@modelprofile.com/authswitch 6.0.0 → 6.2.0

package/ts/classes.codexauth.ts

@@ -56,6 +56,90 @@ const findFirstJwt = (valueArg: unknown, depthArg = 0): string | null => {
   return null;
 };
 
+/**
+ * A short, non-reversible label for an API key so two different keys get two
+ * different stashes without the key itself ever being written down.
+ */
+const fingerprint = (secretArg: string): string => {
+  let hash = 0x811c9dc5;
+  for (let index = 0; index < secretArg.length; index++) {
+    hash ^= secretArg.charCodeAt(index);
+    hash = Math.imul(hash, 0x01000193) >>> 0;
+  }
+  return hash.toString(16).padStart(8, '0');
+};
+
+/**
+ * Extracts the account identity from the content of an auth.json.
+ * Returns null when the content holds no recognisable credential.
+ *
+ * It stands outside the class because the stash store keys and guards its entries by the same identity and has
+ * no Codex installation to read: the credential itself is all this derivation needs.
+ */
+export const codexIdentityFromRaw = (rawArg: string): ICodexIdentity | null => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawArg);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    return null;
+  }
+  const record = parsed as Record<string, unknown>;
+
+  const tokens = (record.tokens ?? null) as Record<string, unknown> | null;
+  const idToken =
+    (tokens ? asString(tokens.id_token) : null) ?? findFirstJwt(record);
+
+  if (idToken) {
+    const claims = decodeJwtPayload(idToken) ?? {};
+    const authClaim = (claims['https://api.openai.com/auth'] ?? {}) as Record<string, unknown>;
+    const profileClaim = (claims['https://api.openai.com/profile'] ?? {}) as Record<string, unknown>;
+    const email =
+      asString(claims.email) ??
+      asString(profileClaim.email) ??
+      asString(authClaim.user_email);
+    const accountId =
+      asString(authClaim.chatgpt_account_id) ??
+      (tokens ? asString(tokens.account_id) : null) ??
+      asString(record.account_id);
+    if (email) {
+      return {
+        kind: 'chatgpt',
+        email: email.toLowerCase(),
+        accountId,
+        planType: asString(authClaim.chatgpt_plan_type),
+        userId: asString(authClaim.user_id) ?? asString(claims.sub),
+      };
+    }
+    if (accountId) {
+      // An OAuth credential we cannot label by email is still worth stashing;
+      // key it by account id so it round-trips instead of being silently dropped.
+      return {
+        kind: 'chatgpt',
+        email: `account:${accountId}`,
+        accountId,
+        planType: asString(authClaim.chatgpt_plan_type),
+        userId: asString(authClaim.user_id) ?? asString(claims.sub),
+      };
+    }
+  }
+
+  const apiKey = asString(record.OPENAI_API_KEY) ?? asString(record.openai_api_key);
+  if (apiKey) {
+    return {
+      kind: 'apikey',
+      email: `apikey:${fingerprint(apiKey)}`,
+      accountId: null,
+      planType: null,
+      userId: null,
+    };
+  }
+
+  return null;
+};
+
 /**
  * Reads, writes and clears the Codex file credential store, and derives the
  * account identity used to key a stash.
@@ -75,81 +159,7 @@ export class CodexAuth {
    * Returns null when the file holds no recognisable credential.
    */
   public identityFromRaw(rawArg: string): ICodexIdentity | null {
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(rawArg);
-    } catch {
-      return null;
-    }
-    if (!parsed || typeof parsed !== 'object') {
-      return null;
-    }
-    const record = parsed as Record<string, unknown>;
-
-    const tokens = (record.tokens ?? null) as Record<string, unknown> | null;
-    const idToken =
-      (tokens ? asString(tokens.id_token) : null) ?? findFirstJwt(record);
-
-    if (idToken) {
-      const claims = decodeJwtPayload(idToken) ?? {};
-      const authClaim = (claims['https://api.openai.com/auth'] ?? {}) as Record<string, unknown>;
-      const profileClaim = (claims['https://api.openai.com/profile'] ?? {}) as Record<string, unknown>;
-      const email =
-        asString(claims.email) ??
-        asString(profileClaim.email) ??
-        asString(authClaim.user_email);
-      const accountId =
-        asString(authClaim.chatgpt_account_id) ??
-        (tokens ? asString(tokens.account_id) : null) ??
-        asString(record.account_id);
-      if (email) {
-        return {
-          kind: 'chatgpt',
-          email: email.toLowerCase(),
-          accountId,
-          planType: asString(authClaim.chatgpt_plan_type),
-          userId: asString(authClaim.user_id) ?? asString(claims.sub),
-        };
-      }
-      if (accountId) {
-        // An OAuth credential we cannot label by email is still worth stashing;
-        // key it by account id so it round-trips instead of being silently dropped.
-        return {
-          kind: 'chatgpt',
-          email: `account:${accountId}`,
-          accountId,
-          planType: asString(authClaim.chatgpt_plan_type),
-          userId: asString(authClaim.user_id) ?? asString(claims.sub),
-        };
-      }
-    }
-
-    const apiKey = asString(record.OPENAI_API_KEY) ?? asString(record.openai_api_key);
-    if (apiKey) {
-      const fingerprint = this.fingerprint(apiKey);
-      return {
-        kind: 'apikey',
-        email: `apikey:${fingerprint}`,
-        accountId: null,
-        planType: null,
-        userId: null,
-      };
-    }
-
-    return null;
-  }
-
-  /**
-   * A short, non-reversible label for an API key so two different keys get two
-   * different stashes without the key itself ever being written down.
-   */
-  private fingerprint(secretArg: string): string {
-    let hash = 0x811c9dc5;
-    for (let index = 0; index < secretArg.length; index++) {
-      hash ^= secretArg.charCodeAt(index);
-      hash = Math.imul(hash, 0x01000193) >>> 0;
-    }
-    return hash.toString(16).padStart(8, '0');
+    return codexIdentityFromRaw(rawArg);
   }
 
