codex-multi-auth 2.8.4 → 2.8.5

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.8.4",
+	"version": "2.8.5",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -257,7 +257,7 @@ For remote or headless shells, prefer `codex-multi-auth login --device-auth`.
 | Routing profiles | `~/.codex/multi-auth/routing-profiles.json` |
 | Budget guards | `~/.codex/multi-auth/budget-guards.json` |
 | Local client tokens | `~/.codex/multi-auth/local-client-tokens.json` |
-| Runtime app helper status | `~/.codex/multi-auth/runtime-rotation-app-helper.json` |
+| Runtime app helper status | `~/.codex/multi-auth/runtime-rotation-app-helper.<pid>.json` |
 | Runtime app helper owner metadata | `~/.codex/multi-auth/runtime-rotation-app-helper-owner.<pid>.json` |
 | Persistent app bind state/logs | `~/.codex/multi-auth/app-bind/` |
 | Logs | `~/.codex/multi-auth/logs/codex-plugin/` |
@@ -392,9 +392,9 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.8.4.md](docs/releases/v2.8.4.md) — install via `npm i -g codex-multi-auth`
-- Previous stable: [docs/releases/v2.8.3.md](docs/releases/v2.8.3.md)
-- Previous stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md)
+- Current stable: [docs/releases/v2.8.5.md](docs/releases/v2.8.5.md) — install via `npm i -g codex-multi-auth`
+- Previous stable: [docs/releases/v2.8.3.md](docs/releases/v2.8.3.md)
+- Previous stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md)
 - Previous stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md)
 - Previous stable: [docs/releases/v2.7.0.md](docs/releases/v2.7.0.md)
 - Previous stable: [docs/releases/v2.6.0.md](docs/releases/v2.6.0.md)

package/dist/lib/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../lib/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEX,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,UAAU,EACV,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,SAAS,iCAAiC,CAAC;AACxD,eAAO,MAAM,aAAa,4CAA4C,CAAC;AACvE,eAAO,MAAM,SAAS,wCAAwC,CAAC;AAC/D,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAClE,eAAO,MAAM,KAAK,wCAAwC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;EAYzB,CAAC;AA0EF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAyBvE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAY3D;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAoCtE;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,MAAqB,GAChC,OAAO,CAAC,WAAW,CAAC,CAwDtB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAe1D;AAED;;;;GAIG;AACH,KAAK,yBAAyB,GAAG;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,wBAAsB,kBAAkB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,yBAA8B,GACrC,OAAO,CAAC,WAAW,CAAC,CAsEtB;AAED,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAuB5B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../lib/auth/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEX,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,UAAU,EACV,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,SAAS,iCAAiC,CAAC;AACxD,eAAO,MAAM,aAAa,4CAA4C,CAAC;AACvE,eAAO,MAAM,SAAS,wCAAwC,CAAC;AAC/D,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAClE,eAAO,MAAM,KAAK,wCAAwC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;EAYzB,CAAC;AA0EF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAyBvE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAY3D;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAoCtE;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,MAAqB,GAChC,OAAO,CAAC,WAAW,CAAC,CAwDtB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAe1D;AAED;;;;GAIG;AACH,KAAK,yBAAyB,GAAG;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,wBAAsB,kBAAkB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,yBAA8B,GACrC,OAAO,CAAC,WAAW,CAAC,CAsEtB;AAED,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAYD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,CAAC,EAAE,wBAAwB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAuB5B"}

package/dist/lib/auth/auth.js

@@ -1,5 +1,4 @@
-import { generatePKCE } from "@openauthjs/openauth/pkce";
-import { randomBytes } from "node:crypto";
+import { randomBytes, webcrypto } from "node:crypto";
 import { logError } from "../logger.js";
 import { safeParseOAuthTokenResponse } from "../schemas.js";
 import { isAbortError } from "../utils.js";
@@ -340,13 +339,19 @@ export async function refreshAccessToken(refreshToken, options = {}) {
         return { type: "failed", reason: "network_error", message: err?.message };
     }
 }
+async function generatePKCE() {
+    const verifier = randomBytes(64).toString("base64url");
+    const digest = await webcrypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    const challenge = Buffer.from(digest).toString("base64url");
+    return { verifier, challenge };
+}
 /**
  * Create OAuth authorization flow
