Fix remaining Windows sync review issues

Author: ndycode

index.ts

@@ -127,7 +127,6 @@ import {
 	StorageError,
 	formatStorageErrorHint,
 	withAccountAndFlaggedStorageTransaction,
-	withFlaggedAccountsTransaction,
 	type AccountStorageV3,
 	type FlaggedAccountMetadataV1,
 } from "./lib/storage.js";
@@ -3428,7 +3427,7 @@ while (attempted.size < Math.max(1, accountCount)) {
 										return;
 									} catch (error) {
 										const code = (error as NodeJS.ErrnoException).code;
-										if ((code === "EPERM" || code === "EBUSY")) {
+										if ((code === "EPERM" || code === "EBUSY" || code === "EACCES")) {
 											lastError = error as NodeJS.ErrnoException;
 											const delayMs = SYNC_PRUNE_BACKUP_RENAME_RETRY_DELAYS_MS[attempt];
 											if (delayMs !== undefined) {

lib/codex-multi-auth-sync.ts

@@ -122,6 +122,8 @@ interface PreparedCodexMultiAuthPreviewStorage {
 const TEMP_CLEANUP_RETRY_DELAYS_MS = [100, 250, 500] as const;
 const STALE_TEMP_CLEANUP_RETRY_DELAY_MS = 150;
 const TEMP_CLEANUP_RETRYABLE_CODES = new Set(["EBUSY", "EAGAIN", "EACCES", "EPERM", "ENOTEMPTY"]);
+const BACKUP_RENAME_RETRY_DELAYS_MS = [100, 250, 500] as const;
+const BACKUP_RENAME_RETRYABLE_CODES = new Set(["EBUSY", "EACCES", "EPERM"]);
 
 function sleepAsync(ms: number): Promise<void> {
 	return new Promise((resolve) => setTimeout(resolve, ms));
@@ -257,6 +259,37 @@ async function scrubStaleNormalizedImportTempFile(candidateDir: string): Promise
 		if (code === "ENOENT" || code === "EACCES" || code === "EPERM" || code === "EBUSY" || code === "EAGAIN") {
 			return;
 		}
+		logWarn(
+			`Failed to scrub stale codex sync temp file ${tempPath}: ${
+				error instanceof Error ? error.message : String(error)
+			}`,
+		);
+	}
+}
+
+async function renameOverlapCleanupBackupWithRetry(sourcePath: string, destinationPath: string): Promise<void> {
+	let lastError: NodeJS.ErrnoException | null = null;
+
+	for (let attempt = 0; attempt < BACKUP_RENAME_RETRY_DELAYS_MS.length; attempt += 1) {
+		try {
+			await fs.rename(sourcePath, destinationPath);
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code && BACKUP_RENAME_RETRYABLE_CODES.has(code)) {
+				lastError = error as NodeJS.ErrnoException;
+				const delayMs = BACKUP_RENAME_RETRY_DELAYS_MS[attempt];
+				if (delayMs !== undefined) {
+					await sleepAsync(delayMs);
+					continue;
+				}
+			}
+			throw error;
+		}
+	}
+
+	if (lastError) {
+		throw lastError;
 	}
 }
 
@@ -1245,7 +1278,7 @@ export async function cleanupCodexMultiAuthSyncedOverlaps(
 					mode: 0o600,
 					flag: "wx",
 				});
-				await fs.rename(tempBackupPath, backupPath);
+				await renameOverlapCleanupBackupWithRetry(tempBackupPath, backupPath);
 				writtenBackupPath = backupPath;
 			} catch (error) {
 				try {

test/codex-multi-auth-sync.test.ts

@@ -1080,6 +1080,66 @@ describe("codex-multi-auth sync", () => {
 		}
 	});
 
