npm - @bitkyc08/opencodex - Versions diffs - 2.7.21 → 2.7.23 - Mend

@bitkyc08/opencodex 2.7.21 → 2.7.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/gui/dist/assets/{index-CILVKWmx.css → index-Bk_GgFrh.css} +1 -1
package/gui/dist/assets/index-DQjt6Hly.js +40 -0
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/src/claude/outbound.ts +15 -4
package/src/cli/index.ts +1 -1
package/src/codex/auth-api.ts +7 -6
package/src/codex/quota.ts +13 -27
package/src/codex/routing.ts +1 -2
package/src/lib/abort.ts +55 -0
package/src/lib/upstream-retry.ts +62 -0
package/src/oauth/index.ts +82 -24
package/src/oauth/local-token-detect.ts +23 -1
package/src/oauth/store.ts +51 -31
package/src/oauth/xai.ts +17 -10
package/src/providers/quota.ts +2 -6
package/src/providers/registry.ts +38 -13
package/src/providers/xai-transport.ts +107 -60
package/src/responses/parser.ts +59 -17
package/src/server/claude-messages.ts +240 -14
package/src/server/management-api.ts +3 -3
package/src/server/request-log.ts +13 -1
package/src/server/responses.ts +67 -18
package/src/types.ts +13 -0
package/src/usage/log.ts +11 -0
package/gui/dist/assets/index-DYIS0tTL.js +0 -40

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DYIS0tTL.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CILVKWmx.css">
+    <script type="module" crossorigin src="/assets/index-DQjt6Hly.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-Bk_GgFrh.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.21",
+  "version": "2.7.23",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/claude/outbound.ts CHANGED Viewed

@@ -9,6 +9,7 @@
  *  - message_delta.usage is cumulative; message_start embeds a full message snapshot.
  *  - errors: {type:"error", error:{type,message}}; may arrive mid-stream after HTTP 200.
  */
+import { isTransientUpstreamStatus } from "../lib/upstream-retry";
 type Rec = Record<string, unknown>;
@@ -202,12 +203,19 @@ export function responsesSseToAnthropicSse(
         });
         emit("message_stop", { type: "message_stop" });
       };
-      const fail = (status: number, message: string) => {
+      // upstreamDerived: transient upstream statuses become overloaded_error so the
+      // Anthropic-SDK client retries with backoff; proxy-internal exceptions stay
+      // api_error — a deterministic ocx bug must not be masked as retryable
+      // (devlog/_plan/260716_claudecode_hardening/020). On win32 mid-stream socket
+      // resets reach the reader catch (no failed-tail relay) and stay api_error —
+      // same as today, deliberate residual.
+      const fail = (status: number, message: string, upstreamDerived = false) => {
         if (terminated) return;
         terminated = true;
         ensureStarted();
         closeOpenBlock();
-        emit("error", anthropicErrorBody(status, message));
+        const type = upstreamDerived && isTransientUpstreamStatus(status) ? "overloaded_error" : undefined;
+        emit("error", anthropicErrorBody(status, message, type));
       };
       const handleFrame = (eventName: string, data: Rec) => {
@@ -323,7 +331,10 @@ export function responsesSseToAnthropicSse(
             const error = isRec(response.error) ? response.error : {};
             const message = typeof error.message === "string" ? error.message : "upstream request failed";
             const status = typeof error.status === "number" ? error.status : 500;
-            fail(status, message);
+            // status-absent response.failed (relaySseWithFailedTail synthetic tail) defaults
+            // to 500, which is in the transient set — the mid-stream reset shape maps to
+            // overloaded_error by design.
+            fail(status, message, true);
             break;
           }
           default:
@@ -360,7 +371,7 @@ export function responsesSseToAnthropicSse(
           // gateways that close such streams politely hand Claude Code an empty/partial
           // turn with no retryable error — CLIProxyAPI#2189 failure pattern). Fail closed
           // with a mid-stream Anthropic error event so the client can retry.
-          if (!cancelled) fail(502, "upstream stream ended before a terminal frame (truncated response)");
+          if (!cancelled) fail(502, "upstream stream ended before a terminal frame (truncated response)", true);
         } catch (err) {
           fail(500, err instanceof Error ? err.message : String(err));
         } finally {