  * @param options - Optional configuration for the flow
  * @returns Authorization flow details
  */
 export async function createAuthorizationFlow(options) {
-    const pkce = (await generatePKCE());
+    const pkce = await generatePKCE();
     const state = createState();
     const url = new URL(AUTHORIZE_URL);
     url.searchParams.set("response_type", "code");

package/dist/lib/codex-manager/commands/rotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/rotation.ts"],"names":[],"mappings":"AA4BA,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wCAAwC,CAAC;AAOhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,KAAK,aAAa,GAAG,gBAAgB,GAAG,IAAI,CAAC;AAiB7C,MAAM,WAAW,mBAAmB;IACnC,gBAAgB,EAAE,MAAM,YAAY,CAAC;IACrC,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,4BAA4B,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;IAC1D,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACpC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,gCAAgC,CAAC,EAAE,MAAM,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IACtF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAmnBD,wBAAsB,kBAAkB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,mBAAmB,GACvB,OAAO,CAAC,MAAM,CAAC,CAkFjB"}
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/rotation.ts"],"names":[],"mappings":"AA2BA,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wCAAwC,CAAC;AAahD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,KAAK,aAAa,GAAG,gBAAgB,GAAG,IAAI,CAAC;AAoB7C,MAAM,WAAW,mBAAmB;IACnC,gBAAgB,EAAE,MAAM,YAAY,CAAC;IACrC,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,4BAA4B,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC;IAChE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;IAC1D,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACpC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,gCAAgC,CAAC,EAAE,MAAM,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IACtF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AA4pBD,wBAAsB,kBAAkB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,mBAAmB,GACvB,OAAO,CAAC,MAAM,CAAC,CAkFjB"}

package/dist/lib/codex-manager/commands/rotation.js

@@ -1,5 +1,4 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { AccountManager, formatAccountLabel, formatCooldown, formatWaitTime, } from "../../accounts.js";
 import { parseBooleanEnv } from "../../env-parsing.js";
 import { getCodexMultiAuthDir } from "../../runtime-paths.js";
@@ -18,10 +17,11 @@ function redactedResetRateLimitsLabel(account, index) {
     return `account ${index + 1} (id:${tail})`;
 }
 import { formatAppBindStatus, } from "../../runtime/app-bind.js";
-import { APP_RUNTIME_HELPER_STATUS_FILE } from "../../runtime-constants.js";
+import { listRuntimeHelperStatusPaths } from "../../runtime-constants.js";
 import { findQuotaCacheEntryForAccount, isQuotaCacheEntryExhausted, } from "../../quota-readiness.js";
 import { recordRuntimeReset, } from "../../runtime/runtime-observability.js";
 import { appRuntimeHelperStatusToSignal as appRuntimeHelperStatusToRuntimeSignal, resolveAccountCurrentMarkers, resolveRuntimeCurrentAccount, } from "../../runtime/runtime-current-account.js";
+import { isLiveRuntimeHelper, liveRuntimeHelpers, readRuntimeHelperPid, selectRuntimeHelperStatus, } from "../../runtime/app-helper-selection.js";
 import { isRateLimitedMarker } from "../rate-limit-markers.js";
 import { isRecord } from "../../utils.js";
 function printRotationUsage(logInfo) {
@@ -402,8 +402,7 @@ function readOptionalString(record, key) {
         : null;
 }
 const MAX_STATUS_FILE_BYTES = 1024 * 1024; // 1 MB sanity cap
-function readAppRuntimeHelperStatus() {
-    const statusPath = join(getCodexMultiAuthDir(), APP_RUNTIME_HELPER_STATUS_FILE);
+function readAppRuntimeHelperStatusFile(statusPath) {
     if (!existsSync(statusPath))
         return null;
     try {
@@ -421,7 +420,8 @@ function readAppRuntimeHelperStatus() {
         return {
             state: readOptionalString(parsed, "state"),
             kind: readOptionalString(parsed, "kind"),
-            pid: readOptionalNumber(parsed, "pid"),
+            pid: readRuntimeHelperPid(parsed.pid),
+            startedAt: readOptionalNumber(parsed, "startedAt"),
             idleExpiresAt: readOptionalNumber(parsed, "idleExpiresAt"),
             totalRequests: readOptionalNumber(parsed, "totalRequests"),
             rotations: readOptionalNumber(parsed, "rotations"),
@@ -437,17 +437,24 @@ function readAppRuntimeHelperStatus() {
         return null;
     }
 }
-function isProcessAlive(pid) {
-    if (!pid)
-        return false;
+// One directory scan feeds both the status line and the live-helper count so
+// the two cannot observe different moments; path discovery is shared with
+// every other reader via listRuntimeHelperStatusPaths in runtime-constants.