   /** Reads the active credential, if any. */

package/ts/classes.codexharness.ts

@@ -3,12 +3,21 @@ import { CodexAccountStatus } from './classes.codexstatus.js';
 import { CodexPreuse } from './classes.codexpreuse.js';
 import { PreuseError } from './preuse.js';
 import type { IAuthHarness, IHarnessAccount, IHarnessAccountStatus, IHarnessOutcome, IHarnessState, IHarnessPreuseOptions, IHarnessPreuseResult, IHarnessStatusOptions } from './interfaces.harness.js';
-import type { IStashListing } from './interfaces.js';
+import type { IActiveAuth, ICodexIdentity, IStashEntry, IStashListing } from './interfaces.js';
 import { countPaired, enrollmentState } from './helpers.js';
 import { beginSavedOpenAiLogin } from './classes.login.js';
 import { plainText } from './formatting.js';
 import type { IHarnessLoginOptions, IHarnessLoginProvider } from './interfaces.harness.js';
 
+/**
+ * Why a write into the stash failed, as its system error code. The message of a filesystem error names the path
+ * it was writing, and that path leads to a credential.
+ */
+const writeFailureCause = (errorArg: unknown): string => {
+  const code = (errorArg as { code?: unknown } | null)?.code;
+  return typeof code === 'string' ? code : 'unknown cause';
+};
+
 /** Codex-specific credentials, remote-control handling and service status. */
 export class CodexHarness implements IAuthHarness {
   public readonly id = 'codex';
@@ -43,21 +52,28 @@ export class CodexHarness implements IAuthHarness {
     }, options);
   }
 
+  /**
+   * The harness's accounts, with the saved copy of the active login brought up to date first.
+   *
+   * A saved login is one whose stored credential is readable and belongs to the account its record names. The
+   * exact tokens are not part of that: Codex' app-server refreshes the login it runs on its own schedule, so
+   * comparing bytes reported every saved active login as unsaved from its first refresh on, and the guide then
+   * offered to save what was already saved.
+   */
   public readState(): IHarnessState {
     const active = this.switcher.readActive();
+    const mirrorFailure = this.mirrorActiveLogin(active);
     const accounts: IHarnessAccount[] = this.switcher.list().map((entryArg) => {
       const raw = this.switcher.stashes.readAuth(entryArg.email);
-      const identity = raw === null ? null : this.switcher.auth.identityFromRaw(raw);
-      const valid = identity !== null && identity.email === entryArg.email && identity.accountId === entryArg.accountId && identity.kind === entryArg.kind;
-      const isActive = active.identity !== null && active.identity.email === entryArg.email && active.identity.accountId === entryArg.accountId && active.identity.kind === entryArg.kind;
-      const isStashed = valid && (!isActive || raw === active.raw);
+      const isStashed = this.recordOf(entryArg, raw === null ? null : this.switcher.auth.identityFromRaw(raw));
+      const isActive = this.recordOf(entryArg, active.identity);
       return {
         id: entryArg.email,
         label: entryArg.email,
         isActive,
         isStashed,
         savedAt: entryArg.stashedAt,
-        details: [this.formatRemoteControl(entryArg).trim(), ...(!valid ? ['saved credential missing or does not match its metadata'] : !isStashed ? ['the current login has changed since it was saved'] : [])],
+        details: [this.formatRemoteControl(entryArg).trim(), ...(!isStashed ? ['saved credential missing or does not match its metadata'] : isActive && mirrorFailure !== null ? [mirrorFailure] : [])],
       };
     });
     if (active.identity && !accounts.some((accountArg) => accountArg.isActive)) {
@@ -74,6 +90,42 @@ export class CodexHarness implements IAuthHarness {
     };
   }
 
