@modelprofile.com/authswitch 6.4.0 → 7.0.0

package/ts/classes.claudestatus.ts

@@ -108,7 +108,7 @@ const claudeUsageWindows = (usage: Record<string, unknown>): IClaudeUsageWindows
 type TClaudeProfile =
   | { kind: 'found'; plan: string | undefined; facts: IHarnessStatusFact[] }
   | { kind: 'mismatch' }
-  | { kind: 'unavailable'; problem: string };
+  | { kind: 'unavailable'; problem: string; credentialRejected: boolean };
 
 /**
  * One Claude OAuth login as a status lookup needs it: the token to ask with, and what the store that keeps it knows
@@ -125,6 +125,14 @@ export interface IClaudeLogin {
   plan?: string;
 }
 
+/** Structured proof from the same profile and usage requests used for harness status. */
+export interface IClaudeStatusRead {
+  status: IHarnessAccountStatus;
+  profile: 'verified' | 'unverified' | 'mismatch' | 'unavailable' | 'unsupported_scope';
+  usage: 'available' | 'unavailable' | 'unsupported_scope';
+  credentialRejected: boolean;
+}
+
 /**
  * How long a session reuses an account's profile. The watch polls every few minutes, and the profile (plan,
  * organization, billing type) changes far more rarely, so it is read at most hourly there.
@@ -167,7 +175,8 @@ export class ClaudeAccountStatus {
     let body: Record<string, unknown>;
     try { body = await this.get('profile', loginArg.accessToken, signal); }
     catch (error) {
-      if (error instanceof ClaudeLoginRejectedError) return { kind: 'unavailable', problem: `Profile: ${error.message}` };
+      if (error instanceof ClaudeLoginRejectedError) return { kind: 'unavailable',
+        problem: `Profile: ${error.message}`, credentialRejected: true };
       throw error;
     }
     try {
@@ -181,7 +190,8 @@ export class ClaudeAccountStatus {
         if (credentialText(value)) facts.push({ section: 'Account', label: String(label), value: String(value) });
       }
       return { kind: 'found', plan: credentialText(organization.organization_type)?.replace(/^claude_/, ''), facts };
-    } catch { return { kind: 'unavailable', problem: 'Claude profile response is unsupported; no profile values were inferred.' }; }
+    } catch { return { kind: 'unavailable',
+      problem: 'Claude profile response is unsupported; no profile values were inferred.', credentialRejected: false }; }
   }
 
   /** The plan the login was saved with, the only one known while the service cannot be asked. */
@@ -195,25 +205,43 @@ export class ClaudeAccountStatus {
   }
 