package/src/cli/index.ts CHANGED Viewed

@@ -500,7 +500,7 @@ switch (command) {
   case "logout": {
     const { removeCredential } = await import("../oauth/store");
     const name = (args[1] ?? "").trim().toLowerCase();
-    removeCredential(name);
+    await removeCredential(name);
     console.log(`Logged out of ${name || "(none)"}.`);
     break;
   }

package/src/codex/auth-api.ts CHANGED Viewed

@@ -237,9 +237,7 @@ async function fetchMainAccountInfo(forceRefresh = false): Promise<{ email: stri
       updateAccountQuota(
         MAIN_CODEX_ACCOUNT_ID,
         result.quota.weeklyPercent,
-        result.quota.fiveHourPercent,
         result.quota.weeklyResetAt,
-        result.quota.fiveHourResetAt,
         result.quota.monthlyPercent,
         result.quota.monthlyResetAt,
         result.quota.resetCredits,
@@ -285,9 +283,7 @@ async function fetchPoolAccountQuota(accountId: string, forceRefresh = false, co
     updateAccountQuota(
       accountId,
       quota.weeklyPercent,
-      quota.fiveHourPercent,
       quota.weeklyResetAt,
-      quota.fiveHourResetAt,
       quota.monthlyPercent,
       quota.monthlyResetAt,
       quota.resetCredits,
@@ -574,6 +570,13 @@ export async function handleCodexAuthAPI(
       const { startLoginFlow, getLoginStatus } = await import("../oauth");
       const result = await startLoginFlow("chatgpt", { forceLogin: true });
+      // Open the browser server-side (same pattern as /api/oauth/login in management-api.ts).
+      // The GUI's window.open is popup-blocked because it runs after an await, not a direct click.
+      if (result.url) {
+        const { openUrl } = await import("../lib/open-url");
+        openUrl(result.url);
+      }
       (async () => {
         let completed = false;
         for (let i = 0; i < 150; i++) {
@@ -644,9 +647,7 @@ export async function handleCodexAuthAPI(
                 updateAccountQuota(
                   accountId,
                   quota.weeklyPercent,
-                  quota.fiveHourPercent,
                   quota.weeklyResetAt,
-                  quota.fiveHourResetAt,
                   quota.monthlyPercent,
                   quota.monthlyResetAt,
                   quota.resetCredits,