+function readAppRuntimeHelperStatuses() {
+    const multiAuthDir = getCodexMultiAuthDir();
+    let entries = [];
     try {
-        process.kill(pid, 0);
-        return true;
+        entries = readdirSync(multiAuthDir);
     }
-    catch (error) {
-        const code = error && typeof error === "object" && "code" in error ? error.code : null;
-        return code === "EPERM";
+    catch {
+        entries = [];
     }
+    return listRuntimeHelperStatusPaths(multiAuthDir, entries)
+        .map(readAppRuntimeHelperStatusFile)
+        .filter((status) => status !== null && status.kind === "codex-app-runtime-rotation-helper");
+}
+function readAppRuntimeHelperStatus(now = Date.now()) {
+    return selectRuntimeHelperStatus(readAppRuntimeHelperStatuses(), now);
 }
 function formatHelperLastAccount(status) {
     if (status.lastAccountLabel && !status.lastAccountLabel.includes("@")) {
@@ -463,14 +470,19 @@ function formatHelperLastAccount(status) {
     }
     return null;
 }
-function formatAppRuntimeHelperStatus(now, status = readAppRuntimeHelperStatus()) {
+function formatAppRuntimeHelperStatus(now, status = readAppRuntimeHelperStatus(now), liveHelperCount = status ? 1 : 0) {
     if (!status)
         return "Codex app helper: not running";
     if (status.kind !== "codex-app-runtime-rotation-helper") {
         return "Codex app helper: not running";
     }
-    const alive = isProcessAlive(status.pid);
-    if (!alive || status.state === "stopped" || status.state === "idle-timeout") {
+    // Only "running" is running: "stopped", "idle-timeout", "max-lifetime",
+    // "owner-gone", "error", and anything a future helper invents are all
+    // terminal, and a live kill(pid, 0) on a terminal record proves nothing —
+    // the PID may be recycled, which is the exact gate this fix stopped
+    // trusting. `isLiveRuntimeHelper` folds both conditions together, and is
+    // the same predicate the selection above and the account marker below use.
+    if (!isLiveRuntimeHelper(status, now)) {
         return "Codex app helper: not running";
     }
     const parts = [`running${status.pid ? ` pid=${status.pid}` : ""}`];
@@ -484,6 +496,12 @@ function formatAppRuntimeHelperStatus(now, status = readAppRuntimeHelperStatus()
     if (status.idleExpiresAt !== null && status.idleExpiresAt > now) {
         parts.push(`idle-expires=${formatWaitTime(status.idleExpiresAt - now)}`);
     }
+    // The line shows the most recently active helper; with per-account
+    // app-servers several can be live at once, so say so instead of implying
+    // this one is the only one.
+    if (liveHelperCount > 1) {
+        parts.push(`(+${liveHelperCount - 1} more running)`);
+    }
     return `Codex app helper: ${parts.join(", ")}`;
 }
 function shouldAutoBindCodexApp(env = process.env) {
@@ -532,8 +550,13 @@ async function printRotationStatus(deps) {
     logInfo(`Runtime rotation proxy: ${enabled ? "enabled" : "disabled"}`);
     logInfo(`Stored setting: ${config.codexRuntimeRotationProxy === true ? "enabled" : "disabled"}`);
     logInfo(`Env override: ${formatEnvOverride()}`);
-    const helperStatus = readAppRuntimeHelperStatus();
-    logInfo(formatAppRuntimeHelperStatus(now, helperStatus));
+    // One scan and one selection feed the status line, the live count and the
+    // account marker below. Selecting twice re-ran the liveness probes at a
+    // later instant, so the helper named on the line and the helper whose
+    // account is marked `current` could be different processes (#667).
