@cortexkit/anthropic-auth-core 1.10.2 → 1.11.0

package/dist/accounts.js

@@ -2,9 +2,9 @@ import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { ClaudeOAuthRefreshError, refreshClaudeOAuthToken } from "./auth.js";
+import { parseRetryAfterHeader, refreshClaudeOAuthToken } from "./auth.js";
 import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from "./constants.js";
-import { log } from "./logger.js";
+import { log, logger } from "./logger.js";
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
@@ -136,12 +136,19 @@ function normalizeOperationError(value) {
         return undefined;
     const nextRetryAt = Number(value.nextRetryAt);
     const retryCount = Number(value.retryCount);
+    const status = Number(value.status);
     return {
         message: value.message,
         checkedAt,
         nextRetryAt: Number.isFinite(nextRetryAt) ? nextRetryAt : undefined,
         retryCount: Number.isFinite(retryCount) ? retryCount : undefined,
         tokenHash: typeof value.tokenHash === 'string' ? value.tokenHash : undefined,
+        // Preserve the dead-token discriminators across save/load. Without these,
+        // a retry-exhausted transient (permanent=false, 24h backoff) would lose its
+        // flag on reload and the 24h-delay heuristic would wrongly re-classify it
+        // permanent → false "needs re-login" nag.
+        status: Number.isFinite(status) ? status : undefined,
+        permanent: typeof value.permanent === 'boolean' ? value.permanent : undefined,
     };
 }
 function normalizeQuota(value) {
@@ -169,6 +176,15 @@ function normalizeQuota(value) {
     }
     return Object.keys(quota).length ? quota : undefined;
 }
+// Fresh empty storage shell — main OpenCode OAuth account, no fallback
+// accounts. Returns a new object each call so mutating callers don't alias.
+export function createEmptyStorage() {
+    return {
+        version: 1,
+        main: { type: 'opencode', provider: 'anthropic' },
+        accounts: [],
+    };
+}
 function normalizeStorage(value) {
     if (!isRecord(value) || !Array.isArray(value.accounts))
         return null;
@@ -187,6 +203,7 @@ function normalizeStorage(value) {
         costZeroing: isRecord(value.costZeroing) ? value.costZeroing : undefined,
         cacheKeep: isRecord(value.cacheKeep) ? value.cacheKeep : undefined,
         relay: isRecord(value.relay) ? value.relay : undefined,
+        logging: isRecord(value.logging) ? value.logging : undefined,
         killswitch: isRecord(value.killswitch) ? value.killswitch : undefined,
         accounts: value.accounts
             .map(normalizeAccount)
@@ -201,7 +218,8 @@ async function readJsonIfPresent(path) {
         if (error.code === 'ENOENT') {
             return { exists: false, value: null };
         }
-        return { exists: false, value: null };
+        const cause = error instanceof Error ? error.message : String(error);
+        throw new Error(`account store at ${path} is corrupt or unreadable (${cause}) — fix or remove it`);
     }
 }
 function objectWithDefinedEntries(value) {
@@ -248,10 +266,14 @@ function mergeConfigAndState(configValue, stateValue) {
 }
 export async function loadAccounts(path = getAccountStoragePath()) {
     const config = await readJsonIfPresent(path);
-    if (!config.exists)
-        return null;
     const state = await readJsonIfPresent(getAccountStatePath(path));
-    return normalizeStorage(mergeConfigAndState(config.value, state.value));
+    // Runtime-only flows (main-OAuth refresh with no fallback accounts) write the
+    // state file but never the config file, so the store is absent only when
+    // neither exists. Synthesize an empty config to merge state into otherwise.