package/src/codex/quota.ts CHANGED Viewed

@@ -1,9 +1,7 @@
 export type StoredAccountQuota = {
   weeklyPercent?: number;
-  fiveHourPercent?: number;
   monthlyPercent?: number;
   weeklyResetAt?: number;
-  fiveHourResetAt?: number;
   monthlyResetAt?: number;
   resetCredits?: number;
   updatedAt: number;
@@ -47,48 +45,38 @@ function normalizeResetAt(value: unknown): number | undefined {
 }
 function hasKnownQuotaValue(quota: Omit<StoredAccountQuota, "updatedAt">): boolean {
-  return [quota.weeklyPercent, quota.fiveHourPercent, quota.monthlyPercent]
+  return [quota.weeklyPercent, quota.monthlyPercent]
     .some(value => typeof value === "number" && Number.isFinite(value));
 }
 export function updateAccountQuota(
   accountId: string,
   weekly: unknown,
-  fiveHour: unknown,
   weeklyResetAt?: unknown,
-  fiveHourResetAt?: unknown,
   monthly?: unknown,
   monthlyResetAt?: unknown,
   resetCredits?: number,
 ): void {
   const existing = accountQuota.get(accountId);
   const nextWeekly = normalizeUsagePercent(weekly);
-  const nextFiveHour = normalizeUsagePercent(fiveHour);
   const nextMonthly = normalizeUsagePercent(monthly);
-  if (nextWeekly === undefined && nextFiveHour === undefined && nextMonthly === undefined && resetCredits === undefined) return;
+  if (nextWeekly === undefined && nextMonthly === undefined && resetCredits === undefined) return;
   const quota: StoredAccountQuota = {
     ...(existing?.weeklyPercent !== undefined ? { weeklyPercent: existing.weeklyPercent } : {}),
-    ...(existing?.fiveHourPercent !== undefined ? { fiveHourPercent: existing.fiveHourPercent } : {}),
     ...(existing?.monthlyPercent !== undefined ? { monthlyPercent: existing.monthlyPercent } : {}),
     ...(existing?.weeklyResetAt !== undefined ? { weeklyResetAt: existing.weeklyResetAt } : {}),
-    ...(existing?.fiveHourResetAt !== undefined ? { fiveHourResetAt: existing.fiveHourResetAt } : {}),
     ...(existing?.monthlyResetAt !== undefined ? { monthlyResetAt: existing.monthlyResetAt } : {}),
     ...(existing?.resetCredits !== undefined ? { resetCredits: existing.resetCredits } : {}),
     updatedAt: Date.now(),
   };
   const nextWeeklyResetAt = normalizeResetAt(weeklyResetAt);
-  const nextFiveHourResetAt = normalizeResetAt(fiveHourResetAt);
   const nextMonthlyResetAt = normalizeResetAt(monthlyResetAt);
   if (nextWeekly !== undefined) {
     quota.weeklyPercent = nextWeekly;
     if (nextWeeklyResetAt !== undefined) quota.weeklyResetAt = nextWeeklyResetAt;
   }
-  if (nextFiveHour !== undefined) {
-    quota.fiveHourPercent = nextFiveHour;
-    if (nextFiveHourResetAt !== undefined) quota.fiveHourResetAt = nextFiveHourResetAt;
-  }
   if (nextMonthly !== undefined) {
     quota.monthlyPercent = nextMonthly;
     if (nextMonthlyResetAt !== undefined) quota.monthlyResetAt = nextMonthlyResetAt;
@@ -122,27 +110,25 @@ export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuot
   const quota: Omit<StoredAccountQuota, "updatedAt"> = {};
   const thirtyDayOnly = data.plan_type?.trim().toLowerCase() === "go" || data.plan_type?.trim().toLowerCase() === "free";
-  const weeklyPercent = normalizeUsagePercent(data.rate_limit.secondary_window?.used_percent);
-  const fiveHourPercent = normalizeUsagePercent(data.rate_limit.primary_window?.used_percent);
+  // primary_window was the 5h window; it now carries weekly data for GPT plans.
+  // secondary_window is the legacy weekly source; prefer primary when present.
+  const primaryPercent = normalizeUsagePercent(data.rate_limit.primary_window?.used_percent);
+  const secondaryPercent = normalizeUsagePercent(data.rate_limit.secondary_window?.used_percent);
+  const weeklyPercent = primaryPercent ?? secondaryPercent;
   const monthlyPercent = normalizeUsagePercent(data.rate_limit.tertiary_window?.used_percent);
-  const weeklyResetAt = normalizeResetAt(data.rate_limit.secondary_window?.reset_at);
-  const fiveHourResetAt = normalizeResetAt(data.rate_limit.primary_window?.reset_at);
+  const primaryResetAt = normalizeResetAt(data.rate_limit.primary_window?.reset_at);
+  const secondaryResetAt = normalizeResetAt(data.rate_limit.secondary_window?.reset_at);
+  const weeklyResetAt = primaryPercent !== undefined ? primaryResetAt : secondaryResetAt;
   const monthlyResetAt = normalizeResetAt(data.rate_limit.tertiary_window?.reset_at);
   if (thirtyDayOnly) {
-    const goMonthlyPercent = monthlyPercent ?? fiveHourPercent;
-    const goMonthlyResetAt = monthlyResetAt ?? fiveHourResetAt;
-    if (goMonthlyPercent !== undefined) {
-      quota.monthlyPercent = goMonthlyPercent;
-      if (goMonthlyResetAt !== undefined) quota.monthlyResetAt = goMonthlyResetAt;
+    if (monthlyPercent !== undefined) {
+      quota.monthlyPercent = monthlyPercent;
+      if (monthlyResetAt !== undefined) quota.monthlyResetAt = monthlyResetAt;
     }
   } else if (weeklyPercent !== undefined) {
     quota.weeklyPercent = weeklyPercent;
     if (weeklyResetAt !== undefined) quota.weeklyResetAt = weeklyResetAt;
   }
-  if (!thirtyDayOnly && fiveHourPercent !== undefined) {
-    quota.fiveHourPercent = fiveHourPercent;
-    if (fiveHourResetAt !== undefined) quota.fiveHourResetAt = fiveHourResetAt;
-  }
   if (!thirtyDayOnly && monthlyPercent !== undefined) {
     quota.monthlyPercent = monthlyPercent;
     if (monthlyResetAt !== undefined) quota.monthlyResetAt = monthlyResetAt;