+    const helperStatuses = readAppRuntimeHelperStatuses();
+    const selectedHelperStatus = selectRuntimeHelperStatus(helperStatuses, now);
+    logInfo(formatAppRuntimeHelperStatus(now, selectedHelperStatus, liveRuntimeHelpers(helperStatuses, now).length));
     const appBindStatus = await printCodexAppBindStatus(deps);
     logInfo(`Storage: ${storagePath}`);
     if (!storage || storage.accounts.length === 0) {
@@ -552,7 +575,7 @@ async function printRotationStatus(deps) {
     const runtimeCurrent = resolveRuntimeCurrentAccount(storage, {
         runtimeSnapshot,
         appBindStatus: appBindStatus?.running ? appBindStatus.router : null,
-        appHelperStatus: appRuntimeHelperStatusToRuntimeSignal(helperStatus),
+        appHelperStatus: appRuntimeHelperStatusToRuntimeSignal(selectedHelperStatus, now),
     }, { now });
     logInfo(`Accounts: ${storage.accounts.length}`);
     for (let index = 0; index < storage.accounts.length; index += 1) {

package/dist/lib/runtime/app-bind.d.ts

@@ -111,6 +111,13 @@ export declare function stopRuntimeRotationRouterProcess(router: Pick<AppBindRou
 /** Parse the documented local-time format emitted by `ps -o lstart=`. */
 export declare function parsePosixProcessStartTime(value: string): number | null;
 export declare function stopDetachedProcess(pid: number | null, platform: NodeJS.Platform, options?: DetachedProcessStopOptions): Promise<boolean>;
+/**
+ * How many helper records unbind processes at once. Exported so a regression
+ * test can observe the bound rather than only its effects — with a handful of
+ * records any width behaves identically, so an edit to `Infinity` would
+ * otherwise ship green.
+ */
+export declare const UNBIND_HELPER_CONCURRENCY = 8;
 export declare function stopRuntimeRotationAppHelperProcess(helper: RuntimeRotationAppHelperStatus, options?: DetachedProcessStopOptions & {
     platform?: NodeJS.Platform;
 }): Promise<boolean>;

package/dist/lib/runtime/app-bind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,GACf,MAAM,CAMR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAsPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAmLD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAmElB;AAyLD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsHD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAgLD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAsCjE"}
+{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,GACf,MAAM,CAMR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAsPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAmLD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAmElB;AAyLD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AA8C3C,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsHD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsQD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAsCjE"}

package/dist/lib/runtime/app-bind.js

@@ -1,14 +1,14 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";
-import { mkdir, open, readFile, rename, rm, unlink } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, rename, rm, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 import { withFileOperationRetry } from "../fs-retry.js";
 import { getCodexMultiAuthDir } from "../runtime-paths.js";
-import { APP_RUNTIME_HELPER_OWNER_FILE, APP_RUNTIME_HELPER_STATUS_FILE, } from "../runtime-constants.js";
+import { APP_RUNTIME_HELPER_OWNER_FILE, listRuntimeHelperOwnerPaths, listRuntimeHelperStatusPaths, } from "../runtime-constants.js";
 import { configHasRuntimeRotationProvider, restoreConfigTomlFromRuntimeRotationProvider, restoreConfigTomlFromRuntimeRotationProviderWithoutBackup, rewriteConfigTomlForRuntimeRotationProvider, } from "./config-toml.js";
 const APP_BIND_DIR_NAME = "app-bind";
 const APP_BIND_STATE_FILE = "runtime-rotation-app-bind.json";
@@ -879,6 +879,44 @@ function resolveRuntimeHelperOwnerPath(baseDir, pid) {
         return null;
     return join(baseDir, APP_RUNTIME_HELPER_OWNER_FILE.replace(/\.json$/i, `.${pid}.json`));
 }
+/**
+ * How many helper records unbind processes at once. Exported so a regression
+ * test can observe the bound rather than only its effects — with a handful of
+ * records any width behaves identically, so an edit to `Infinity` would
+ * otherwise ship green.