+	it("warns when stale sync temp scrubbing hits an unexpected truncate error", async () => {
+		const rootDir = join(process.cwd(), ".tmp-codex-multi-auth");
+		const fakeHome = await fs.promises.mkdtemp(join(os.tmpdir(), "codex-sync-home-"));
+		process.env.CODEX_MULTI_AUTH_DIR = rootDir;
+		process.env.HOME = fakeHome;
+		process.env.USERPROFILE = fakeHome;
+		const globalPath = join(rootDir, "openai-codex-accounts.json");
+		const tempRoot = join(fakeHome, ".opencode", "tmp");
+		const staleDir = join(tempRoot, "oc-chatgpt-multi-auth-sync-stale-scrub-warning");
+		const staleFile = join(staleDir, "accounts.json");
+		mockExistsSync.mockImplementation((candidate) => String(candidate) === globalPath);
+		mockSourceStorageFile(
+			globalPath,
+			JSON.stringify({
+				version: 3,
+				activeIndex: 0,
+				activeIndexByFamily: {},
+				accounts: [{ accountId: "org-source", organizationId: "org-source", refreshToken: "rt-source", addedAt: 1, lastUsed: 1 }],
+			}),
+		);
+
+		const originalRm = fs.promises.rm.bind(fs.promises);
+		const rmSpy = vi.spyOn(fs.promises, "rm").mockImplementation(async (path, options) => {
+			if (String(path) === staleDir) {
+				throw Object.assign(new Error("still locked"), { code: "EBUSY" });
+			}
+			return originalRm(path, options as never);
+		});
+		const truncateSpy = vi.spyOn(fs.promises, "truncate").mockImplementation(async (path, len) => {
+			if (String(path) === staleFile) {
+				throw Object.assign(new Error("disk io failed"), { code: "EIO" });
+			}
+			return undefined;
+		});
+		const loggerModule = await import("../lib/logger.js");
+
+		try {
+			await fs.promises.mkdir(staleDir, { recursive: true });
+			await fs.promises.writeFile(staleFile, "sensitive-refresh-token", "utf8");
+			const oldTime = new Date(Date.now() - (15 * 60 * 1000));
+			await fs.promises.utimes(staleDir, oldTime, oldTime);
+			await fs.promises.utimes(staleFile, oldTime, oldTime);
+
+			const { previewSyncFromCodexMultiAuth } = await import("../lib/codex-multi-auth-sync.js");
+			await expect(previewSyncFromCodexMultiAuth(process.cwd())).resolves.toMatchObject({
+				rootDir,
+				accountsPath: globalPath,
+				scope: "global",
+			});
+
+			expect(vi.mocked(loggerModule.logWarn)).toHaveBeenCalledWith(
+				expect.stringContaining(`Failed to scrub stale codex sync temp file ${staleFile}: disk io failed`),
+			);
+		} finally {
+			rmSpy.mockRestore();
+			truncateSpy.mockRestore();
+			await fs.promises.rm(fakeHome, { recursive: true, force: true });
+		}
+	});
+
 	it("skips source accounts whose emails already exist locally during sync", async () => {
 		const rootDir = join(process.cwd(), ".tmp-codex-multi-auth");
 		process.env.CODEX_MULTI_AUTH_DIR = rootDir;
@@ -1657,14 +1717,17 @@ describe("codex-multi-auth sync", () => {
 			expect(persist).not.toHaveBeenCalled();
 	});
 
-	it("writes overlap cleanup backups via a temp file before rename", async () => {
+	it("writes overlap cleanup backups via a temp file and retries transient EACCES renames", async () => {
 			const storageModule = await import("../lib/storage.js");
 			vi.mocked(storageModule.withAccountStorageTransaction).mockImplementationOnce(async (handler) =>
 					handler(defaultTransactionalStorage(), vi.fn(async () => {})),
 			);
 			const mkdirSpy = vi.spyOn(fs.promises, "mkdir").mockResolvedValue(undefined);
 			const writeSpy = vi.spyOn(fs.promises, "writeFile").mockResolvedValue(undefined);
-			const renameSpy = vi.spyOn(fs.promises, "rename").mockResolvedValue(undefined);
+			const renameSpy = vi
+				.spyOn(fs.promises, "rename")
+				.mockRejectedValueOnce(Object.assign(new Error("rename locked"), { code: "EACCES" }))
+				.mockResolvedValueOnce(undefined);
 			const unlinkSpy = vi.spyOn(fs.promises, "unlink").mockResolvedValue(undefined);
 
 			try {
@@ -1675,6 +1738,7 @@ describe("codex-multi-auth sync", () => {
 					const tempBackupPath = writeSpy.mock.calls[0]?.[0];
 					expect(String(tempBackupPath)).toMatch(/^\/tmp\/overlap-cleanup-backup\.json\.\d+\.[a-z0-9]+\.tmp$/);
 					expect(renameSpy).toHaveBeenCalledWith(tempBackupPath, "/tmp/overlap-cleanup-backup.json");
+					expect(renameSpy).toHaveBeenCalledTimes(2);
 					expect(unlinkSpy).not.toHaveBeenCalled();
 			} finally {
 					mkdirSpy.mockRestore();

test/index.test.ts

@@ -2116,7 +2116,7 @@ describe("OpenAIOAuthPlugin", () => {
 	});
 
 	describe("sync maintenance flows", () => {
-		it("shows overlap cleanup backup hints only when cleanup reports a written backup", async () => {
+		it("shows the locally tracked overlap cleanup backup path when cleanup fails", async () => {
 			const cliModule = await import("../lib/cli.js");
 			const confirmModule = await import("../lib/ui/confirm.js");
 			const syncModule = await import("../lib/codex-multi-auth-sync.js");
@@ -2341,7 +2341,7 @@ describe("OpenAIOAuthPlugin", () => {
 			const writeSpy = vi.spyOn(nodeFsPromises, "writeFile").mockResolvedValue(undefined);
 			const renameSpy = vi
 				.spyOn(nodeFsPromises, "rename")
-				.mockRejectedValueOnce(Object.assign(new Error("rename locked"), { code: "EPERM" }))
+				.mockRejectedValueOnce(Object.assign(new Error("rename locked"), { code: "EACCES" }))
 				.mockResolvedValueOnce(undefined);
 			const normalizePath = (value: string) => value.replace(/\\/g, "/");
 			const now = Date.now();