+    if (!config.exists && !state.exists)
+        return null;
+    const configValue = config.exists ? config.value : createEmptyStorage();
+    return normalizeStorage(mergeConfigAndState(configValue, state.value));
 }
 async function loadExistingTopLevelFields(path) {
     const existing = await readJsonIfPresent(path);
@@ -356,6 +378,7 @@ function configFromStorage(storage) {
         quota,
         claudeCache: storage.claudeCache,
         dump: storage.dump,
+        logging: storage.logging,
         claudeFast: storage.claudeFast,
         costZeroing: storage.costZeroing,
         cacheKeep: storage.cacheKeep,
@@ -364,25 +387,16 @@ function configFromStorage(storage) {
         accounts: storage.accounts.map(accountConfig),
     });
 }
-function stateFromStorage(storage) {
-    const accounts = Object.fromEntries(storage.accounts.map((account) => [
-        account.id,
-        accountRuntimeState(account),
-    ]));
-    return {
-        version: 1,
-        main: objectWithDefinedEntries({
-            quota: storage.quota?.mainQuota,
-            quotaCheckedAt: storage.quota?.mainQuotaCheckedAt,
-            quotaToken: storage.quota?.mainQuotaToken,
-            lastQuotaApiError: storage.quota?.mainLastQuotaApiError,
-            lastRefreshError: storage.refresh?.mainLastRefreshError,
-            refreshLeaseId: storage.refresh?.mainRefreshLeaseId,
-            refreshLeaseUntil: storage.refresh?.mainRefreshLeaseUntil,
-            refreshLeaseTokenHash: storage.refresh?.mainRefreshLeaseTokenHash,
-        }),
-        accounts,
-    };
+// ---------------------------------------------------------------------------
+// In-process save mutex — serializes all account-store writes so concurrent
+// read-modify-write callers (background timers that call saveAccountState with
+// different section flags) don't lose each other's updates (#9).
+// ---------------------------------------------------------------------------
+let saveChain = Promise.resolve();
+function enqueueSave(fn) {
+    return new Promise((resolve, reject) => {
+        saveChain = saveChain.then(() => fn().then(resolve, reject), () => fn().then(resolve, reject));
+    });
 }
 async function writeJsonAtomic(path, value) {
     await mkdir(dirname(path), { recursive: true });
@@ -391,13 +405,27 @@ async function writeJsonAtomic(path, value) {
         encoding: 'utf8',
         mode: 0o600,
     });
-    await rename(tempPath, path);
+    try {
+        await rename(tempPath, path);
+    }
+    catch (error) {
+        await rm(tempPath, { force: true }).catch(() => { });
+        throw error;
+    }
 }
-export async function saveAccounts(storage, path = getAccountStoragePath()) {
+export function saveAccounts(storage, path = getAccountStoragePath()) {
+    const resolvedPath = path;
+    return enqueueSave(() => saveAccountsLocked(storage, resolvedPath));
+}
+async function saveAccountsLocked(storage, path) {
     const existing = await loadExistingTopLevelFields(path);
     const nextConfig = { ...existing, ...configFromStorage(storage) };
     await writeJsonAtomic(path, nextConfig);
-    await writeJsonAtomic(getAccountStatePath(path), stateFromStorage(storage));
+    await saveAccountStateUnlocked(storage, path, {
+        mainQuota: true,
+        mainRefresh: true,
+        accounts: true,
+    });
 }
 function applyMainQuotaStatePatch(state, storage) {
     state.main = state.main ?? {};
@@ -430,11 +458,15 @@ function pruneUndefined(value) {
         .filter(([, entry]) => entry !== undefined)
         .map(([key, entry]) => [key, pruneUndefined(entry)]));
 }
-export async function saveAccountState(storage, path = getAccountStoragePath(), scope = {
+export function saveAccountState(storage, path = getAccountStoragePath(), scope = {
     mainQuota: true,
     mainRefresh: true,
     accounts: true,
 }) {
+    const resolvedPath = path;
+    return enqueueSave(() => saveAccountStateUnlocked(storage, resolvedPath, scope));
+}
+async function saveAccountStateUnlocked(storage, path, scope) {
     const statePath = getAccountStatePath(path);
     const existing = (await readJsonIfPresent(statePath)).value;
     const next = isRecord(existing)
@@ -459,6 +491,19 @@ export async function saveAccountState(storage, path = getAccountStoragePath(),
                 }
             }
         }
+        else {
+            // Full save: drop any per-account state whose id is no longer present in
+            // storage.accounts. The scoped path above only prunes ids it was asked to
+            // save; on a removal the storage is saved with scope.accounts === true
+            // (ids === null), so without this branch the removed account's runtime
+            // state (quota/lastRefreshError/access/refresh/expires) would be orphaned
+            // in the state file and later merged onto a re-added same-id account.