package/src/codex/routing.ts CHANGED Viewed

@@ -80,7 +80,6 @@ export function getCodexUpstreamHealth(
 export function computeCodexUsageScore(quota: {
   weeklyPercent?: number;
-  fiveHourPercent?: number;
   monthlyPercent?: number;
 } | null, plan?: string | null): number {
   if (!quota) return CODEX_UNKNOWN_USAGE_SCORE;
@@ -90,7 +89,7 @@ export function computeCodexUsageScore(quota: {
       ? quota.monthlyPercent
       : CODEX_UNKNOWN_USAGE_SCORE;
   }
-  const values = [quota.weeklyPercent, quota.fiveHourPercent, quota.monthlyPercent]
+  const values = [quota.weeklyPercent, quota.monthlyPercent]
     .filter((value): value is number => typeof value === "number" && Number.isFinite(value));
   return values.length > 0 ? Math.max(...values) : CODEX_UNKNOWN_USAGE_SCORE;
 }

package/src/lib/abort.ts CHANGED Viewed

@@ -14,6 +14,61 @@ export interface ClearableDeadline {
   clear: () => void;
 }
+export interface IdleDeadline {
+  /** (Re-)arm the timer for one idle window. Call when a wait for progress BEGINS. No-op after fire/cancel. */
+  reset: () => void;
+  /** Disarm the timer WITHOUT retiring the deadline (call when the awaited progress arrives). No-op after fire/cancel. */
+  pause: () => void;
+  /** Retire permanently (success/teardown paths). Idempotent. */
+  cancel: () => void;
+}
+/**
+ * Resettable inactivity deadline (devlog 260716_passthrough_followups/010).
+ *
+ * Fires `onIdle` at most ONCE after `idleMs` elapses with no `reset()`/`pause()`.
+ * Contract:
+ * - `idleMs <= 0` returns an inert no-op deadline — the 0-disable responsibility
+ *   lives here so callers cannot mis-handle it.
+ * - The timer starts DISARMED: callers arm it with `reset()` when a wait begins and
+ *   `pause()` it when the wait settles, so pull-based relays never count downstream
+ *   backpressure (no pending read) as upstream inactivity.
+ * - First terminal wins: after `onIdle` runs or `cancel()` is called, every method
+ *   is a no-op and `onIdle` never runs again.
+ * - Never linked to fetch signals — the consumer decides how to kill its stream
+ *   (e.g. reader.cancel), keeping body-lifetime semantics unchanged.
+ */
+export function idleDeadline(idleMs: number, onIdle: () => void): IdleDeadline {
+  if (idleMs <= 0) return { reset: () => {}, pause: () => {}, cancel: () => {} };
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let done = false;
+  const disarm = () => {
+    if (timer !== undefined) clearTimeout(timer);
+    timer = undefined;
+  };
+  return {
+    reset: () => {
+      if (done) return;
+      disarm();
+      timer = setTimeout(() => {
+        if (done) return;
+        done = true;
+        timer = undefined;
+        onIdle();
+      }, idleMs);
+    },
+    pause: () => {
+      if (done) return;
+      disarm();
+    },
+    cancel: () => {
+      if (done) return;
+      done = true;
+      disarm();
+    },
+  };
+}
 /**
  * Response-header deadline whose timer can be cleared without severing body-lifetime cancellation.
  *

