@cortexkit/anthropic-auth-core 1.2.3 → 1.2.5

package/dist/accounts.d.ts

@@ -153,6 +153,7 @@ export declare class FallbackAccountManager {
     refreshAccount(account: OAuthAccount, storage: AccountStorage, options?: {
         force?: boolean;
     }): Promise<OAuthAccount>;
+    private waitForConcurrentFallbackRefresh;
     private refreshAccountNow;
     refreshAccountQuota(account: OAuthAccount, storage: AccountStorage): Promise<OAuthAccount>;
 }

package/dist/accounts.js

@@ -22,6 +22,9 @@ const DEFAULT_MINIMUM_REMAINING = {
 const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
 const BACKGROUND_TICK_MS = 60_000;
 const BACKGROUND_TICK_JITTER_MS = 60_000;
+const FALLBACK_REFRESH_LOCK_TTL_MS = 2 * 60_000;
+const FALLBACK_REFRESH_JOIN_WAIT_MS = 10_000;
+const FALLBACK_REFRESH_JOIN_POLL_MS = 100;
 function getConfigDir() {
     if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
         return process.env.OPENCODE_CONFIG_DIR.trim();
@@ -466,6 +469,35 @@ function quotaIsStale(account, storage, now) {
         return !window || now - window.checkedAt >= maxAge;
     });
 }
+function cachedQuotaWindowStillRelevant(window, now) {
+    if (!window)
+        return false;
+    if (!window.resetsAt)
+        return true;
+    const resetTime = Date.parse(window.resetsAt);
+    return !Number.isFinite(resetTime) || resetTime > now;
+}
+function cachedQuotaSnapshotStillRelevant(quota, now) {
+    return ['five_hour', 'seven_day'].every((key) => cachedQuotaWindowStillRelevant(quota?.[key], now));
+}
+function isTransientQuotaError(error) {
+    const message = formatErrorMessage(error);
+    if (/Claude quota check failed: (429|5\d\d)\b/.test(message))
+        return true;
+    if (!(error instanceof Error))
+        return false;
+    const code = error.code;
+    return (message.includes('fetch failed') ||
+        code === 'ECONNRESET' ||
+        code === 'ECONNREFUSED' ||
+        code === 'ETIMEDOUT' ||
+        code === 'UND_ERR_CONNECT_TIMEOUT');
+}
+function canUseCachedQuotaAfterRefreshError(account, storage, error, now) {
+    return (isTransientQuotaError(error) &&
+        quotaSnapshotPassesPolicy(account.quota, storage) &&
+        cachedQuotaSnapshotStillRelevant(account.quota, now));
+}
 function clampPercent(value) {
     if (!Number.isFinite(value))
         return 0;
@@ -534,6 +566,12 @@ function recordQuotaRefreshError(account, error, now) {
         recordRefreshError(account, error, now);
     }
 }
+function fallbackRefreshLockName(accountId) {
+    return `fallback-oauth-refresh-${createHash('sha256')
+        .update(accountId)
+        .digest('hex')
+        .slice(0, 16)}`;
+}
 export class FallbackAccountManager {
     now;
     fetchImpl;
@@ -601,9 +639,17 @@ export class FallbackAccountManager {
                 if (this.accountPassesQuotaPolicy(next, storage))
                     usable.push(next);
             }
-            catch {
-                if (!failClosedOnUnknownQuota(storage))
+            catch (error) {
+                if (canUseCachedQuotaAfterRefreshError(account, storage, error, this.now())) {
+                    log('[refresh] fallback quota using cached quota after refresh error', {
+                        accountId: account.id,
+                        error: formatErrorMessage(error),
+                    });
+                    usable.push(account);
+                }
+                else if (!failClosedOnUnknownQuota(storage)) {
                     usable.push(account);
+                }
             }
         }
         if (changed)
@@ -717,6 +763,14 @@ export class FallbackAccountManager {
                     next = await this.refreshAccount(next, storage);
                     changed = true;
                 }
+                if (!quotaIsStale(next, storage, this.now())) {
+                    if (next.lastQuotaRefreshError) {
+                        next.lastQuotaRefreshError = undefined;
+                        updateStoredAccount(storage, next);
+                        changed = true;
+                    }
+                    continue;
+                }
                 await this.refreshAccountQuota(next, storage);
                 changed = true;
             }
@@ -749,43 +803,105 @@ export class FallbackAccountManager {
         updateStoredAccount(storage, refreshed);
         return refreshed;
     }
+    async waitForConcurrentFallbackRefresh(account, storage, previous, options) {
+        const deadline = Date.now() + FALLBACK_REFRESH_JOIN_WAIT_MS;
+        while (Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, FALLBACK_REFRESH_JOIN_POLL_MS));
+            const latestStorage = await this.load();
+            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            if (!latestAccount)
+                continue;
+            const changed = latestAccount.access !== previous.access ||
+                latestAccount.refresh !== previous.refresh ||
+                (latestAccount.expires ?? 0) > (previous.expires ?? 0) + 60_000;
+            if (changed &&
+                (options.force ||
+                    !tokenNeedsRefresh(latestAccount, latestStorage, this.now()))) {
+                updateStoredAccount(storage, latestAccount);