+            const present = new Set(storage.accounts.map((account) => account.id));
+            for (const id of Object.keys(next.accounts)) {
+                if (!present.has(id))
+                    delete next.accounts[id];
+            }
+        }
     }
     await writeJsonAtomic(statePath, pruneUndefined(next));
 }
@@ -521,26 +566,134 @@ export async function acquireRefreshFileLock(options) {
         if ('unref' in renewTimer)
             renewTimer.unref();
     }
-    if (!(await tryAcquire())) {
-        try {
-            const owner = await readOwner();
-            if (Number(owner?.expiresAt) > now())
-                return null;
+    let acquired = await tryAcquire();
+    if (!acquired) {
+        const evictPath = `${lockPath}.evicting`;
+        const evictOwnerPath = join(evictPath, 'owner.json');
+        const evictOwnerId = randomUUID();
+        const EVICT_TTL = 5_000;
+        const MAX_STEAL_ATTEMPTS = 8;
+        async function backoff() {
+            await new Promise((resolve) => setTimeout(resolve, Math.floor(Math.random() * 4)));
         }
-        catch {
+        async function lockIsLive() {
             try {
-                const current = await stat(lockPath);
-                if (current.mtimeMs + options.ttlMs > Date.now())
-                    return null;
+                const currentOwner = await readOwner();
+                return Number(currentOwner?.expiresAt) > now();
+            }
+            catch {
+                try {
+                    const current = await stat(lockPath);
+                    return current.mtimeMs + options.ttlMs > now();
+                }
+                catch {
+                    // Lock doesn't exist — safe to acquire.
+                    return false;
+                }
+            }
+        }
+        async function ownsEvictionMarker() {
+            try {
+                const owner = JSON.parse(await readFile(evictOwnerPath, 'utf8'));
+                return owner?.ownerId === evictOwnerId;
             }
             catch {
+                return false;
+            }
+        }
+        async function tryAcquireEvictionMarker() {
+            await mkdir(evictPath);
+            try {
+                await writeFile(evictOwnerPath, `${JSON.stringify({ ownerId: evictOwnerId, createdAt: now() })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return false;
+                await releaseEvictionMarker();
+                throw error;
+            }
+            await options.onStep?.('eviction-marker-acquired');
+            return true;
+        }
+        async function releaseEvictionMarker() {
+            if (await ownsEvictionMarker()) {
+                await rm(evictPath, { recursive: true, force: true }).catch(() => { });
+            }
+        }
+        for (let attempt = 0; attempt < MAX_STEAL_ATTEMPTS; attempt++) {
+            acquired = await tryAcquire();
+            if (acquired)
+                break;
+            if (await lockIsLive())
                 return null;
+            try {
+                if (!(await tryAcquireEvictionMarker())) {
+                    await backoff();
+                    continue;
+                }
+            }
+            catch (evictError) {
+                const code = evictError.code;
+                if (code !== 'EEXIST')
+                    throw evictError;
+                let evictStat;
+                try {
+                    evictStat = await stat(evictPath);
+                }
+                catch (statError) {
+                    if (statError.code === 'ENOENT') {
+                        await backoff();
+                        continue;
+                    }
+                    throw statError;
+                }
+                if (evictStat.mtimeMs + EVICT_TTL > now())
+                    return null;
+                await options.onStep?.('stale-marker-stat');
+                const claimedPath = `${evictPath}.${randomUUID()}`;
+                try {
+                    await rename(evictPath, claimedPath);
+                }
+                catch (renameError) {
+                    if (renameError.code === 'ENOENT') {
+                        await backoff();
+                        continue;
+                    }
+                    throw renameError;
+                }
+                await options.onStep?.('stale-marker-claimed');
+                await rm(claimedPath, { recursive: true, force: true }).catch(() => { });
+                await backoff();
+                continue;
+            }
+            try {
+                if (await lockIsLive())
+                    return null;
+                if (!(await ownsEvictionMarker()))
+                    return null;
+                await options.onStep?.('stale-lock-confirmed');
+                if (!(await ownsEvictionMarker()))
+                    return null;
+                await rm(lockPath, { recursive: true, force: true }).catch(() => { });
+                if (!(await ownsEvictionMarker()))
+                    return null;
+                acquired = await tryAcquire();
+                if (!acquired)
+                    return null;
+                if (!(await ownsEvictionMarker())) {