package/src/lib/upstream-retry.ts CHANGED Viewed

@@ -21,6 +21,25 @@ const RESET_RETRY_MAX_ATTEMPTS = 3;
 const RESET_RETRY_BASE_DELAY_MS = 150;
 const RESET_RETRY_MAX_DELAY_MS = 1_000;
+// Transient-5xx status retry layer (pre-stream only; devlog/_plan/260716_claudecode_hardening/010).
+const TRANSIENT_RETRY_MAX_ATTEMPTS = 3; // 1 initial + 2 retries
+const TRANSIENT_RETRY_BASE_DELAY_MS = 400;
+const TRANSIENT_RETRY_MAX_DELAY_MS = 5_000;
+// A failed attempt slower than this is the "slow 502" incident shape (191s observed on
+// 2026-07-15): retrying it only duplicates upstream load past client timeouts — return it.
+const TRANSIENT_RETRY_SLOW_ATTEMPT_MS = 15_000;
+/**
+ * Upstream statuses treated as transient: gateway errors and Cloudflare 52x.
+ * 500 is included per the OpenAI SDK default (auto-retries >=500; Tier-2 proven in
+ * devlog/260716_ocx_claude_sol_502_midstream/02). 507 was observed in the 48h ledger
+ * but is deliberately excluded (storage-class, not gateway-transient).
+ */
+export function isTransientUpstreamStatus(status: number): boolean {
+  return status === 500 || status === 502 || status === 503 || status === 504
+    || status === 520 || status === 521 || status === 522;
+}
 export interface RetryBackoffOptions {
   baseDelayMs: number;
   maxDelayMs: number;
@@ -121,6 +140,11 @@ export interface ResetRetryOptions {
   attempts?: number;
 }
+export interface TransientRetryOptions extends ResetRetryOptions {
+  /** Test seam: per-attempt slow budget override (defaults to TRANSIENT_RETRY_SLOW_ATTEMPT_MS). */
+  slowAttemptMs?: number;
+}
 /**
  * Run `doFetch`, retrying only connection-reset-shaped rejections (see
  * isConnectionResetError) with jittered backoff. The caller's thunk must be replay-safe
@@ -150,3 +174,41 @@ export async function fetchWithResetRetry(
   }
   throw lastError ?? new Error("upstream fetch failed");
 }
+/**
+ * fetchWithResetRetry plus a transient-5xx status retry layer, PRE-STREAM only: a
+ * returned Response has by definition not been relayed to the client yet, so replaying
+ * the (string-body) request is safe. The failed attempt's body is cancelled before the
+ * retry; every returned response (ok, non-transient, aborted, slow, exhausted) keeps
+ * its body intact. Honors Retry-After via retryBackoffDelayMs.
+ *
+ * A failed attempt slower than the slow budget is returned as-is (slow-502 shape);
+ * note `opts.attempts` is shared with the inner reset layer (no caller passes it today).
+ */
+export async function fetchWithTransientRetry(
+  doFetch: () => Promise<Response>,
+  opts: TransientRetryOptions = {},
+): Promise<Response> {
+  const attempts = Math.max(1, opts.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS);
+  const slowAttemptMs = opts.slowAttemptMs ?? TRANSIENT_RETRY_SLOW_ATTEMPT_MS;
+  let attemptStart = Date.now();
+  let res = await fetchWithResetRetry(doFetch, opts);
+  for (let attempt = 0; attempt < attempts - 1; attempt++) {
+    if (res.ok || !isTransientUpstreamStatus(res.status)) return res;
+    if (opts.abortSignal?.aborted) return res;
+    if (Date.now() - attemptStart > slowAttemptMs) return res;
+    console.warn(
+      `[upstream-retry] transient ${res.status}${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`,
+    );
+    const delay = retryBackoffDelayMs(attempt, {
+      baseDelayMs: TRANSIENT_RETRY_BASE_DELAY_MS,
+      maxDelayMs: TRANSIENT_RETRY_MAX_DELAY_MS,
+      headers: res.headers,
+    });
+    cancelResponseBodyBestEffort(res);
+    await sleepWithAbort(delay, opts.abortSignal);
+    attemptStart = Date.now();
+    res = await fetchWithResetRetry(doFetch, opts);
+  }
+  return res;
+}

