codexuse-cli 5.6.0 → 5.6.2

package/dist/index.js

@@ -6228,13 +6228,20 @@ async function openLockDatabase(databasePath) {
     throw error;
   }
 }
-async function acquireCrossProcessFileLock(filePath) {
+async function acquireCrossProcessFileLockTransaction(filePath, mode) {
   const databasePath = `${import_node_path8.default.resolve(filePath)}.codexuse-lock.sqlite`;
   let database = null;
   try {
     database = await openLockDatabase(databasePath);
+    database.exec("PRAGMA busy_timeout = 1000;");
+    database.exec("CREATE TABLE IF NOT EXISTS codexuse_file_lock (id INTEGER PRIMARY KEY);");
     database.exec("PRAGMA busy_timeout = 0;");
-    database.exec("BEGIN IMMEDIATE;");
+    if (mode === "write") {
+      database.exec("BEGIN EXCLUSIVE;");
+    } else {
+      database.exec("BEGIN;");
+      database.exec("SELECT COUNT(*) FROM codexuse_file_lock;");
+    }
   } catch (error) {
     database?.close();
     if (isSqliteBusyError2(error)) {
@@ -6256,6 +6263,12 @@ async function acquireCrossProcessFileLock(filePath) {
     }
   };
 }
+async function acquireCrossProcessFileLock(filePath) {
+  return acquireCrossProcessFileLockTransaction(filePath, "write");
+}
+async function acquireCrossProcessFileReadLock(filePath) {
+  return acquireCrossProcessFileLockTransaction(filePath, "read");
+}
 
 // ../../packages/shared/src/core/logger.ts
 var isTestEnv = process.env.NODE_ENV === "test" || process.env.VITEST === "true" || process.env.VITEST === "1";
@@ -32534,6 +32547,21 @@ async function acquireCodexAuthFileLock(filePath) {
     throw error;
   }
 }
+async function acquireCodexAuthFileReadLock(filePath) {
+  const queueKey = import_node_path9.default.resolve(filePath);
+  await (authFileLockQueues.get(queueKey) ?? Promise.resolve());
+  const releaseReadLock = await acquireCrossProcessFileReadLock(filePath);
+  if (!releaseReadLock) {
+    return null;
+  }
+  const needsRecovery = await readOptionalFile(authWritebackPaths(filePath).manifest) !== null;
+  if (!needsRecovery) {
+    return { mode: "read", release: releaseReadLock };
+  }
+  await releaseReadLock();
+  const releaseWriteLock = await acquireCodexAuthFileLock(filePath);
+  return releaseWriteLock ? { mode: "write", release: releaseWriteLock } : null;
+}
 async function readAuthFileCached(filePath) {
   let stats;
   try {
@@ -32708,15 +32736,15 @@ async function fetchRateLimitsViaRpc(envOverride, options = {}) {
   const tempAuthPath = import_node_path9.default.join(tempHome, "auth.json");
   let initialSourceAuth;
   try {
-    const releaseLock = await acquireCodexAuthFileLock(sourceAuthPath);
-    if (!releaseLock) {
+    const authLock = await acquireCodexAuthFileReadLock(sourceAuthPath);
+    if (!authLock) {
       await import_node_fs4.promises.rm(tempHome, { recursive: true, force: true });
       return null;
     }
     try {
       initialSourceAuth = await readAuthFileCached(sourceAuthPath);
     } finally {
-      await releaseLock();
+      await authLock.release();
     }
     if (!initialSourceAuth) {
       await import_node_fs4.promises.rm(tempHome, { recursive: true, force: true });
@@ -32843,15 +32871,15 @@ async function activateResetWindowViaRpcIsolated(envOverride, options, sourceAut
   const tempAuthPath = import_node_path9.default.join(tempHome, "auth.json");
   let initialSourceAuth;
   try {
-    const releaseLock = await acquireCodexAuthFileLock(sourceAuthPath);
-    if (!releaseLock) {
+    const authLock = await acquireCodexAuthFileReadLock(sourceAuthPath);
+    if (!authLock) {
       await import_node_fs4.promises.rm(tempHome, { recursive: true, force: true });
       return { status: "skipped", reason: "auth-busy" };
     }
     try {
       initialSourceAuth = await readAuthFileCached(sourceAuthPath);
     } finally {
-      await releaseLock();
+      await authLock.release();
     }
     if (!initialSourceAuth) {
       await import_node_fs4.promises.rm(tempHome, { recursive: true, force: true }).catch(() => {
@@ -43081,6 +43109,7 @@ var ProfileManager = class {
     this.jwtPayloadCache = /* @__PURE__ */ new Map();
     this.profileRecordIndexCache = null;
     this.credentialsMigrationPromise = null;