+ */
+export const UNBIND_HELPER_CONCURRENCY = 8;
+/**
+ * `Promise.all` over `items` with at most `limit` in flight, preserving input
+ * order in the result. Used where the per-item work is independent but not
+ * free — a helper stop pays a SIGTERM, a graceful wait and possibly a SIGKILL —
+ * so serialising it multiplies a single stop window by the number of stale
+ * helpers, and unbounded parallelism signals every one of them at once.
+ */
+async function mapWithConcurrency(items, limit, worker) {
+    const results = new Array(items.length);
+    let next = 0;
+    const runners = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+        for (;;) {
+            const index = next;
+            next += 1;
+            // Only running past the end retires a runner. Folding the
+            // `undefined` check into the same `return` would make a sparse
+            // array or a `(T | undefined)[]` silently drop every item after
+            // the first hole — on a cleanup path whose failure mode is
+            // "helpers left running while the user is told the app was
+            // unbound".
+            if (index >= items.length)
+                return;
+            const item = items[index];
+            if (item === undefined)
+                continue;
+            results[index] = await worker(item, index);
+        }
+    });
+    await Promise.all(runners);
+    return results;
+}
 export async function stopRuntimeRotationAppHelperProcess(helper, options = {}) {
     if (helper.kind !== "codex-app-runtime-rotation-helper" ||
         helper.state !== "running" ||
@@ -1054,66 +1092,146 @@ async function unbindCodexAppRuntimeRotationLocked(options, paths) {
     if (router?.pid && (!routerStopped || isProcessAlive(router.pid))) {
         options.log?.(`Warning: runtime router (pid ${router.pid}) did not stop; continuing cleanup`);
     }
-    const helperStatusPath = join(dirname(paths.bindDir), APP_RUNTIME_HELPER_STATUS_FILE);
-    const helperRead = await readRuntimeHelperStatus(helperStatusPath);
-    let removeHelperStatus = false;
-    let removeHelperOwner = false;
-    let helperOwnerPath = null;
-    if (helperRead.kind === "valid") {
+    // Helpers publish per-PID status files (`runtime-rotation-app-helper.<pid>.json`);
+    // the un-suffixed name is the legacy shared path from before that change,
+    // still checked so a pre-upgrade helper is torn down too. Every candidate
+    // walks the same per-helper logic the single file used to get: stopping is
+    // gated on ownership verification (status/owner identity-token agreement
+    // plus process identity), so unbind reaps each helper it can prove is one
+    // of ours and preserves — with a warning — anything it cannot.
+    const helperBaseDir = dirname(paths.bindDir);
+    let helperDirEntries = [];
+    try {
+        helperDirEntries = await withFileOperationRetry(() => readdir(helperBaseDir));
+    }
+    catch (error) {
+        // Degrading to legacy-only cleanup while reporting success would leave
+        // every per-PID helper running with the user told the app was unbound —
+        // say so. ENOENT just means no helper ever ran.
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : "unknown";
+        if (code !== "ENOENT") {
+            options.log?.(`Warning: could not enumerate runtime app helper status files (${code}); only the legacy helper path is checked`);
+        }
+        helperDirEntries = [];
+    }
+    const helperStatusPaths = listRuntimeHelperStatusPaths(helperBaseDir, helperDirEntries);
+    // Each candidate is independent — a read, a liveness check, and at most one
+    // SIGTERM/graceful-wait/SIGKILL sequence — and on the machine from #663 there
+    // were 183 of them. Run them in a bounded pool rather than one after another,
+    // so unbind costs roughly one stop window instead of N of them; the bound
+    // keeps a machine full of stale helpers from being hit with 183 concurrent
+    // signal sequences.