+  /** Whether a saved record is the record of this identity: same account, same email, same kind of login. */
+  private recordOf(entryArg: IStashEntry, identityArg: ICodexIdentity | null): boolean {
+    return identityArg !== null && entryArg.email === identityArg.email && entryArg.accountId === identityArg.accountId && entryArg.kind === identityArg.kind;
+  }
+
+  /**
+   * Writes the credential Codex is running on into that account's own saved record, and reports why it could
+   * not when the write failed.
+   *
+   * Codex rotates the tokens of the active login, and until now only a switch or a save wrote that rotation
+   * back -- `use()` re-saves the outgoing login, and re-selecting the active account updates its record before
+   * restoring the pairings. Every read now keeps the saved copy on the credential Codex last wrote, so the copy
+   * is one a switch can restore rather than one the service has moved past.
+   *
+   * The write goes only into the stash: Codex' own files are read, nothing is stopped or signalled, no daemon
+   * has to be down for it, and the record keeps its save time and its enrollments. A login with no saved record
+   * of its own is never saved implicitly -- `stash` is what saves a login -- and a record whose credential is
+   * missing or belongs to another account is left for `stash` to repair rather than quietly overwritten.
+   */
+  private mirrorActiveLogin(activeArg: IActiveAuth): string | null {
+    if (activeArg.source !== 'file' || activeArg.identity === null || activeArg.raw === null) return null;
+    const email = activeArg.identity.email;
+    const saved = this.switcher.stashes.readAuth(email);
+    if (saved === null || saved === activeArg.raw) return null;
+    const meta = this.switcher.stashes.readMeta(email);
+    if (meta === null || !this.recordOf(meta, activeArg.identity) || !this.recordOf(meta, this.switcher.auth.identityFromRaw(saved))) return null;
+    try {
+      this.switcher.stashes.replaceAuth(email, activeArg.raw);
+      return null;
+    } catch (errorArg) {
+      // A saved copy that could not be brought up to date is no reason to fail a read: the record still holds a
+      // credential of this account, and the next read tries again.
+      return `the current login could not be copied into its saved record (${writeFailureCause(errorArg)}); the record still holds the credential from the last save`;
+    }
+  }
+
   public async readAccountStatus(accountIdArg: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
     const credential = this.readAccountCredential(accountIdArg);
     if (!credential) return { facts: [], problems: ['No matching credential is available for status lookup.'] };

package/ts/classes.credentialstore.ts

@@ -164,8 +164,8 @@ export class CredentialStore {
         && typeof record.switchedAt === 'string' && Number.isFinite(Date.parse(record.switchedAt));
     });
   }
-  public recordSwitch(entry: Omit<ISwitchRecord, 'switchedAt'>): void {
-    this.writeSwitchRecords([...this.switchRecords().filter(item => item.slotId !== entry.slotId), { ...entry, switchedAt: new Date().toISOString() }]);
+  public recordSwitch(entry: Omit<ISwitchRecord, 'switchedAt'> & { switchedAt?: string }): void {
+    this.writeSwitchRecords([...this.switchRecords().filter(item => item.slotId !== entry.slotId), { ...entry, switchedAt: entry.switchedAt ?? new Date().toISOString() }]);
   }
   public clearSwitch(slotId: string): void {
     const remaining = this.switchRecords().filter(item => item.slotId !== slotId);