   public async read(loginArg: IClaudeLogin, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
+    return (await this.readDetailed(loginArg, optionsArg)).status;
+  }
+
+  /** One request pair; callers requiring immutable identity use the proof rather than display text. */
+  public async readDetailed(loginArg: IClaudeLogin,
+    optionsArg: IHarnessStatusOptions = {}): Promise<IClaudeStatusRead> {
     const result: IHarnessAccountStatus = { facts: [], problems: [], ...this.storedSummary(loginArg) };
     // Only a store that keeps the login's scopes can tell beforehand that the service will not answer about the account.
     if (loginArg.scopes.length && !loginArg.scopes.includes('user:profile')) {
       result.facts.push({ section: 'Availability', label: 'Live account status', value: 'This login lacks the user:profile scope. Log in through Claude Code to obtain subscriber status.' });
-      return result;
+      return { status: result, profile: 'unsupported_scope', usage: 'unsupported_scope', credentialRejected: false };
     }
     const token = credentialText(loginArg.accessToken);
-    if (!token) return { facts: [], problems: ['No usable Claude Code access token is available.'] };
+    if (!token) return { status: { facts: [], problems: ['No usable Claude Code access token is available.'] },
+      profile: 'unavailable', usage: 'unavailable', credentialRejected: false };
     const [profile, usage] = await Promise.allSettled([this.profile(loginArg, optionsArg), this.get('usage', token, optionsArg.signal)]);
     const failure = (reason: unknown): string => reason instanceof ClaudeRequestError ? reason.message : 'Lookup failed.';
+    let profileOutcome: IClaudeStatusRead['profile'] = 'unavailable';
+    let usageOutcome: IClaudeStatusRead['usage'] = 'unavailable';
+    let credentialRejected = usage.status === 'rejected' && usage.reason instanceof ClaudeLoginRejectedError;
     if (profile.status === 'fulfilled') {
       const found = profile.value;
-      if (found.kind === 'mismatch') return { facts: [], problems: [MISMATCH] };
-      if (found.kind === 'unavailable') result.problems.push(found.problem);
+      if (found.kind === 'mismatch') return { status: { facts: [], problems: [MISMATCH] },
+        profile: 'mismatch', usage: 'unavailable', credentialRejected: false };
+      if (found.kind === 'unavailable') {
+        result.problems.push(found.problem);
+        credentialRejected ||= found.credentialRejected;
+      }
       else {
+        profileOutcome = loginArg.identity ? 'verified' : 'unverified';
         if (found.plan) result.summary = { ...result.summary, subscription: { plan: found.plan, source: 'live' } };
         result.facts.push(...found.facts.map(fact => ({ ...fact })));
       }
-    } else result.problems.push(`Profile: ${failure(profile.reason)}`);
+    } else {
+      result.problems.push(`Profile: ${failure(profile.reason)}`);
+      credentialRejected ||= profile.reason instanceof ClaudeLoginRejectedError;
+    }
     if (usage.status === 'fulfilled') {
       try {
         const { windows, unsupported } = claudeUsageWindows(usage.value);
@@ -232,12 +260,13 @@ export class ClaudeAccountStatus {
           if (limit !== undefined && limit > 0 && used !== undefined) result.facts.push({ section: 'Extra usage', label: 'Monthly budget used', value: `${Math.round(used / limit * 10000) / 100}%` });
         }
         if (unsupported.length) result.facts.push({ section: 'Availability', label: 'Unsupported limits', value: `The service returned limits without a supported reset window, which are not shown: ${unsupported.join(', ')}.` });
+        usageOutcome = 'available';
       } catch { result.problems.push('Claude usage response is unsupported; missing values were not inferred.'); }
     } else result.problems.push(`Usage: ${failure(usage.reason)}`);
     const limited = [profile, usage].flatMap(item => item.status === 'rejected' && item.reason instanceof ClaudeRateLimitError ? [item.reason] : []);
     if (limited.length) result.rateLimit = { retryAt: latestRetryAt(limited.map(error => error.retryAt)) };
     // The missing renewal dates are the harness's `renewalUnavailableReason`, stated once by the views that show them.
     result.facts.push({ section: 'Availability', label: 'Earned resets', value: 'authswitch does not read earned reset credits for Claude Code logins.' });
-    return result;
+    return { status: result, profile: profileOutcome, usage: usageOutcome, credentialRejected };
   }
 }

package/ts/classes.claudetokenrefresh.ts

@@ -1,5 +1,8 @@
-import { credentialText } from './classes.credentialstore.js';
-import { claudeRequest, ClaudeAccountOnHoldError, ClaudeLoginRejectedError, ClaudeRequestError, oauthErrorCode } from './claudehttp.js';
+import { claudeRequest, claudeRotatingRequest, ClaudeAccountOnHoldError, ClaudeLoginRejectedError,
+  ClaudeRequestError, ClaudeRotatingRequestError, oauthErrorCode } from './claudehttp.js';
+
+const credentialText = (value: unknown): string | undefined =>
+  typeof value === 'string' && value.length > 0 ? value : undefined;
 
 /** Claude Code 2.1.273's token endpoint (`TOKEN_URL`, bundle offset @188533776). */
 const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
@@ -36,6 +39,13 @@ export interface IClaudeTokens {
   scopes?: string[];
 }
 