+                log('[refresh] fallback oauth joined concurrent refresh', {
+                    accountId: latestAccount.id,
+                    expiresInMs: latestAccount.expires
+                        ? latestAccount.expires - this.now()
+                        : undefined,
+                });
+                return latestAccount;
+            }
+            const refreshError = latestAccount.lastRefreshError;
+            if (refreshError &&
+                refreshBackoffActive(refreshError, latestAccount.refresh, this.now())) {
+                updateStoredAccount(storage, latestAccount);
+                throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+            }
+        }
+        return null;
+    }
     async refreshAccountNow(account, storage, options) {
-        const latestStorage = await this.load();
-        const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+        let latestStorage = await this.load();
+        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
         if (latestAccount &&
             !options.force &&
             !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
             updateStoredAccount(storage, latestAccount);
             return latestAccount;
         }
-        const sourceAccount = latestAccount ?? account;
-        const refreshToken = sourceAccount.refresh;
-        log('[refresh] fallback oauth refresh request start', {
-            accountId: sourceAccount.id,
-            force: options.force === true,
-            expiresInMs: sourceAccount.expires
-                ? sourceAccount.expires - this.now()
-                : undefined,
-        });
-        const refreshed = await refreshClaudeOAuthToken({
-            refreshToken,
-            fetchImpl: this.fetchImpl,
+        let sourceAccount = latestAccount ?? account;
+        const fileLock = await acquireRefreshFileLock({
+            name: fallbackRefreshLockName(sourceAccount.id),
+            ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
+            path: this.configPath,
             now: this.now,
         });
-        sourceAccount.access = refreshed.access;
-        sourceAccount.refresh = refreshed.refresh;
-        sourceAccount.expires = refreshed.expires;
-        sourceAccount.lastRefreshedAt =
-            refreshed.expires - refreshed.expiresIn * 1000;
-        sourceAccount.lastRefreshError = undefined;
-        updateStoredAccount(storage, sourceAccount);
-        log('[refresh] fallback oauth refresh succeeded', {
-            accountId: sourceAccount.id,
-            expiresInMs: sourceAccount.expires
-                ? sourceAccount.expires - this.now()
-                : undefined,
-        });
-        return sourceAccount;
+        if (!fileLock) {
+            log('[refresh] fallback oauth refresh skipped file lock', {
+                accountId: sourceAccount.id,
+            });
+            const concurrent = await this.waitForConcurrentFallbackRefresh(account, storage, sourceAccount, options);
+            if (concurrent)
+                return concurrent;
+            throw new Error('Fallback OAuth refresh is already in progress');
+        }
+        try {
+            latestStorage = await this.load();
+            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            if (latestAccount &&
+                !options.force &&
+                !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
+                updateStoredAccount(storage, latestAccount);
+                return latestAccount;
+            }
+            sourceAccount = latestAccount ?? sourceAccount;
+            const refreshToken = sourceAccount.refresh;
+            log('[refresh] fallback oauth refresh request start', {
+                accountId: sourceAccount.id,
+                force: options.force === true,
+                expiresInMs: sourceAccount.expires
+                    ? sourceAccount.expires - this.now()
+                    : undefined,
+            });
+            const refreshed = await refreshClaudeOAuthToken({
+                refreshToken,
+                fetchImpl: this.fetchImpl,
+                now: this.now,
+            });
+            sourceAccount.access = refreshed.access;
+            sourceAccount.refresh = refreshed.refresh;
+            sourceAccount.expires = refreshed.expires;
+            sourceAccount.lastRefreshedAt =
+                refreshed.expires - refreshed.expiresIn * 1000;
+            sourceAccount.lastRefreshError = undefined;
+            updateStoredAccount(storage, sourceAccount);
+            await this.save(storage);
+            log('[refresh] fallback oauth refresh succeeded', {
+                accountId: sourceAccount.id,
+                expiresInMs: sourceAccount.expires
+                    ? sourceAccount.expires - this.now()
+                    : undefined,
+            });
+            return sourceAccount;
+        }
+        finally {
+            await fileLock.release();
+        }
     }
     async refreshAccountQuota(account, storage) {
         let target = account;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "type": "module",
   "repository": {
     "type": "git",