+    this.blockedProfileMigrationErrors = /* @__PURE__ */ new Map();
     this.profileHomeAuthSyncCache = /* @__PURE__ */ new Map();
   }
   computeExpiryIso(data) {
@@ -43133,6 +43162,16 @@ var ProfileManager = class {
   normalizeProfileHomeId(value3, fallbackName) {
     return normalizeProfileHomeId(value3) ?? this.normalizeProfileName(fallbackName);
   }
+  assertProfileHomeUsable(profileName) {
+    const migrationError = this.blockedProfileMigrationErrors.get(profileName);
+    if (!migrationError) {
+      return;
+    }
+    throw errorWithCause(
+      `Profile '${profileName}' cannot be used because another profile references the same private auth store. Delete one conflicting profile, then restart CodexUse.`,
+      migrationError
+    );
+  }
   isNotFoundError(error) {
     return Boolean(
       error && typeof error === "object" && "code" in error && error.code === "ENOENT"
@@ -43814,8 +43853,7 @@ var ProfileManager = class {
     }
     if (!this.credentialsMigrationPromise) {
       this.credentialsMigrationPromise = this.migrateCredentialsToProfileHomes().catch((error) => {
-        this.credentialsMigrationPromise = null;
-        throw error;
+        logError("Deferred profile credential migration because the migration pass failed:", error);
       });
     }
     await this.credentialsMigrationPromise;
@@ -43832,9 +43870,12 @@ var ProfileManager = class {
       const collisionKey = homeId.toLowerCase();
       const existingProfileName = profileNamesByHomeId.get(collisionKey);
       if (existingProfileName && existingProfileName !== profileName) {
-        throw new Error(
+        const collisionError = new Error(
           `Profiles '${existingProfileName}' and '${profileName}' use the same private auth store. Refresh one profile before retrying.`
         );
+        this.blockedProfileMigrationErrors.set(existingProfileName, collisionError);
+        this.blockedProfileMigrationErrors.set(profileName, collisionError);
+        logWarn("Deferred profiles that reference the same private auth store:", collisionError);
       }
       homeIdsByProfileName.set(profileName, homeId);
       profileNamesByHomeId.set(collisionKey, profileName);
@@ -43855,62 +43896,94 @@ var ProfileManager = class {
     let changed = false;
     const nextMap = {};
     for (const [profileName, raw] of Object.entries(source)) {
-      const record3 = this.fromStateRecord(profileName, raw);
-      if (!record3) {
+      if (this.blockedProfileMigrationErrors.has(profileName)) {
         nextMap[profileName] = raw;
         continue;
       }
-      const nextHomeId = homeIdsByProfileName.get(profileName) ?? record3.homeId;
-      const hasStateCredentials = Boolean(
-        record3.data.id_token || record3.data.access_token || record3.data.refresh_token
-      );
-      const needsHomeId = normalizeProfileHomeId(raw.homeId) === null;
-      if (needsHomeId && record3.homeId !== nextHomeId) {
-        const sourceHome = this.getProfileHomePath(record3.homeId);
-        const targetHome = this.getProfileHomePath(nextHomeId);
-        let sourceExists = true;
-        try {
-          await import_fs.promises.access(sourceHome);
-        } catch (error) {
-          if (!this.isNotFoundError(error)) {
-            throw error;
-          }
-          sourceExists = false;
+      try {
+        let record3 = this.fromStateRecord(profileName, raw);
+        if (!record3) {
+          nextMap[profileName] = raw;
+          continue;
         }
-        if (sourceExists) {
+        const nextHomeId = homeIdsByProfileName.get(profileName) ?? record3.homeId;
+        const hasStateCredentials = Boolean(
+          record3.data.id_token || record3.data.access_token || record3.data.refresh_token
+        );
+        const needsHomeId = normalizeProfileHomeId(raw.homeId) === null;
+        if (needsHomeId && record3.homeId !== nextHomeId) {
+          const sourceHome = this.getProfileHomePath(record3.homeId);
+          const targetHome = this.getProfileHomePath(nextHomeId);
+          let sourceExists = true;
           try {
-            await import_fs.promises.access(targetHome);