+                    await rm(lockPath, { recursive: true, force: true }).catch(() => { });
+                    acquired = false;
+                    return null;
+                }
+                break;
+            }
+            finally {
+                await releaseEvictionMarker();
             }
         }
-        await rm(lockPath, { recursive: true, force: true }).catch(() => { });
-        if (!(await tryAcquire()))
-            return null;
     }
+    if (!acquired)
+        return null;
     scheduleRenewal();
     return {
         release: async () => {
@@ -574,11 +727,7 @@ export function getCache1hPersistentMode(storage) {
     return normalizeCache1hMode(storage?.claudeCache?.mode);
 }
 export async function setCache1hPersistentEnabled(enabled, mode, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.claudeCache = {
         ...(storage.claudeCache ?? {}),
         enabled,
@@ -588,11 +737,7 @@ export async function setCache1hPersistentEnabled(enabled, mode, path = getAccou
     return storage;
 }
 export async function setCache1hPersistentMode(mode, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.claudeCache = {
         ...(storage.claudeCache ?? {}),
         enabled: storage.claudeCache?.enabled === true,
@@ -605,11 +750,7 @@ export function isDumpPersistentlyEnabled(storage) {
     return storage?.dump?.enabled === true;
 }
 export async function setDumpPersistentEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.dump = {
         ...(storage.dump ?? {}),
         enabled,
@@ -621,11 +762,7 @@ export function isFastModePersistentlyEnabled(storage) {
     return storage?.claudeFast?.enabled === true;
 }
 export async function setFastModePersistentEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.claudeFast = {
         ...(storage.claudeFast ?? {}),
         enabled,
@@ -634,11 +771,7 @@ export async function setFastModePersistentEnabled(enabled, path = getAccountSto
     return storage;
 }
 export async function setCacheKeepPersistentWindow(startHour, endHour, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.cacheKeep = {
         enabled: true,
         startHour,
@@ -648,11 +781,7 @@ export async function setCacheKeepPersistentWindow(startHour, endHour, path = ge
     return storage;
 }
 export async function setCacheKeepPersistentEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.cacheKeep = {
         ...(storage.cacheKeep ?? {}),
         enabled,
@@ -660,6 +789,18 @@ export async function setCacheKeepPersistentEnabled(enabled, path = getAccountSt
     await saveAccounts(storage, path);
     return storage;
 }
+export function isCacheKeepSubagentsEnabled(storage) {
+    return storage?.cacheKeep?.subagents === true;
+}
+export async function setCacheKeepSubagentsEnabled(enabled, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+    storage.cacheKeep = {
+        ...(storage.cacheKeep ?? {}),
+        subagents: enabled,
+    };
+    await saveAccounts(storage, path);
+    return storage;
+}
 function getFallbackStatuses(storage) {
     return storage?.fallbackOn?.length ? storage.fallbackOn : DEFAULT_FALLBACK_ON;
 }
@@ -699,8 +840,9 @@ export function hashRefreshToken(refreshToken) {
     return createHash('sha256').update(refreshToken).digest('hex');
 }
 function isTransientRefreshError(error) {
-    if (error instanceof ClaudeOAuthRefreshError) {
-        return error.status === 429 || error.status >= 500;
+    const status = error.status;
+    if (typeof status === 'number' && Number.isFinite(status)) {
+        return status === 429 || status >= 500;
     }
     if (!(error instanceof Error))
         return false;
@@ -717,10 +859,11 @@ export function buildRefreshOperationError(input) {
         ? (input.previous.retryCount ?? 0)
         : 0;
     const retryCount = previousRetryCount + 1;
+    const retryAfterFromError = input.error
+        .retryAfter;
     let delay;
-    if (input.error instanceof ClaudeOAuthRefreshError &&
-        input.error.retryAfter) {
-        delay = input.error.retryAfter * 1000;
+    if (typeof retryAfterFromError === 'number' && retryAfterFromError > 0) {
+        delay = retryAfterFromError * 1000;
     }
     else if (isTransientRefreshError(input.error)) {
         delay = Math.min(MAX_REFRESH_RETRY_DELAY_MS, MIN_REFRESH_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6));
@@ -728,14 +871,59 @@ export function buildRefreshOperationError(input) {
     else {
         delay = NON_TRANSIENT_REFRESH_RETRY_DELAY_MS;
     }
+    const statusFromError = input.error.status;
+    const status = typeof statusFromError === 'number' && Number.isFinite(statusFromError)
+        ? statusFromError
+        : undefined;
+    const message = formatErrorMessage(input.error);
+    // A token is permanently dead ONLY on 400 invalid_grant. The OAuth spec allows
+    // other 400s (invalid_client / invalid_request / unsupported_grant_type) that
+    // re-login does NOT fix — those, like a retry-exhausted / network / 429 / 5xx
+    // error, get a long backoff but must stay permanent=false so they are not
+    // falsely flagged "needs re-login". ClaudeOAuthRefreshError carries the raw
+    // OAuth body, and its message embeds it (`...: 400 — <body>`), so check both.