package/ts/classes.fileharness.ts

@@ -99,9 +99,10 @@ export abstract class FileHarness implements IAuthHarness {
    * Credential slots that no longer hold the account the last switch wrote.
    *
    * The login can change outside authswitch -- a new native login, or, for a harness that does not pick
-   * up swaps live, a running instance writing its previous login back at its next refresh. The recorded
+   * up swaps live, a request already in flight writing the previous login's own rotation back. The recorded
    * hash detects that the file changed at all; comparing the account distinguishes the benign case -- the
-   * switched-in account rotating its own token -- from a different account. Detection is advisory and
+   * switched-in account rotating its own token -- from a different account. A rotation authswitch performed
+   * itself is not drift at all: `recordRenewal` moves the record onto it. Detection is advisory and
    * never turns a read into a failure.
    */
   private credentialDrift(snapshotArg: IFileHarnessSnapshot): IHarnessCredentialDrift[] {
@@ -127,14 +128,18 @@ export abstract class FileHarness implements IAuthHarness {
   private savedLabel(accountIdArg: string): string | null {
     try { return this.store.read(accountIdArg).label; } catch { return null; }
   }
-  /** Instances that keep a replaced or cleared login in memory until they are restarted; none for a live-swap harness. */
+  /** How a running instance still holds the previous login and can write it back; stated per harness. */
+  protected runningRetention(): string {
+    return 'They keep the previous login in memory until they are restarted, and a token refresh by one of them can ';
+  }
+  /** Instances that can still write a replaced or cleared login back; none for a live-swap harness. */
   private runningCaveat(kindArg: 'replaced' | 'cleared'): string[] {
     if (this.liveSwap) return [];
     let count: number;
     try { count = this.processes.list().length; }
     catch { return [`Could not check for running ${this.label} processes. If any are running, restart them: an unrestarted instance can write its previous login back.`]; }
     if (!count) return [];
-    return [`${count} ${this.label} process(es) are still running. They keep the previous login in memory until they are restarted, and a token refresh by one of them can `
+    return [`${count} ${this.label} process(es) are still running. ${this.runningRetention()}`
       + `${kindArg === 'replaced' ? 'overwrite the credential file with the previous account' : 'write the cleared login back into the credential file'}. `
       + `Restart them, then check authswitch ${this.id} active.`];
   }
@@ -154,6 +159,25 @@ export abstract class FileHarness implements IAuthHarness {
       return [];
     } catch { return [`The login was written, but this switch could not be recorded for later credential checks.`]; }
   }
+  /**
+   * Let a slot's switch record follow a credential authswitch itself renewed in place.
+   *
+   * The record must name what authswitch last wrote, or the next read reports authswitch's own rotation as a
+   * login someone else put there -- an account whose identity is its refresh token changes id on every rotation.
+   * A slot no switch armed keeps no record: a renewal never starts watching one. The record is advisory, so an
+   * update that fails costs at most the drift note the next read would have shown anyway; a status read has
+   * nowhere to report it.
+   */
+  protected recordRenewal(slotIdArg: string): void {
+    try {
+      const record = this.store.switchRecords().find(item => item.slotId === slotIdArg);
+      const active = this.snapshot().accounts.find(account => account.slotId === slotIdArg);
+      if (!record || !active) return;
+      // The switch time stays the switch time: a renewal changes what the record names, not when the login was put there.
+      this.store.recordSwitch({ slotId: slotIdArg, accountId: this.store.id(active.slotId, active.identity),
+        credentialHash: credentialHash(JSON.stringify(active.credential)), switchedAt: record.switchedAt });
+    } catch { /* Advisory state only. */ }
+  }
   /** The active login with this account id, read from the native files; undefined when the account is not active. */
   protected activeCredential(id: string): IFileAccount | undefined {
     return this.snapshot().accounts.find(account => this.store.id(account.slotId, account.identity) === id);
@@ -162,10 +186,6 @@ export abstract class FileHarness implements IAuthHarness {
   protected savedCredential(id: string): IFileAccount {
     return this.saved(this.store.read(id));
   }
-  /** The account's current credential: the active login when it is active, which may be newer than its saved copy. */
-  protected readCredential(id: string): IFileAccount {
-    return this.activeCredential(id) ?? this.savedCredential(id);
-  }
   /** Save a newly authenticated credential without changing a native harness's login. */
   public importCredential(slotId: string, credential: Record<string, unknown>): Promise<{ accountId: string }> {
     return this.store.locked(() => ({ accountId: this.store.save(this.inspect(credential, slotId)).id }));