-            throw new Error(
-              `Profile '${profileName}' cannot migrate its private auth store because the target already exists.`
-            );
+            await import_fs.promises.access(sourceHome);
           } catch (error) {
             if (!this.isNotFoundError(error)) {
               throw error;
             }
+            sourceExists = false;
           }
-          const releaseGuard = await this.acquireProfileHomeMutationGuard(record3);
-          try {
-            await import_fs.promises.rename(sourceHome, targetHome);
-          } finally {
-            await releaseGuard();
+          if (sourceExists) {
+            let targetExists = true;
+            try {
+              await import_fs.promises.access(targetHome);
+            } catch (error) {
+              if (!this.isNotFoundError(error)) {
+                throw error;
+              }
+              targetExists = false;
+            }
+            if (targetExists) {
+              const sourceHydration = await this.hydrateProfileRecordWithStatus(record3);
+              let targetAuth = null;
+              try {
+                const targetRaw = await this.readProfileAuthFile(
+                  (0, import_path2.join)(targetHome, "auth.json")
+                );
+                targetAuth = targetRaw ? JSON.parse(targetRaw) : null;
+              } catch (error) {
+                logWarn(
+                  `Deferred private auth migration for '${profileName}' because the existing target could not be verified:`,
+                  error
+                );
+              }
+              if (!sourceHydration.cacheable || !targetAuth || !this.activeAuthMatchesRecord(targetAuth, sourceHydration.record)) {
+                logWarn(
+                  `Deferred private auth migration for '${profileName}' because the existing target belongs to unverified credentials.`
+                );
+                nextMap[profileName] = raw;
+                continue;
+              }
+              record3 = sourceHydration.record;
+            } else {
+              const releaseGuard = await this.acquireProfileHomeMutationGuard(record3);
+              try {
+                await import_fs.promises.rename(sourceHome, targetHome);
+              } finally {
+                await releaseGuard();
+              }
+            }
           }
         }
-      }
-      record3.homeId = nextHomeId;
-      if (!hasStateCredentials && !needsHomeId && raw.credentialsSource === "profile-home") {
-        nextMap[profileName] = raw;
-        continue;
-      }
-      const hydration = await this.hydrateProfileRecordWithStatus(record3);
-      if (!hasStateCredentials && !hydration.cacheable) {
-        nextMap[profileName] = this.toStateRecord(record3);
+        record3.homeId = nextHomeId;
+        if (!hasStateCredentials && !needsHomeId && raw.credentialsSource === "profile-home") {
+          nextMap[profileName] = raw;
+          continue;
+        }
+        const hydration = await this.hydrateProfileRecordWithStatus(record3);
+        if (!hasStateCredentials && !hydration.cacheable) {
+          nextMap[profileName] = this.toStateRecord(record3);
+          changed = true;
+          continue;
+        }
+        nextMap[profileName] = this.toStateRecord(
+          await this.hydrateProfileRecordStrict(hydration.record)
+        );
         changed = true;
-        continue;
+      } catch (error) {
+        nextMap[profileName] = raw;
+        logWarn(`Deferred private auth migration for '${profileName}':`, error);
       }
-      nextMap[profileName] = this.toStateRecord(
-        await this.hydrateProfileRecordStrict(hydration.record)
-      );
-      changed = true;
     }
     if (changed) {
       this.profileRecordIndexCache = null;
@@ -44183,6 +44256,48 @@ var ProfileManager = class {
     }
     return result2;
   }
+  async readProfileAuthFile(authPath) {
+    const authLock = await acquireCodexAuthFileReadLock(authPath);
+    if (!authLock) {
+      throw profileMutationError(
+        "PROFILE_HOME_BUSY",
+        "Another CodexUse process is updating this profile auth. Retry after it finishes."