+/** Authority callers persist a pre-send marker, then classify every failed rotating request. */
+export type TClaudeAuthorityRefreshResult =
+  | { success: true; tokens: IClaudeTokens }
+  | { success: false; requestOutcome: 'notSent' | 'outcomeUnknown';
+      reason: 'not_refreshable' | 'provider_rejected' | 'account_on_hold' | 'provider_unavailable' | 'unsupported_response';
+      responseStatus?: number };
+
 /** How Claude Code 2.1.273 builds one refresh request for a stored login. */
 export interface IClaudeGrant {
   /** The login's own OAuth client, or Claude Code's public one. */
@@ -104,10 +114,10 @@ export class ClaudeTokenRefresh {
    * Whether Claude Code would refresh this login before using it: its access token expires within five minutes. A
    * login without a numeric expiry or without a refresh token is used as it is, exactly as Claude Code does.
    */
-  public due(oauthArg: Record<string, unknown>): boolean {
+  public due(oauthArg: Record<string, unknown>, minValidityMs = CLAUDE_REFRESH_MARGIN_MS): boolean {
     const expiresAt = oauthArg.expiresAt;
     return typeof expiresAt === 'number' && Number.isFinite(expiresAt) && credentialText(oauthArg.refreshToken) !== undefined
-      && this.now() + CLAUDE_REFRESH_MARGIN_MS >= expiresAt;
+      && this.now() + Math.max(CLAUDE_REFRESH_MARGIN_MS, minValidityMs) >= expiresAt;
   }
 
   /** One refresh request, as Claude Code sends it: a JSON body, the login's client, and the scopes of this attempt. */
@@ -121,26 +131,56 @@ export class ClaudeTokenRefresh {
     });
   }
 