package/ts/classes.opencodeanthropicrefresh.ts

@@ -0,0 +1,64 @@
+import { credentialText } from './classes.credentialstore.js';
+import { claudeRequest, ClaudeLoginRejectedError, ClaudeRequestError, oauthErrorCode } from './claudehttp.js';
+
+/** The token endpoint `opencode-anthropic-auth` 0.0.13 renews an OpenCode `anthropic` login at (`index.mjs`). */
+const TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';
+/** The OAuth client that plugin sends, Claude Code's public one (`CLIENT_ID`, `index.mjs`). */
+const CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+/**
+ * How long one renewal may take. A renewal is never cut shorter than that, nor cancelled once sent: the service may
+ * already have replaced the refresh token the request carries.
+ */
+const REFRESH_TIMEOUT_MS = 30_000;
+
+/** The token fields OpenCode keeps for an OAuth login, as one renewal replaces them. */
+export interface IOpenCodeAnthropicTokens {
+  access: string;
+  refresh: string;
+  /** Milliseconds since the epoch, as OpenCode stores them. */
+  expires: number;
+}
+
+const seconds = (valueArg: unknown): number | undefined =>
+  typeof valueArg === 'number' && Number.isFinite(valueArg) && valueArg >= 0 ? valueArg : undefined;
+
+/**
+ * Renews an OpenCode `anthropic` OAuth login with the request OpenCode's own Anthropic provider sends for it.
+ *
+ * `opencode-anthropic-auth` 0.0.13 -- the plugin that gives OpenCode 1.18.x its `anthropic` OAuth provider; the
+ * binary carries no Anthropic OAuth code of its own -- posts a JSON body of `grant_type`, `refresh_token` and
+ * Claude Code's public client to `console.anthropic.com`, with no scope, and stores `{access, refresh, expires}`
+ * from the answer. This sends exactly that request, so a login renewed here is renewed the way OpenCode renews it.
+ *
+ * It only talks to the token endpoint; which login is renewed, and where the rotated pair is written, belongs to
+ * the harness.
+ */
+export class OpenCodeAnthropicRefresh {
+  constructor(private readonly fetcher: typeof fetch = globalThis.fetch, private readonly now: () => number = Date.now) {}
+
+  /**
+   * New tokens for the login. A response without a refresh token keeps the one that was sent, as the service's own
+   * answer to a grant it did not rotate. Throws `ClaudeRequestError` with a fixed diagnostic; a grant the service
+   * rejects is `ClaudeLoginRejectedError`, and a rate limit is `ClaudeRateLimitError`.
+   */
+  public async refresh(refreshTokenArg: string): Promise<IOpenCodeAnthropicTokens> {
+    const { status, body } = await claudeRequest(this.fetcher, {
+      url: TOKEN_URL, method: 'POST', headers: { 'Content-Type': 'application/json' }, subject: 'Claude sign-in',
+      body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshTokenArg, client_id: CLIENT_ID }),
+      timeoutMs: REFRESH_TIMEOUT_MS, readErrorBody: true, now: this.now,
+    });
+    if ((status === 400 || status === 401) && oauthErrorCode(body) === 'invalid_grant') throw new ClaudeLoginRejectedError();
+    if (status < 200 || status > 299) throw new ClaudeRequestError(`The Claude sign-in service returned HTTP ${status}.`);
+    const receivedAt = this.now();
+    const access = credentialText(body?.access_token);
+    const tokenType = body?.token_type;
+    const expiresIn = seconds(body?.expires_in);
+    const rotated = body?.refresh_token == null ? null : credentialText(body.refresh_token);
+    // Only a response every field of the stored entry can be taken from is written back into a file OpenCode owns.
+    if (!access || (tokenType != null && (typeof tokenType !== 'string' || tokenType.toLowerCase() !== 'bearer'))
+      || expiresIn === undefined || rotated === undefined) {
+      throw new ClaudeRequestError('The Claude sign-in service returned an unsupported token response; the stored login was not changed.');
+    }
+    return { access, refresh: rotated ?? refreshTokenArg, expires: receivedAt + expiresIn * 1000 };
+  }
+}

