@cortexkit/anthropic-auth-core 1.2.3 → 1.2.4

package/dist/accounts.d.ts

@@ -153,6 +153,7 @@ export declare class FallbackAccountManager {
     refreshAccount(account: OAuthAccount, storage: AccountStorage, options?: {
         force?: boolean;
     }): Promise<OAuthAccount>;
+    private waitForConcurrentFallbackRefresh;
     private refreshAccountNow;
     refreshAccountQuota(account: OAuthAccount, storage: AccountStorage): Promise<OAuthAccount>;
 }

package/dist/accounts.js

@@ -22,6 +22,9 @@ const DEFAULT_MINIMUM_REMAINING = {
 const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
 const BACKGROUND_TICK_MS = 60_000;
 const BACKGROUND_TICK_JITTER_MS = 60_000;
+const FALLBACK_REFRESH_LOCK_TTL_MS = 2 * 60_000;
+const FALLBACK_REFRESH_JOIN_WAIT_MS = 10_000;
+const FALLBACK_REFRESH_JOIN_POLL_MS = 100;
 function getConfigDir() {
     if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
         return process.env.OPENCODE_CONFIG_DIR.trim();
@@ -534,6 +537,12 @@ function recordQuotaRefreshError(account, error, now) {
         recordRefreshError(account, error, now);
     }
 }
+function fallbackRefreshLockName(accountId) {
+    return `fallback-oauth-refresh-${createHash('sha256')
+        .update(accountId)
+        .digest('hex')
+        .slice(0, 16)}`;
+}
 export class FallbackAccountManager {
     now;
     fetchImpl;
@@ -749,43 +758,105 @@ export class FallbackAccountManager {
         updateStoredAccount(storage, refreshed);
         return refreshed;
     }
+    async waitForConcurrentFallbackRefresh(account, storage, previous, options) {
+        const deadline = Date.now() + FALLBACK_REFRESH_JOIN_WAIT_MS;
+        while (Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, FALLBACK_REFRESH_JOIN_POLL_MS));
+            const latestStorage = await this.load();
+            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            if (!latestAccount)
+                continue;
+            const changed = latestAccount.access !== previous.access ||
+                latestAccount.refresh !== previous.refresh ||
+                (latestAccount.expires ?? 0) > (previous.expires ?? 0) + 60_000;
+            if (changed &&
+                (options.force ||
+                    !tokenNeedsRefresh(latestAccount, latestStorage, this.now()))) {
+                updateStoredAccount(storage, latestAccount);
+                log('[refresh] fallback oauth joined concurrent refresh', {
+                    accountId: latestAccount.id,
+                    expiresInMs: latestAccount.expires
+                        ? latestAccount.expires - this.now()
+                        : undefined,
+                });
+                return latestAccount;
+            }
+            const refreshError = latestAccount.lastRefreshError;
+            if (refreshError &&
+                refreshBackoffActive(refreshError, latestAccount.refresh, this.now())) {
+                updateStoredAccount(storage, latestAccount);
+                throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+            }
+        }
+        return null;
+    }
     async refreshAccountNow(account, storage, options) {
-        const latestStorage = await this.load();
-        const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+        let latestStorage = await this.load();
+        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
         if (latestAccount &&
             !options.force &&
             !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
             updateStoredAccount(storage, latestAccount);
             return latestAccount;
         }
-        const sourceAccount = latestAccount ?? account;
-        const refreshToken = sourceAccount.refresh;
-        log('[refresh] fallback oauth refresh request start', {
-            accountId: sourceAccount.id,
-            force: options.force === true,
-            expiresInMs: sourceAccount.expires
-                ? sourceAccount.expires - this.now()
-                : undefined,
-        });
-        const refreshed = await refreshClaudeOAuthToken({
-            refreshToken,
-            fetchImpl: this.fetchImpl,
+        let sourceAccount = latestAccount ?? account;
+        const fileLock = await acquireRefreshFileLock({
+            name: fallbackRefreshLockName(sourceAccount.id),
+            ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
+            path: this.configPath,
             now: this.now,
         });
-        sourceAccount.access = refreshed.access;
-        sourceAccount.refresh = refreshed.refresh;
-        sourceAccount.expires = refreshed.expires;
-        sourceAccount.lastRefreshedAt =
-            refreshed.expires - refreshed.expiresIn * 1000;
-        sourceAccount.lastRefreshError = undefined;
-        updateStoredAccount(storage, sourceAccount);
-        log('[refresh] fallback oauth refresh succeeded', {
-            accountId: sourceAccount.id,
-            expiresInMs: sourceAccount.expires
-                ? sourceAccount.expires - this.now()
-                : undefined,
-        });
-        return sourceAccount;
+        if (!fileLock) {
+            log('[refresh] fallback oauth refresh skipped file lock', {
+                accountId: sourceAccount.id,
+            });
+            const concurrent = await this.waitForConcurrentFallbackRefresh(account, storage, sourceAccount, options);
+            if (concurrent)
+                return concurrent;
+            throw new Error('Fallback OAuth refresh is already in progress');
+        }
+        try {
+            latestStorage = await this.load();
+            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            if (latestAccount &&
+                !options.force &&
+                !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
+                updateStoredAccount(storage, latestAccount);
+                return latestAccount;
+            }
+            sourceAccount = latestAccount ?? sourceAccount;
+            const refreshToken = sourceAccount.refresh;
+            log('[refresh] fallback oauth refresh request start', {
+                accountId: sourceAccount.id,
+                force: options.force === true,
+                expiresInMs: sourceAccount.expires
+                    ? sourceAccount.expires - this.now()
+                    : undefined,
+            });
+            const refreshed = await refreshClaudeOAuthToken({
+                refreshToken,
+                fetchImpl: this.fetchImpl,
+                now: this.now,
+            });
+            sourceAccount.access = refreshed.access;
+            sourceAccount.refresh = refreshed.refresh;
+            sourceAccount.expires = refreshed.expires;
+            sourceAccount.lastRefreshedAt =
+                refreshed.expires - refreshed.expiresIn * 1000;
+            sourceAccount.lastRefreshError = undefined;
+            updateStoredAccount(storage, sourceAccount);
+            await this.save(storage);
+            log('[refresh] fallback oauth refresh succeeded', {
+                accountId: sourceAccount.id,
+                expiresInMs: sourceAccount.expires
+                    ? sourceAccount.expires - this.now()
+                    : undefined,
+            });
+            return sourceAccount;
+        }
+        finally {
+            await fileLock.release();
+        }
     }
     async refreshAccountQuota(account, storage) {
         let target = account;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "type": "module",
   "repository": {
     "type": "git",