+    const helperResults = await mapWithConcurrency(helperStatusPaths, UNBIND_HELPER_CONCURRENCY, async (helperStatusPath) => {
+        const helperRead = await readRuntimeHelperStatus(helperStatusPath);
+        if (helperRead.kind !== "valid")
+            return null;
         const helper = helperRead.status;
-        if (helper.kind === "codex-app-runtime-rotation-helper") {
-            helperOwnerPath = resolveRuntimeHelperOwnerPath(dirname(paths.bindDir), helper.pid);
-            const helperOwner = helperOwnerPath
-                ? await readRuntimeHelperOwner(helperOwnerPath)
-                : null;
-            const helperOwnershipMatches = !helper.identityToken ||
-                (helperOwner !== null &&
-                    helper.identityToken === helperOwner.identityToken);
-            if (helper.state === "running") {
-                if (helper.pid === null) {
-                    options.log?.("Warning: runtime app helper status has no valid PID; preserving status");
+        if (helper.kind !== "codex-app-runtime-rotation-helper")
+            return null;
+        let removeHelperStatus = false;
+        let removeHelperOwner = false;
+        const helperOwnerPath = resolveRuntimeHelperOwnerPath(helperBaseDir, helper.pid);
+        const helperOwner = helperOwnerPath
+            ? await readRuntimeHelperOwner(helperOwnerPath)
+            : null;
+        const helperOwnershipMatches = !helper.identityToken ||
+            (helperOwner !== null &&
+                helper.identityToken === helperOwner.identityToken);
+        if (helper.state === "running") {
+            if (helper.pid === null) {
+                options.log?.("Warning: runtime app helper status has no valid PID; preserving status");
+            }
+            else {
+                const wasAlive = isProcessAlive(helper.pid);
+                if (!wasAlive) {
+                    // Decisive, and deliberately not gated on ownership (#666): a
+                    // dead PID means both files describe a process that no longer
+                    // exists, so keeping the owner file preserves nothing. It used
+                    // to be gated, which deleted the status file and stranded the
+                    // owner file — and because unbind then enumerated status paths
+                    // only, nothing ever rediscovered it. This matches what the
+                    // launcher-side sweep already does with a dead PID.
+                    removeHelperStatus = true;
+                    removeHelperOwner = helperOwnerPath !== null;
+                }
+                else if (!helperOwnershipMatches) {
+                    options.log?.("Warning: runtime app helper ownership metadata does not match; preserving status");
                 }
                 else {
-                    const wasAlive = isProcessAlive(helper.pid);
-                    if (!wasAlive) {
-                        removeHelperStatus = true;
-                        removeHelperOwner =
-                            helperOwnershipMatches && helperOwnerPath !== null;
-                    }
-                    else if (!helperOwnershipMatches) {
-                        options.log?.("Warning: runtime app helper ownership metadata does not match; preserving status");
-                    }
-                    else {
-                        const stopped = await stopRuntimeRotationAppHelperProcess(helper, {
-                            platform,
-                            log: options.log,
-                            identityToken: helper.identityToken
-                                ? helperOwner?.identityToken
-                                : undefined,
-                            verifyProcessIdentity: options.verifyProcessIdentity,
-                        });
-                        const stillAlive = isProcessAlive(helper.pid);
-                        removeHelperStatus = stopped && !stillAlive;
-                        removeHelperOwner =
-                            removeHelperStatus && helperOwnerPath !== null;
-                        if (!removeHelperStatus) {
-                            options.log?.(`Warning: runtime app helper (pid ${helper.pid}) did not stop; preserving status`);
-                        }
+                    const stopped = await stopRuntimeRotationAppHelperProcess(helper, {
+                        platform,
+                        log: options.log,
+                        identityToken: helper.identityToken
+                            ? helperOwner?.identityToken
+                            : undefined,
+                        verifyProcessIdentity: options.verifyProcessIdentity,
+                    });
+                    const stillAlive = isProcessAlive(helper.pid);
+                    removeHelperStatus = stopped && !stillAlive;
+                    removeHelperOwner = removeHelperStatus && helperOwnerPath !== null;
+                    if (!removeHelperStatus) {
+                        options.log?.(`Warning: runtime app helper (pid ${helper.pid}) did not stop; preserving status`);
                     }
                 }
             }
-            else {
-                // A non-running, owned record is removable only when its PID is
-                // absent or no longer alive. This avoids deleting a status file
-                // while a helper is still serving despite a stale state value.