package/src/oauth/index.ts CHANGED Viewed

@@ -3,8 +3,8 @@ import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { loadConfig, resolveEnvValue, saveConfig } from "../config";
 import { maskEmail } from "../lib/privacy";
-import { getAccountCredential, getAccountSet, saveAccountCredential, saveCredential, markAccountNeedsReauth, getCredential } from "./store";
-import { loginXai, refreshXaiToken } from "./xai";
+import { getAccountCredential, getAccountSet, saveAccountCredential, saveCredential, markAccountNeedsReauth, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration } from "./store";
+import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginKiro, readKiroCliSqlite, refreshKiroToken } from "./kiro";
@@ -14,9 +14,22 @@ import { loginCursor, refreshCursorToken } from "./cursor";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { effectiveGoogleMode } from "../providers/registry";
 import { resolveProviderTransport } from "../providers/xai-transport";
+import { detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 const REFRESH_SKEW_MS = 60_000;
-const tokenRefreshes = new Map<string, Promise<string>>();
+export interface OAuthAccessSnapshot {
+  provider: string;
+  accountId: string;
+  generation: string;
+  accessToken: string;
+}
+const tokenRefreshes = new Map<string, Promise<OAuthAccessSnapshot>>();
+const XAI_PERMANENT_FAILURE_TTL_MS=30_000;
+const permanentRefreshFailures=new Map<string,number>();
+interface XaiRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void> }
+function verdictKey(p:string,a:string,c:OAuthCredentials){return `${p}\0${a}\0${credentialGeneration(c)}`;}
+function cached(p:string,a:string,c:OAuthCredentials,now:()=>number){const k=verdictKey(p,a,c),u=permanentRefreshFailures.get(k);if(u===undefined)return false;if(u<=now()){permanentRefreshFailures.delete(k);return false;}return true;}
 export interface LoginOpts { forceLogin?: boolean }
@@ -139,36 +152,74 @@ export class OAuthLoginRequiredError extends Error {
   }
 }
-/** Return a valid access token for the ACTIVE account, refreshing + persisting if expired. */
-export async function getValidAccessToken(provider: string): Promise<string> {
-  const def = OAUTH_PROVIDERS[provider];
-  if (!def) throw new UnsupportedOAuthProviderError(provider);
-  const set = getAccountSet(provider);
-  if (!set) throw new OAuthLoginRequiredError(provider);
-  return getValidAccessTokenForAccount(provider, set.activeAccountId);
+function accessSnapshot(provider: string, accountId: string, cred: OAuthCredentials): OAuthAccessSnapshot {
+  return {
+    provider,
+    accountId,
+    generation: credentialGeneration(cred),
+    accessToken: cred.access,
+  };
 }
-/**
- * Account-scoped token resolver (multiauth): refresh is single-flighted per
- * (provider, account), and the rotated credential is persisted for THAT account only —
- * a guardian refresh of a background account never switches the active account.
- */
-export async function getValidAccessTokenForAccount(provider: string, accountId: string): Promise<string> {
+async function resolveAccessSnapshotForAccount(
+  provider: string,
+  accountId: string,
+  rejectedGeneration?: string,
+): Promise<OAuthAccessSnapshot> {
   const def = OAUTH_PROVIDERS[provider];
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const cred = getAccountCredential(provider, accountId);
   if (!cred) throw new OAuthLoginRequiredError(provider);
-  if (cred.expires > Date.now() + REFRESH_SKEW_MS) return cred.access;
+  const current = accessSnapshot(provider, accountId, cred);
+  if (rejectedGeneration !== undefined && current.generation !== rejectedGeneration) return current;
+  if (rejectedGeneration === undefined && cred.expires > Date.now() + REFRESH_SKEW_MS) return current;
   const key = `${provider}\u0000${accountId}`;
   const existing = tokenRefreshes.get(key);
   if (existing) return existing;
-  const refresh = refreshAndPersistAccessToken(provider, accountId, def, cred).finally(() => {
+  const refresh = (async (): Promise<OAuthAccessSnapshot> => {
+    const accessToken = await refreshAndPersistAccessToken(provider, accountId, def, cred);
+    const persisted = getAccountCredential(provider, accountId);
+    if (!persisted) throw new OAuthLoginRequiredError(provider);
+    if (persisted.access !== accessToken) {
+      throw new Error(`OAuth refresh persisted an unexpected access token for ${provider}`);
+    }
+    return accessSnapshot(provider, accountId, persisted);
+  })().finally(() => {
     if (tokenRefreshes.get(key) === refresh) tokenRefreshes.delete(key);
   });
   tokenRefreshes.set(key, refresh);
   return refresh;
 }
+export async function getValidAccessTokenSnapshot(provider: string): Promise<OAuthAccessSnapshot> {
+  const set = getAccountSet(provider);
+  if (!set) throw new OAuthLoginRequiredError(provider);
+  return resolveAccessSnapshotForAccount(provider, set.activeAccountId);
+}
+export async function forceRefreshOAuthAccessSnapshot(
+  rejected: OAuthAccessSnapshot,
+): Promise<OAuthAccessSnapshot> {
+  if (rejected.provider !== "xai") throw new UnsupportedOAuthProviderError(rejected.provider);
+  return resolveAccessSnapshotForAccount(rejected.provider, rejected.accountId, rejected.generation);
+}
+/** Return a valid access token for the ACTIVE account, refreshing + persisting if expired. */
+export async function getValidAccessToken(provider: string): Promise<string> {
+  return (await getValidAccessTokenSnapshot(provider)).accessToken;
+}
+/**
+ * Account-scoped token resolver (multiauth): refresh is single-flighted per
+ * (provider, account), and the rotated credential is persisted for THAT account only —