+    const body = typeof input.error.body === 'string'
+        ? input.error.body
+        : '';
+    const isInvalidGrant = body.includes('invalid_grant') || message.includes('invalid_grant');
     return {
-        message: formatErrorMessage(input.error),
+        message,
         checkedAt: input.now,
         nextRetryAt: input.now + delay,
         retryCount,
         tokenHash,
+        status,
+        permanent: status === 400 && isInvalidGrant,
     };
 }
+/**
+ * True when a refresh error means the token is permanently dead and the account
+ * needs a re-login (vs a transient failure that recovers).
+ *
+ * Precedence:
+ *  1. the explicit `permanent` flag (set at construction from 400 invalid_grant)
+ *     — the authoritative signal; correctly classifies a retry-exhausted/network
+ *     error (long backoff, but NOT dead) as non-permanent;
+ *  2. else the captured HTTP `status` — 400 (for errors built before `permanent`
+ *     existed but after `status`);
+ *  3. else the legacy 24h-delay heuristic — back-compat ONLY for errors persisted
+ *     before either field existed (e.g. an operator's already-dead token: no
+ *     status, ~24h backoff). It still flags those until the next refresh restamps
+ *     the error with the explicit field.
+ */
+export function isPermanentRefreshError(error) {
+    if (!error)
+        return false;
+    if (typeof error.permanent === 'boolean')
+        return error.permanent;
+    if (typeof error.status === 'number')
+        return error.status === 400;
+    if (typeof error.nextRetryAt === 'number') {
+        return (error.nextRetryAt - error.checkedAt >=
+            NON_TRANSIENT_REFRESH_RETRY_DELAY_MS);
+    }
+    return false;
+}
 export function refreshBackoffActive(error, refreshToken, now) {
     if (!error?.nextRetryAt || error.nextRetryAt <= now)
         return false;
@@ -747,6 +935,12 @@ export function formatRefreshBackoffMessage(error, now) {
     const seconds = Math.max(1, Math.ceil(((error.nextRetryAt ?? now) - now) / 1000));
     return `Claude OAuth refresh is backed off for ${seconds}s after: ${error.message}`;
 }
+export function isQuotaPolicyAuthError(error) {
+    const status = error.status;
+    if (status === 403)
+        return true;
+    return /Claude quota check failed: 403\b/.test(formatErrorMessage(error));
+}
 export function buildQuotaOperationError(input) {
     const previousRetryCount = input.previous?.retryCount ?? 0;
     const retryCount = previousRetryCount + 1;
@@ -773,6 +967,19 @@ export function getQuotaCheckIntervalMs(storage) {
     const minutes = storage?.quota?.checkIntervalMinutes ?? DEFAULT_QUOTA_CHECK_INTERVAL_MINUTES;
     return Math.max(1, minutes) * 60_000;
 }
+export function getPersistedLogLevel(storage) {
+    return storage?.logging?.level;
+}
+export async function setLogLevelPersistent(level, path = getAccountStoragePath()) {
+    const { setLogLevel } = await import("./logger.js");
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+    storage.logging = {
+        ...(storage.logging ?? {}),
+        level,
+    };
+    await saveAccounts(storage, path);
+    setLogLevel(level);
+}
 export function getPersistedMainQuota(storage) {
     if (!storage?.quota?.mainQuota || !storage.quota.mainQuotaCheckedAt)
         return null;
@@ -804,6 +1011,9 @@ export function quotaSnapshotPassesPolicy(quota, storage) {
         const window = quota?.[key];
         if (!window)
             return !failClosedOnUnknownQuota(storage);
+        if (!Number.isFinite(window.remainingPercent)) {
+            return !failClosedOnUnknownQuota(storage);
+        }
         if (window.remainingPercent < thresholds[key])
             return false;
     }
@@ -818,13 +1028,15 @@ export const DEFAULT_KILLSWITCH_THRESHOLDS = {
     seven_day: 10,
 };
 function normalizeKillswitchThresholds(thresholds) {
+    const fiveHour = thresholds?.five_hour ?? thresholds?.['5h'];
+    const sevenDay = thresholds?.seven_day ?? thresholds?.['1w'];
     return {
-        five_hour: thresholds?.five_hour ??