-                removeHelperStatus =
-                    helper.pid === null || !isProcessAlive(helper.pid);
-                removeHelperOwner =
-                    removeHelperStatus &&
-                        helperOwnershipMatches &&
-                        helperOwnerPath !== null;
-            }
         }
+        else {
+            // A non-running, owned record is removable only when its PID is
+            // absent or no longer alive. This avoids deleting a status file
+            // while a helper is still serving despite a stale state value.
+            // Ownership does not gate the owner file here either, for the same
+            // reason as above: the PID is gone, so neither file describes
+            // anything that can still be running.
+            removeHelperStatus = helper.pid === null || !isProcessAlive(helper.pid);
+            removeHelperOwner = removeHelperStatus && helperOwnerPath !== null;
+        }
+        return {
+            statusPath: helperStatusPath,
+            ownerPath: helperOwnerPath,
+            removeHelperStatus,
+            removeHelperOwner,
+        };
+    });
+    const helperCleanupPaths = [];
+    // Owner paths this pass already reasoned about, whether or not it decided to
+    // remove them — a preserved live helper's owner file must not then be swept
+    // by the orphan pass below.
+    const consideredOwnerPaths = new Set();
+    for (const result of helperResults) {
+        if (!result)
+            continue;
+        if (result.ownerPath !== null)
+            consideredOwnerPaths.add(result.ownerPath);
+        if (result.removeHelperStatus)
+            helperCleanupPaths.push(result.statusPath);
+        if (result.removeHelperOwner && result.ownerPath !== null) {
+            helperCleanupPaths.push(result.ownerPath);
+        }
+    }
+    // Owner files with no status record left to pair them with. Before #666 these
+    // were unreachable: every earlier pass walked status paths only, so an owner
+    // file that outlived its status file was never looked at again. A dead PID is
+    // the whole test — a live PID's owner file belongs to a helper that is still
+    // running, and was already considered above.
+    for (const owner of listRuntimeHelperOwnerPaths(helperBaseDir, helperDirEntries)) {
+        if (consideredOwnerPaths.has(owner.path))
+            continue;
+        if (isProcessAlive(owner.pid)) {
+            // An owner file with no status record whose PID is nonetheless live
+            // is the one shape this pass cannot reclaim. Either a helper is
+            // starting right now and has not published yet, or — the case that
+            // accumulates — the PID was recycled by an unrelated process after
+            // the status file was already gone. Telling those apart needs the
+            // recorded-start-time comparison the launcher-side sweep does, which
+            // unbind has no equivalent of; that is a scope decision, but it
+            // should not be a silent one. Every other preserve in this function
+            // warns, so this one does too.
+            options.log?.(`Warning: runtime app helper owner metadata (pid ${owner.pid}) has no status record but its PID is live; preserving`);
+            continue;
+        }
+        helperCleanupPaths.push(owner.path);
     }
     await removeAppBindStartup(state ?? paths);
     const backup = await readAppBindBackup(paths.backupPath);
@@ -1154,8 +1272,7 @@ async function unbindCodexAppRuntimeRotationLocked(options, paths) {
         paths.backupPath,
         paths.statusPath,
         state?.logPath ?? paths.logPath,
-        ...(removeHelperStatus ? [helperStatusPath] : []),
-        ...(removeHelperOwner && helperOwnerPath ? [helperOwnerPath] : []),
+        ...helperCleanupPaths,
     ];
     for (const candidate of cleanupCandidates) {
         try {

package/dist/lib/runtime/app-helper-selection.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The fields any helper status record has to expose for the shared selector to
+ * reason about it. `rotation status` and runtime account resolution carry
+ * different extra fields — request counters on one side, account identity on
+ * the other — but they answer "which helper is current" the same way, and used
+ * to answer it with two hand-rolled copies that could drift apart within a
+ * single command (#667).