package/ts/classes.opencodeharness.ts

@@ -4,7 +4,9 @@ import { CredentialStore, credentialHash, credentialRecord, credentialText, read
 import { HarnessProcesses } from './classes.harnessprocesses.js';
 import { ClaudeAccountStatus } from './classes.claudestatus.js';
 import { CLAUDE_REFRESH_MARGIN_MS } from './classes.claudetokenrefresh.js';
+import { ClaudeLoginRejectedError, ClaudeRateLimitError } from './claudehttp.js';
 import { CodexAccountStatus } from './classes.codexstatus.js';
+import { OpenCodeAnthropicRefresh } from './classes.opencodeanthropicrefresh.js';
 import { writeSecretFileAtomically } from './helpers.js';
 import type { IHarnessAccountStatus, IHarnessLoginOptions, IHarnessLoginProvider, IHarnessProcessControl, IHarnessStatusOptions } from './interfaces.harness.js';
 import { beginSavedOpenAiLogin, openCodeCredentialFromLogin } from './classes.login.js';
@@ -21,6 +23,11 @@ export interface IOpenCodeHarnessOptions {
   now?: () => number;
 }
 
+/** Anthropic refused the grant OpenCode's entry holds; no retry and no other account changes that answer. */
+const ANTHROPIC_LOGIN_REJECTED = 'Login expired or was rejected. Log in again with opencode auth login.';
+/** A saved copy is not the login OpenCode uses, so renewing it would rotate a token OpenCode's own entry still holds. */
+const SAVED_ANTHROPIC_EXPIRED = 'This saved Anthropic login\'s access token has expired. authswitch renews the Anthropic login OpenCode has active; activate this one to have it renewed, or log in again with opencode auth login.';
+
 /** OpenCode owns one login per provider. Replacing a slot never replaces the whole provider set. */
 export class OpenCodeHarness extends FileHarness {
   public readonly id = 'opencode';
@@ -30,12 +37,17 @@ export class OpenCodeHarness extends FileHarness {
   public readonly liveSwap = false;
   /** Only its OpenAI login reports usage, and a supervisor (AGL) restarts it around a switch, so a watch leaves it alone. */
   public readonly autoSwitch = false;
+  /** OpenCode re-reads its credential file on every request; only a request already in flight still holds the previous login. */
+  protected override runningRetention(): string {
+    return 'They re-read the credential file on every request, but a request already in flight still holds the previous login, and its token refresh can ';
+  }
   public readonly loginProviders: IHarnessLoginProvider[] = [{ providerId: 'openai', label: 'OpenAI', flows: ['device'] }];
   protected readonly store: CredentialStore;
   private readonly file: string;
   private readonly env: NodeJS.ProcessEnv;
   private readonly status: CodexAccountStatus;
   private readonly claudeStatus: ClaudeAccountStatus;
+  private readonly anthropicRefresh: OpenCodeAnthropicRefresh;
   public readonly processes: IHarnessProcessControl;
   private readonly fetcher?: typeof fetch;
   private readonly now: () => number;
@@ -47,6 +59,7 @@ export class OpenCodeHarness extends FileHarness {
     this.store = new CredentialStore(this.id, options.stashRoot);
     this.status = new CodexAccountStatus(options.fetch);
     this.claudeStatus = new ClaudeAccountStatus(options.fetch, options.now);
+    this.anthropicRefresh = new OpenCodeAnthropicRefresh(options.fetch, options.now);
     this.fetcher = options.fetch;
     this.now = options.now ?? Date.now;
     this.processes = options.processes ?? new HarnessProcesses('opencode');
@@ -112,35 +125,87 @@ export class OpenCodeHarness extends FileHarness {
     writeSecretFileAtomically(this.file, raw);
     if (readCredentialDocument(this.file).raw !== raw) throw new Error('Active login verification failed. The outgoing login remains saved.');
   }
+  /** The login OpenCode has in a provider slot, read from its file; undefined where the file holds none it can read. */
+  private activeSlot(slotIdArg: string): IFileAccount | undefined {
+    return this.snapshot().accounts.find(account => account.slotId === slotIdArg);
+  }
+  /** Whether this login's access token is inside Claude Code's five-minute margin, the margin Claude's own logins use. */
+  private renewalDue(credentialArg: Record<string, unknown>): boolean {
+    const expires = credentialArg.expires;
+    return typeof expires === 'number' && Number.isFinite(expires) && this.now() + CLAUDE_REFRESH_MARGIN_MS >= expires;
+  }
+
+  /**
+   * Renews OpenCode's active Anthropic login and writes the rotated pair back into OpenCode's own credential file.
+   *
+   * Nothing is stranded by that write. OpenCode's auth service reads `auth.json` on every `Auth.all()`, `Auth.get()`
+   * is that read (1.18.15 @99100961, 1.18.31 @103733929), and its Anthropic provider -- `opencode-anthropic-auth`
+   * 0.0.13, since the binary carries no Anthropic OAuth code -- calls the `getAuth()` it was initialised with
+   * (@98017331) inside the `fetch` wrapper of every single request. A running OpenCode therefore holds no refresh
