,6 +293,7 @@ async function main() {
 	const args = parseArgs(process.argv.slice(2));
 	installLogBounds(args.maxLogBytes, args.logPath).unref?.();
 	const stateRecord = readState(args.statePath);
+	let previousDisconnect = readDisconnect(readState(args.statusPath || stateRecord?.statusPath || "")?.lastWebsocketDisconnect);
 	if (args.statePath && stateRecord === null) {
 		const error = new Error(
 			"Codex app runtime router state is unreadable; refusing to bind an ephemeral port.",
@@ -273,6 +301,7 @@ async function main() {
 		writeStatus(
 			args.statusPath,
 			createStatusPayload({
+				previousDisconnect,
 				state: "error",
 				proxyServer: null,
 				error,
@@ -310,20 +339,19 @@ async function main() {
 
 	let proxyServer = null;
 	const writeCurrentStatus = (state, error) => {
-		writeStatus(
-			args.statusPath || stateRecord?.statusPath || "",
-			createStatusPayload({
-				state,
-				proxyServer,
-				error,
-				stateRecord,
-				startedAt: routerStartedAt,
-				statusPath: args.statusPath || stateRecord?.statusPath || "",
-				routerScriptPath: stateRecord?.routerScriptPath || process.argv[1],
-				identityToken:
-					args.identityToken || stateRecord?.identityToken || "",
-			}),
-		);
+		const payload = createStatusPayload({
+			previousDisconnect,
+			state,
+			proxyServer,
+			error,
+			stateRecord,
+			startedAt: routerStartedAt,
+			statusPath: args.statusPath || stateRecord?.statusPath || "",
+			routerScriptPath: stateRecord?.routerScriptPath || process.argv[1],
+			identityToken: args.identityToken || stateRecord?.identityToken || "",
+		});
+		previousDisconnect = payload.lastWebsocketDisconnect;
+		writeStatus(args.statusPath || stateRecord?.statusPath || "", payload);
 	};
 
 	try {