+ * a guardian refresh of a background account never switches the active account.
+ */
+export async function getValidAccessTokenForAccount(provider: string, accountId: string): Promise<string> {
+  return (await resolveAccessSnapshotForAccount(provider, accountId)).accessToken;
+}
 function readFreshKiroCliCredential(): OAuthCredentials | undefined {
   const imported = readKiroCliSqlite();
   if (!imported || imported.expires <= Date.now() + REFRESH_SKEW_MS) return undefined;
@@ -180,6 +231,10 @@ function isTerminalRefreshError(err: unknown): boolean {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
   return msg.includes("invalid_grant") || msg.includes("refresh_token_reused") || msg.includes("revoked");
 }
+function terminal(error:unknown):boolean{return error instanceof XaiTokenRequestError?["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??""):isTerminalRefreshError(error);}
+function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OAuthCredentials{if(stored.source!=="local-cli")return stored;const disk=detectGrokCliToken();if(!disk)return stored;const allowed=isSameGrokIdentity(stored,disk)||(active&&!hasComparableGrokIdentity(stored,disk));return allowed&&shouldAdoptGrokGeneration(stored,disk,now(),REFRESH_SKEW_MS)?disk:stored;}
+function merged(fresh:OAuthCredentials,previous:OAuthCredentials):OAuthCredentials{return{...fresh,source:previous.source==="local-cli"?"oauth":fresh.source??previous.source??"oauth",...(fresh.projectId===undefined&&previous.projectId?{projectId:previous.projectId}:{}),...(fresh.email===undefined&&previous.email?{email:previous.email}:{}),...(fresh.accountId===undefined&&previous.accountId?{accountId:previous.accountId}:{})};}
+export async function refreshXaiAccountWithLock(provider:string,accountId:string,def:OAuthProviderDef,callerCredential:OAuthCredentials,deps:XaiRefreshDeps={}):Promise<string>{const now=deps.now??Date.now;const guard=await(deps.intentLock??createOAuthRefreshIntentLock(provider,accountId)).acquire();try{const stored=getAccountCredential(provider,accountId);if(!stored)throw new OAuthLoginRequiredError(provider);const active=getAccountSet(provider)?.activeAccountId===accountId,candidate=authoritative(stored,active,now);if(credentialGeneration(candidate)!==credentialGeneration(callerCredential)&&candidate.expires>now()+REFRESH_SKEW_MS){if(credentialGeneration(candidate)!==credentialGeneration(stored)){const o=await mergeAccountCredential(provider,accountId,candidate,{expectedGeneration:credentialGeneration(stored),afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}}return candidate.access;}if(cached(provider,accountId,candidate,now))throw new OAuthLoginRequiredError(provider);const generation=credentialGeneration(candidate);try{const fresh=merged(await def.refresh(candidate.refresh),candidate);const o=await mergeAccountCredential(provider,accountId,fresh,{expectedGeneration:generation,afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));if(candidate.source==="local-cli")console.warn(XAI_LOCAL_CLI_DETACH_WARNING);return fresh.access;}catch(error){if(!terminal(error))throw error;permanentRefreshFailures.set(verdictKey(provider,accountId,candidate),now()+XAI_PERMANENT_FAILURE_TTL_MS);await markAccountNeedsReauthIfGeneration(provider,accountId,generation);throw new OAuthLoginRequiredError(provider);}}finally{guard.release();}}
 async function refreshAndPersistAccessToken(
   provider: string,
@@ -193,17 +248,20 @@ async function refreshAndPersistAccessToken(
   if (provider === "kiro" && isActive) {
     const imported = readFreshKiroCliCredential();
     if (imported) {
-      saveCredential(provider, imported);
+      await saveCredential(provider, imported);
       return imported.access;
     }
   }
+  if (provider === "xai") return refreshXaiAccountWithLock(provider, accountId, def, cred);
   try {
     const fresh = await def.refresh(cred.refresh);
+    const detachedLocalCli = provider === "xai" && cred.source === "local-cli";
+    if (detachedLocalCli) console.warn(XAI_LOCAL_CLI_DETACH_WARNING);
     // Persist to THIS account (rotation-safe: new refresh token hits disk before use) without
     // touching activeAccountId.
-    saveAccountCredential(provider, accountId, {
+    await saveAccountCredential(provider, accountId, {
       ...fresh,
-      source: fresh.source ?? cred.source ?? "oauth",
+      source: detachedLocalCli ? "oauth" : fresh.source ?? cred.source ?? "oauth",
       // Preserve a previously-discovered project id when a refresh-time re-discovery comes back empty
       // (e.g. a transient network blip), so Antigravity does not lose its CCA project across refresh.
       ...(fresh.projectId === undefined && cred.projectId ? { projectId: cred.projectId } : {}),
@@ -216,12 +274,12 @@ async function refreshAndPersistAccessToken(
     if (provider === "kiro" && isActive) {
       const imported = readFreshKiroCliCredential();
       if (imported) {
-        saveCredential(provider, imported);
+        await saveCredential(provider, imported);
         return imported.access;
       }
     }
     if (isTerminalRefreshError(err)) {
-      markAccountNeedsReauth(provider, accountId, true);
+      await markAccountNeedsReauth(provider, accountId, true);
       throw new OAuthLoginRequiredError(provider);
     }
     throw err;
@@ -352,7 +410,7 @@ export async function runLogin(provider: string, ctrl: OAuthController, opts?: L
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const rawCred = await def.login(ctrl, opts);
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
-  saveCredential(provider, cred);
+  await saveCredential(provider, cred);
   const config = loadConfig();
   upsertOAuthProvider(config, provider);
   saveConfig(config);