-  /**
-   * New tokens for the login. A response without a refresh token keeps the one sent, and one without a scope keeps the
-   * stored scopes, as Claude Code merges them. Throws `ClaudeRequestError` with a fixed diagnostic; a grant the service
-   * rejects is `ClaudeLoginRejectedError`, an account the service put on hold is `ClaudeAccountOnHoldError`, and a rate
-   * limit is `ClaudeRateLimitError`.
-   */
-  public async refresh(oauthArg: Record<string, unknown>): Promise<IClaudeTokens> {
+  private attemptForAuthority(refreshTokenArg: string, grantArg: IClaudeGrant, scopesArg: readonly string[]) {
+    return claudeRotatingRequest(this.fetcher, {
+      url: TOKEN_URL, method: 'POST', headers: { 'Content-Type': 'application/json' }, subject: 'Claude sign-in',
+      body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshTokenArg,
+        client_id: grantArg.clientId, scope: grantScope(scopesArg) }),
+      timeoutMs: REFRESH_TIMEOUT_MS, readErrorBody: true, now: this.now,
+    });
+  }
+
+  /** The authority must already have durably marked this grant as possibly sent. */
+  public async refreshForAuthority(oauthArg: Record<string, unknown>): Promise<TClaudeAuthorityRefreshResult> {
     const refreshToken = credentialText(oauthArg.refreshToken);
     const grant = claudeGrant(oauthArg);
     if (!refreshToken || !grant) {
-      throw new ClaudeRequestError('This saved login has no refresh token, and no subscriber scope or plan to refresh with. Log in again with Claude Code and save it.');
+      return { success: false, requestOutcome: 'notSent', reason: 'not_refreshable' };
     }
-    let { status, body } = await this.attempt(refreshToken, grant, grant.scopes);
-    // The service refusing Claude Code's current scope set is the one failure it sends a second request for.
-    if (status === 400 && oauthErrorCode(body) === 'invalid_scope' && grant.fallbackScopes !== null) {
-      ({ status, body } = await this.attempt(refreshToken, grant, grant.fallbackScopes));
+    let response: Awaited<ReturnType<typeof this.attemptForAuthority>>;
+    try {
+      response = await this.attemptForAuthority(refreshToken, grant, grant.scopes);
+      // A definitive invalid_scope response is the one safe condition in which Claude retries the same grant.
+      if (response.status === 400 && oauthErrorCode(response.body) === 'invalid_scope'
+        && grant.fallbackScopes !== null) {
+        response = await this.attemptForAuthority(refreshToken, grant, grant.fallbackScopes);
+      }
+    } catch (error) {
+      return { success: false,
+        requestOutcome: error instanceof ClaudeRotatingRequestError ? error.requestOutcome : 'outcomeUnknown',
+        reason: 'provider_unavailable' };
     }
-    if (accountOnHold(status, body)) throw new ClaudeAccountOnHoldError();
-    if ((status === 400 || status === 401) && oauthErrorCode(body) === 'invalid_grant') throw new ClaudeLoginRejectedError();
-    if (status < 200 || status > 299) throw new ClaudeRequestError(`The Claude sign-in service returned HTTP ${status}.`);
+    if (accountOnHold(response.status, response.body)) {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'account_on_hold',
+        responseStatus: response.status };
+    }
+    if ((response.status === 400 || response.status === 401)
+      && oauthErrorCode(response.body) === 'invalid_grant') {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'provider_rejected',
+        responseStatus: response.status };
+    }
+    if (response.status < 200 || response.status > 299) {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'provider_unavailable',
+        responseStatus: response.status };
+    }
+    try { return { success: true, tokens: this.tokensFromResponse(response.body, refreshToken) }; }
+    catch {
+      return { success: false, requestOutcome: 'outcomeUnknown', reason: 'unsupported_response',
+        responseStatus: response.status };
+    }
+  }
+
+  private tokensFromResponse(body: Record<string, unknown> | null, refreshToken: string): IClaudeTokens {
     const receivedAt = this.now();
     const accessToken = credentialText(body?.access_token);
     const tokenType = body?.token_type;
@@ -158,4 +198,27 @@ export class ClaudeTokenRefresh {
       ...(scope === null || !scope.length ? {} : { scopes: scope }),
     };
   }
+
+  /**
+   * New tokens for the login. A response without a refresh token keeps the one sent, and one without a scope keeps the
+   * stored scopes, as Claude Code merges them. Throws `ClaudeRequestError` with a fixed diagnostic; a grant the service
+   * rejects is `ClaudeLoginRejectedError`, an account the service put on hold is `ClaudeAccountOnHoldError`, and a rate
+   * limit is `ClaudeRateLimitError`.
+   */
+  public async refresh(oauthArg: Record<string, unknown>): Promise<IClaudeTokens> {
+    const refreshToken = credentialText(oauthArg.refreshToken);
+    const grant = claudeGrant(oauthArg);
+    if (!refreshToken || !grant) {
+      throw new ClaudeRequestError('This saved login has no refresh token, and no subscriber scope or plan to refresh with. Log in again with Claude Code and save it.');
+    }
+    let { status, body } = await this.attempt(refreshToken, grant, grant.scopes);
+    // The service refusing Claude Code's current scope set is the one failure it sends a second request for.
+    if (status === 400 && oauthErrorCode(body) === 'invalid_scope' && grant.fallbackScopes !== null) {
+      ({ status, body } = await this.attempt(refreshToken, grant, grant.fallbackScopes));
+    }
+    if (accountOnHold(status, body)) throw new ClaudeAccountOnHoldError();
+    if ((status === 400 || status === 401) && oauthErrorCode(body) === 'invalid_grant') throw new ClaudeLoginRejectedError();
+    if (status < 200 || status > 299) throw new ClaudeRequestError(`The Claude sign-in service returned HTTP ${status}.`);
+    return this.tokensFromResponse(body, refreshToken);
+  }
 }

package/ts/classes.codexharness.ts

@@ -69,6 +69,7 @@ export class CodexHarness implements IAuthHarness {
       const isActive = this.recordOf(entryArg, active.identity);
       return {
         id: entryArg.email,
+        providerAccountId: entryArg.accountId,
         label: entryArg.email,
         isActive,
         isStashed,
@@ -77,7 +78,8 @@ export class CodexHarness implements IAuthHarness {
       };
     });
     if (active.identity && !accounts.some((accountArg) => accountArg.isActive)) {
-      accounts.unshift({ id: this.activeAccountId(active.identity.email, active.identity.accountId), label: active.identity.email, isActive: true,
+      accounts.unshift({ id: this.activeAccountId(active.identity.email, active.identity.accountId),
+        providerAccountId: active.identity.accountId, label: active.identity.email, isActive: true,
         isStashed: false, savedAt: null, details: [] });
     }
     return {