-            thresholds?.['5h'] ??
-            DEFAULT_KILLSWITCH_THRESHOLDS.five_hour,
-        seven_day: thresholds?.seven_day ??
-            thresholds?.['1w'] ??
-            DEFAULT_KILLSWITCH_THRESHOLDS.seven_day,
+        five_hour: typeof fiveHour === 'number' && Number.isFinite(fiveHour)
+            ? fiveHour
+            : DEFAULT_KILLSWITCH_THRESHOLDS.five_hour,
+        seven_day: typeof sevenDay === 'number' && Number.isFinite(sevenDay)
+            ? sevenDay
+            : DEFAULT_KILLSWITCH_THRESHOLDS.seven_day,
     };
 }
 export function isKillswitchEnabled(storage) {
@@ -856,6 +1068,10 @@ export function killswitchPassesPolicy(quota, storage, accountId) {
             sawUnknownWindow = true;
             continue;
         }
+        if (!Number.isFinite(window.remainingPercent)) {
+            sawUnknownWindow = true;
+            continue;
+        }
         if (window.remainingPercent < thresholds[key])
             return false;
     }
@@ -889,15 +1105,41 @@ export function getKillswitchConfig(storage) {
     return storage?.killswitch ?? { enabled: false };
 }
 export async function setKillswitchPersistent(config, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.killswitch = config;
     await saveAccounts(storage, path);
     return storage;
 }
+export async function removeAccountPersistent(id, path = getAccountStoragePath()) {
+    const storage = await loadAccounts(path);
+    if (!storage)
+        return false;
+    const existed = removeAccount(storage, id);
+    if (existed)
+        await saveAccounts(storage, path);
+    return existed;
+}
+export async function reorderAccountsPersistent(orderedIds, path = getAccountStoragePath()) {
+    const storage = await loadAccounts(path);
+    if (!storage)
+        return;
+    reorderAccounts(storage, orderedIds);
+    await saveAccounts(storage, path);
+}
+export async function setAccountEnabledPersistent(id, enabled, path = getAccountStoragePath()) {
+    const storage = await loadAccounts(path);
+    if (!storage)
+        return false;
+    const found = setAccountEnabled(storage, id, enabled);
+    if (found)
+        await saveAccounts(storage, path);
+    return found;
+}
+export async function addAccountPersistent(account, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+    upsertAccount(storage, account);
+    await saveAccounts(storage, path);
+}
 export function getQuotaNextRefreshAt(quota, storage, now) {
     if (!quotaEnabled(storage))
         return now + getQuotaCheckIntervalMs(storage);
@@ -948,11 +1190,21 @@ function cachedQuotaSnapshotStillRelevant(quota, now) {
     return ['five_hour', 'seven_day'].every((key) => cachedQuotaWindowStillRelevant(quota?.[key], now));
 }
 function isTransientQuotaError(error) {
-    const message = formatErrorMessage(error);
-    if (/Claude quota check failed: (429|5\d\d)\b/.test(message))
+    const status = error.status;
+    if (typeof status === 'number' && Number.isFinite(status)) {
+        if (status === 429 || status >= 500)
+            return true;
+    }
+    const formattedMessage = formatErrorMessage(error);
+    if (/Claude quota check failed: (429|5\d\d)\b/.test(formattedMessage)) {
         return true;
+    }
+    if (formattedMessage.includes('Quota refresh is already in progress')) {
+        return true;
+    }
     if (!(error instanceof Error))
         return false;
+    const message = error.message;
     const code = error.code;
     return (message.includes('fetch failed') ||
         code === 'ECONNRESET' ||
@@ -977,6 +1229,8 @@ function clampPercent(value) {
 function mapUsageWindow(window, checkedAt) {