+   * token in memory and picks up this rotation on its next request, exactly as it picks up its own.
+   *
+   * The renewal is the only authswitch operation on the store while it runs, and the rotated pair replaces the
+   * entry only while OpenCode still holds the refresh token that was sent: a login OpenCode renewed meanwhile is
+   * returned as it now stands. The write itself is `apply`'s verified compare-and-swap, which preserves every other
+   * provider and replaces the file atomically -- OpenCode writes the same file in place. The slot's switch record
+   * follows that write, because an `anthropic` login's identity is its refresh token and this rotation is
+   * authswitch's own: without that, the next read would report this write as a different account.
+   */
+  private renewAnthropic(accountArg: IFileAccount, signalArg?: AbortSignal): Promise<IFileAccount> {
+    return this.store.locked(async () => {
+      const current = this.activeSlot(accountArg.slotId) ?? accountArg;
+      if (!this.renewalDue(current.credential)) return current;
+      const refreshToken = credentialText(current.credential.refresh);
+      if (refreshToken === undefined) throw new Error('This Anthropic login holds no refresh token; log in again with opencode auth login.');
+      signalArg?.throwIfAborted();
+      const tokens = await this.anthropicRefresh.refresh(refreshToken);
+      const latest = this.activeSlot(accountArg.slotId);
+      if (!latest || credentialText(latest.credential.refresh) !== refreshToken) return latest ?? current;
+      const renewed = this.inspect({ ...latest.credential, access: tokens.access, refresh: tokens.refresh, expires: tokens.expires }, latest.slotId);
+      this.apply(latest.slotId, latest, renewed);
+      this.recordRenewal(latest.slotId);
+      return renewed;
+    }, { signal: signalArg });
+  }
+
   /**
    * The subscription and usage of an OpenCode `anthropic` OAuth login.
    *
    * That entry holds the same Claude subscriber grant Claude Code stores, so Claude's own account endpoints answer
    * for it and the account reports real windows instead of no quota API at all. OpenCode keeps no scopes and no
-   * account identity with it, so the service decides both; the token is used exactly as stored. Renewing it is
-   * OpenCode's, because the renewal rotates the refresh token a running OpenCode holds in memory, and authswitch
-   * cannot write that rotation into an instance it does not manage.
+   * account identity with it, so the service decides both. A due access token is renewed first, with OpenCode's own
+   * request; a refusal is reported and nothing is written, so the entry OpenCode owns is left exactly as it was.
+   *
+   * A saved copy is never renewed: OpenCode's entry holds the same refresh token, and rotating it here would leave
+   * the login OpenCode actually uses holding a token the service has replaced.
    */
-  private anthropicStatus(credentialArg: Record<string, unknown>, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
-    const accessToken = credentialText(credentialArg.access);
-    const expires = credentialArg.expires;
-    if (accessToken === undefined || typeof expires !== 'number') {
-      return Promise.resolve(this.claudeStatus.unavailable({}, 'This Anthropic login holds no usable access token; log in again with opencode auth login.'));
-    }
-    if (this.now() + CLAUDE_REFRESH_MARGIN_MS >= expires) {
-      return Promise.resolve(this.claudeStatus.unavailable({}, 'This Anthropic login\'s access token has expired. OpenCode renews it while it runs; authswitch does not, because the renewal rotates the refresh token a running OpenCode keeps in memory. Start OpenCode, or log in again with opencode auth login.'));
+  private async anthropicStatus(accountArg: IFileAccount, isActiveArg: boolean, optionsArg: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
+    let account = accountArg;
+    if (this.renewalDue(account.credential)) {
+      if (!isActiveArg) return this.claudeStatus.unavailable({}, SAVED_ANTHROPIC_EXPIRED);
+      try { account = await this.renewAnthropic(account, optionsArg.signal); }
+      catch (error) {
+        if (optionsArg.signal?.aborted) throw error;
+        const problem = error instanceof ClaudeLoginRejectedError ? ANTHROPIC_LOGIN_REJECTED
+          : error instanceof Error ? error.message : 'the login could not be renewed.';
+        return this.claudeStatus.unavailable({}, `Login refresh: ${problem}`,
+          error instanceof ClaudeRateLimitError ? { retryAt: error.retryAt } : undefined);
+      }
     }
+    const accessToken = credentialText(account.credential.access);
+    if (accessToken === undefined) return this.claudeStatus.unavailable({}, 'This Anthropic login holds no usable access token; log in again with opencode auth login.');
     return this.claudeStatus.read({ accessToken, scopes: [] }, optionsArg);
   }
 