+      );
+    }
+    let result2 = null;
+    let readError = null;
+    let needsWriteRecovery = false;
+    try {
+      const recoveryManifest = await this.readOptionalFile(
+        this.profileAuthCasPaths(authPath).manifest
+      );
+      if (recoveryManifest !== null && authLock.mode === "read") {
+        needsWriteRecovery = true;
+      } else {
+        if (recoveryManifest !== null) {
+          await this.recoverProfileAuthCasIfNeeded(authPath);
+        }
+        result2 = await this.readOptionalFile(authPath);
+      }
+    } catch (error) {
+      readError = error;
+    }
+    try {
+      await authLock.release();
+    } catch (releaseError) {
+      throw errorWithCause("Profile auth read lock could not be released.", {
+        readError,
+        releaseError
+      });
+    }
+    if (readError) {
+      throw readError;
+    }
+    if (needsWriteRecovery) {
+      return this.withProfileAuthFileLock(authPath, async (currentRaw) => currentRaw);
+    }
+    return result2;
+  }
   async replaceProfileAuthIfCurrent(authPath, expectedRaw, replacementRaw) {
     await this.withProfileAuthFileLock(authPath, async (currentRaw) => {
       if (currentRaw !== expectedRaw) {
@@ -44518,13 +44633,14 @@ var ProfileManager = class {
     return (await this.hydrateProfileRecordWithStatus(record3)).record;
   }
   async hydrateProfileRecordWithStatus(record3) {
+    const migrationError = this.blockedProfileMigrationErrors.get(record3.name);
+    if (migrationError) {
+      return { record: record3, cacheable: false };
+    }
     const authPath = import_path.default.join(this.getProfileHomePath(record3.homeId), "auth.json");
     let authRaw;
     try {
-      const recovered = await this.withProfileAuthFileLock(
-        authPath,
-        async (currentRaw) => currentRaw
-      );
+      const recovered = await this.readProfileAuthFile(authPath);
       if (recovered === null) {
         const missing = new Error("Profile auth is missing.");
         missing.code = "ENOENT";
@@ -44627,18 +44743,14 @@ var ProfileManager = class {
     };
   }
   async hydrateProfileRecordStrict(record3) {
+    this.assertProfileHomeUsable(record3.name);
     const authPath = import_path.default.join(this.getProfileHomePath(record3.homeId), "auth.json");
     let activeAuth;
     try {
-      const raw = await this.withProfileAuthFileLock(
-        authPath,
-        async (currentRaw) => {
-          if (currentRaw === null) {
-            throw new Error("Profile auth is missing.");
-          }
-          return currentRaw;
-        }
-      );
+      const raw = await this.readProfileAuthFile(authPath);
+      if (raw === null) {
+        throw new Error("Profile auth is missing.");
+      }
       activeAuth = JSON.parse(raw);
     } catch (error) {
       throw errorWithCause(
@@ -44730,6 +44842,7 @@ var ProfileManager = class {
     return activeDescription.identityKey === targetIdentity && this.normalizeWorkspaceId(activeDescription.workspaceId) === targetWorkspaceId;
   }
   async writeActiveAuthForRecordLocked(record3, expectedSourceFingerprint) {
+    this.assertProfileHomeUsable(record3.name);
     const releaseIntent = await this.acquireProfileHomeWriteIntent(record3);
     try {
       const latest = await this.readStoredProfileRecord(record3.name);
@@ -45026,6 +45139,7 @@ var ProfileManager = class {
   }
   async persistProfileRecord(name, data, metadata, options) {
     const resolvedName = this.normalizeProfileName(name);
+    this.assertProfileHomeUsable(resolvedName);
     const initialMap = await this.readProfilesStateMap();
     const initialState = initialMap[resolvedName] ?? null;
     const storedExisting = initialState ? this.fromStateRecord(resolvedName, initialState) : null;
@@ -46651,6 +46765,7 @@ var ProfileManager = class {
     await this.initialize();
     const sourceName = this.normalizeProfileName(oldName);
     const targetName = this.normalizeProfileName(newName);
+    this.assertProfileHomeUsable(sourceName);
     const initialProfiles = await this.readProfilesStateMap();
     const expectedSourceState = initialProfiles[sourceName] ?? null;
     const existing = expectedSourceState ? this.fromStateRecord(sourceName, expectedSourceState) : null;
@@ -51673,7 +51788,7 @@ async function ensureCliStorageReady() {
 }
 
 // src/app/main.ts
-var VERSION = true ? "5.6.0" : "0.0.0";
+var VERSION = true ? "5.6.2" : "0.0.0";
 async function runCli() {
   const args2 = process.argv.slice(2);
   if (args2.length === 0) {