     if (typeof window?.utilization !== 'number')
         return undefined;
+    if (!Number.isFinite(window.utilization))
+        return undefined;
     const usedPercent = clampPercent(window.utilization);
     return {
         usedPercent,
@@ -999,7 +1253,11 @@ export async function fetchOAuthQuotaSnapshot(input) {
     });
     if (!response.ok) {
         const body = await response.text().catch(() => '');
-        throw new Error(`Claude quota check failed: ${response.status} — ${body}`);
+        const error = Object.assign(new Error(`Claude quota check failed: ${response.status} — ${body}`), {
+            status: response.status,
+            retryAfter: parseRetryAfterHeader(response.headers.get('Retry-After')),
+        });
+        throw error;
     }
     const checkedAt = input.now?.() ?? Date.now();
     const usage = (await response.json());
@@ -1013,6 +1271,46 @@ function updateStoredAccount(storage, account) {
     if (index >= 0)
         storage.accounts[index] = account;
 }
+export function upsertAccount(storage, account) {
+    const index = storage.accounts.findIndex((candidate) => candidate.id === account.id ||
+        (account.label && candidate.label === account.label));
+    if (index >= 0) {
+        storage.accounts[index] = {
+            ...storage.accounts[index],
+            ...account,
+            addedAt: storage.accounts[index]?.addedAt ?? account.addedAt,
+            ...(account.type === 'oauth' && {
+                quota: account.quota,
+                lastRefreshedAt: account.lastRefreshedAt,
+                lastRefreshError: account.lastRefreshError,
+                lastQuotaRefreshError: account.lastQuotaRefreshError,
+            }),
+        };
+        return;
+    }
+    storage.accounts.push(account);
+}
+export function removeAccount(storage, id) {
+    const index = storage.accounts.findIndex((c) => c.id === id);
+    if (index < 0)
+        return false;
+    storage.accounts.splice(index, 1);
+    return true;
+}
+export function reorderAccounts(storage, orderedIds) {
+    const orderMap = new Map(orderedIds.map((id, i) => [id, i]));
+    const known = storage.accounts.filter((a) => orderMap.has(a.id));
+    const unknown = storage.accounts.filter((a) => !orderMap.has(a.id));
+    known.sort((a, b) => (orderMap.get(a.id) ?? 0) - (orderMap.get(b.id) ?? 0));
+    storage.accounts = [...known, ...unknown];
+}
+export function setAccountEnabled(storage, id, enabled) {
+    const account = storage.accounts.find((c) => c.id === id);
+    if (!account)
+        return false;
+    account.enabled = enabled;
+    return true;
+}
 function formatErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -1025,12 +1323,14 @@ function recordRefreshError(account, error, now) {
     });
 }
 function recordQuotaRefreshError(account, error, now) {
+    if (isQuotaPolicyAuthError(error))
+        return;
     account.lastQuotaRefreshError = buildQuotaOperationError({
         error,
         now,
         previous: account.lastQuotaRefreshError,
     });
-    if (error instanceof ClaudeOAuthRefreshError) {
+    if (error.isRefreshError) {
         recordRefreshError(account, error, now);
     }
 }
@@ -1218,7 +1518,7 @@ export class FallbackAccountManager {
                 changed = true;
             }
             catch (error) {
-                log('[refresh] fallback oauth background failed', {
+                logger.warn('refresh', 'fallback oauth background failed', {
                     accountId: account.id,
                     error: error instanceof Error ? error.message : String(error),
                 });