-  public async readAccountStatus(id: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
-    const account = this.readCredential(id);
+  public async readAccountStatus(id: string, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
+    const active = this.activeCredential(id);
+    const account = active ?? this.savedCredential(id);
     if (account.slotId === 'openai' && account.credential.type === 'oauth') {
       const info = this.openAiInfo(account.credential);
       if (!info.accountId) return { facts: [], problems: ['The OpenAI login has no account ID for a status lookup.'] };
       return this.status.readCredential(credentialText(account.credential.access)!, info.accountId, info.plan, optionsArg);
     }
-    if (account.slotId === 'anthropic' && account.credential.type === 'oauth') return this.anthropicStatus(account.credential, optionsArg);
+    if (account.slotId === 'anthropic' && account.credential.type === 'oauth') return this.anthropicStatus(account, active !== undefined, optionsArg);
     return { facts: [
       { section: 'Authentication', label: 'Provider', value: account.slotId },
       { section: 'Authentication', label: 'Login type', value: String(account.credential.type) },

package/ts/classes.stashstore.ts

@@ -6,6 +6,7 @@ import type {
   THarnessName,
 } from './interfaces.js';
 import { writeSecretFileAtomically } from './helpers.js';
+import { codexIdentityFromRaw } from './classes.codexauth.js';
 
 const AUTH_FILE_NAME = 'auth.json';
 const META_FILE_NAME = 'stash.json';
@@ -105,6 +106,27 @@ export class StashStore {
     return entry;
   }
 
+  /**
+   * Replaces the credential of an existing stash and leaves its metadata exactly as it is.
+   *
+   * Codex refreshes the login it is running on its own schedule, so a saved copy of that login holds older
+   * tokens until something writes the rotation back. Doing so is an update of one account's credential, not a
+   * new save: the record keeps its account, its enrollments and the moment it was saved, which `write()` would
+   * stamp anew. The credential must belong to the account the metadata names -- the same guard `write()`
+   * applies -- so a mirror can never move one account's login into another account's record.
+   */
+  public replaceAuth(emailArg: string, rawAuthArg: string): void {
+    const meta = this.readMeta(emailArg);
+    if (!meta) {
+      throw new Error(`no stash for "${emailArg}" whose credential could be replaced`);
+    }
+    const identity = codexIdentityFromRaw(rawAuthArg);
+    if (!identity || identity.email !== meta.email || identity.accountId !== meta.accountId || identity.kind !== meta.kind) {
+      throw new Error('the credential does not belong to the account this stash holds; refusing to replace it');
+    }
+    writeSecretFileAtomically(plugins.path.join(this.entryDir(emailArg), AUTH_FILE_NAME), rawAuthArg);
+  }
+
   /**
    * Reads a stash back and confirms it matches what was meant to be written.
    * Callers use this before clearing the active credential, so a stash is only

package/ts/interfaces.harness.ts

@@ -239,9 +239,13 @@ export interface IAuthHarness {
    */
   readonly autoSwitch?: boolean;
   /**
-   * The account's live status. It must never activate, switch or clear a login. It may renew the tokens of the
-   * saved copy it reads when the provider leaves it no other way to answer -- the Claude Code adapter does, for
-   * saved and inactive logins only, under its store's lock -- and must leave the active login's credential alone.
+   * The account's live status. It must never activate, switch or clear a login.
+   *
+   * It may renew the tokens of the credential it reads when the provider leaves it no other way to answer, under
+   * its store's lock and with a compare-and-swap on the refresh token it sent. A saved copy is always its own to
+   * renew -- the Claude Code adapter renews one, because Claude Code's active login is Claude Code's. The active
+   * login may only be renewed where the owning harness re-reads its credential file on every request, so that the
+   * rotation strands nothing: OpenCode's Anthropic provider does, and authswitch renews that entry.
    */
   readAccountStatus(accountIdArg: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus>;
   readonly loginProviders?: IHarnessLoginProvider[];