package/src/oauth/local-token-detect.ts CHANGED Viewed

@@ -13,7 +13,7 @@ const XAI_AUTH_KEY_PREFIX = "https://auth.x.ai::";
 const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
 export function detectGrokCliToken(): OAuthCredentials | null {
-  const authPath = join(homedir(), ".grok", "auth.json");
+  const authPath = join(process.env.HOME ?? homedir(), ".grok", "auth.json");
   if (!existsSync(authPath)) return null;
   try {
@@ -39,6 +39,28 @@ export function detectGrokCliToken(): OAuthCredentials | null {
   }
 }
+export function hasComparableGrokIdentity(stored: OAuthCredentials, disk: OAuthCredentials): boolean {
+  return Boolean((stored.accountId && disk.accountId) || (stored.email && disk.email));
+}
+export function isSameGrokIdentity(stored: OAuthCredentials, disk: OAuthCredentials): boolean {
+  if (stored.accountId && disk.accountId) return stored.accountId === disk.accountId;
+  if (stored.email && disk.email) return stored.email.toLowerCase() === disk.email.toLowerCase();
+  return false;
+}
+export function shouldAdoptGrokGeneration(
+  stored: OAuthCredentials,
+  disk: OAuthCredentials,
+  now = Date.now(),
+  refreshSkewMs = 60_000,
+): boolean {
+  if (disk.expires <= now + refreshSkewMs) return false;
+  const bothExpiriesExist = stored.expires > 0 && disk.expires > 0;
+  if (bothExpiriesExist) return disk.expires >= stored.expires;
+  return true;
+}
 /** Claude Code config dir: `CLAUDE_CONFIG_DIR` override, else `~/.claude`. */
 function claudeConfigDir(): string {
   const explicit = process.env.CLAUDE_CONFIG_DIR?.trim();