+ */
+export interface RuntimeHelperSelectable {
+    state: string | null;
+    pid: number | null;
+    startedAt: number | null;
+    updatedAt: number | null;
+}
+/**
+ * How stale a `running` record may be before it stops counting as live.
+ *
+ * A running helper republishes its status on every tick, and the publish path
+ * heartbeats at least once per `APP_RUNTIME_HELPER_STATUS_HEARTBEAT_MS` (60s)
+ * even when nothing in the payload changed. Ten heartbeats of silence is not a
+ * helper that is merely quiet — it is a record whose writer is gone.
+ *
+ * This is the identity check these readers were missing. `kill(pid, 0)` answers
+ * "does *a* process hold this integer", so a stale record — classically the
+ * legacy shared `runtime-rotation-app-helper.json` left behind by a SIGKILLed
+ * pre-upgrade helper — passes liveness as soon as an unrelated process is
+ * handed its PID, and can then win selection outright. Freshness is the half of
+ * identity available to a synchronous reader: the wrapper verifies identity by
+ * probing kernel start times, but that costs a `ps` per candidate, and these
+ * two call sites are read-only status paths reached from the interactive menu
+ * as well as the CLI. Whoever holds the PID now, they are not the process that
+ * last wrote this file.
+ */
+export declare const RUNTIME_HELPER_STATUS_STALE_MS: number;
+/** Tolerance for clock skew between the writing helper and the reader. */
+export declare const RUNTIME_HELPER_CLOCK_TOLERANCE_MS: number;
+/**
+ * A PID is a positive integer or it is nothing. Both readers used to accept any
+ * finite number, so a corrupt or hand-edited record carrying `-1234` reached
+ * `process.kill(-1234, 0)` — which on POSIX probes process *group* 1234 and
+ * succeeds on any busy machine, reporting a helper that does not exist as live.
+ * Fractional values were accepted the same way.
+ */
+export declare function readRuntimeHelperPid(value: unknown): number | null;
+/**
+ * Best-effort liveness probe. `EPERM` means a process exists that this user may
+ * not signal, so it counts as alive; every other errno — including the `EINVAL`
+ * some platforms raise for a PID above their ceiling — counts as dead.
+ */
+export declare function isRuntimeHelperProcessAlive(pid: number | null): boolean;
+/**
+ * The single definition of "this helper is currently serving": a running state,
+ * a live PID, and a record recent enough to have been written by that PID's
+ * current occupant.
+ */
+export declare function isLiveRuntimeHelper(status: RuntimeHelperSelectable, now?: number): boolean;
+/** Every helper that passes {@link isLiveRuntimeHelper}, input order preserved. */
+export declare function liveRuntimeHelpers<T extends RuntimeHelperSelectable>(statuses: readonly T[], now?: number): T[];
+/**
+ * Prefer a live helper, and among several the most recently updated. Absent any
+ * live helper, fall back to the freshest record so the previous "reports the
+ * last helper's final state" behaviour survives.
+ *
+ * Callers that also need the live count must pass the same `statuses` array and
+ * the same `now` to {@link liveRuntimeHelpers}, so the selected helper and the
+ * count describe one instant rather than two.
+ */
+export declare function selectRuntimeHelperStatus<T extends RuntimeHelperSelectable>(statuses: readonly T[], now?: number): T | null;
+//# sourceMappingURL=app-helper-selection.d.ts.map

package/dist/lib/runtime/app-helper-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-helper-selection.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-helper-selection.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,8BAA8B,QAAiB,CAAC;AAE7D,0EAA0E;AAC1E,eAAO,MAAM,iCAAiC,QAAY,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAWvE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,GAAE,MAAmB,GACtB,OAAO,CAgBT;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,uBAAuB,EACnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,GAAG,GAAE,MAAmB,GACtB,CAAC,EAAE,CAEL;AASD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,uBAAuB,EAC1E,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,GAAG,GAAE,MAAmB,GACtB,CAAC,GAAG,IAAI,CAKV"}