@sunerpy/opencode-kiro-auth 0.6.2 → 0.8.0

package/README.md

@@ -101,6 +101,13 @@ mapping) lives in `~/.config/opencode/kiro.json`. See
 [docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the full example and every
 option.
 
+New default keys are backfilled into an existing `kiro.json` automatically when
+the plugin loads (additive only — your existing values are never changed). For
+multi-account or long-idle setups, enable
+[token keep-alive](docs/CONFIGURATION.md#token-keep-alive)
+(`token_keepalive_enabled: true`) to keep idle accounts' tokens fresh while
+OpenCode is running.
+
 ## Multiple accounts & rotation
 
 You can register more than one Kiro account and let the plugin spread
@@ -113,10 +120,11 @@ requests across them for combined quota and automatic failover.
    AWS identity is stored separately in `kiro.db`. Re-running login for the
    same identity updates it in place; logging in with a different identity
    adds a new account.
-2. Auto-sync from Kiro CLI: with `auto_sync_kiro_cli: true` (the default),
-   the plugin imports credentials from your local `kiro-cli` database.
-   Switching or adding accounts via `kiro-cli login` flows into the plugin
-   automatically, no extra step needed.
+2. Auto-sync from Kiro CLI: with `auto_sync_kiro_cli: true` (opt-in, default
+   `false`), the plugin imports credentials from your local `kiro-cli`
+   database. Note `kiro-cli` stores only one token per auth method, so it
+   cannot represent multiple accounts — manual `opencode auth login` per
+   account (option 1) is the supported multi-account path.
 
 **Rotation strategy** — set `account_selection_strategy` in
 `~/.config/opencode/kiro.json`:

package/dist/core/auth/auth-handler.js

@@ -1,4 +1,5 @@
 import { RegionSchema } from '../../plugin/config/schema.js';
+import { isRefreshTokenDead } from '../../plugin/health.js';
 import * as logger from '../../plugin/logger.js';
 import { IdcAuthMethod } from './idc-auth-method.js';
 import { isInteractiveTty, ttyConfirm, ttySelect } from './tty-menu.js';
@@ -64,11 +65,12 @@ export class AuthHandler {
             const email = acc.email || 'unknown';
             const used = acc.usedCount ?? 0;
             const limit = acc.limitCount ?? 0;
+            const marker = isRefreshTokenDead(acc.unhealthyReason) ? ' (needs re-login)' : '';
             if (limit > 0) {
                 const pct = Math.round((used / limit) * 100);
-                return `${email} ${used}/${limit} (${pct}%)`;
+                return `${email} ${used}/${limit} (${pct}%)${marker}`;
             }
-            return `${email} ${used} used`;
+            return `${email} ${used} used${marker}`;
         });
         const remaining = accounts.length - Math.min(accounts.length, CAP);
         const body = remaining > 0 ? `${parts.join(' · ')} +${remaining} more` : parts.join(' · ');

package/dist/core/auth/idc-auth-method.js

@@ -4,7 +4,7 @@ import { authorizeKiroIDC, pollKiroIDCToken } from '../../kiro/oauth-idc.js';
 import { createDeterministicAccountId } from '../../plugin/accounts.js';
 import * as logger from '../../plugin/logger.js';
 import { kiroDb } from '../../plugin/storage/sqlite.js';
-import { makePlaceholderEmail } from '../../plugin/sync/kiro-cli-parser.js';
+import { isPlaceholderEmail, makePlaceholderEmail } from '../../plugin/sync/kiro-cli-parser.js';
 import { readActiveProfileArnFromKiroCli } from '../../plugin/sync/kiro-cli-profile.js';
 import { fetchUsageLimits } from '../../plugin/usage.js';
 const openBrowser = (url) => {
@@ -155,10 +155,22 @@ export class IdcAuthMethod {
                         usedCount: usage.usedCount,
                         limitCount: usage.limitCount
                     };
+                    // clear tombstone ONLY on deliberate user login; never in auto-sync (would revive removed accounts).
+                    // This must precede save/addAccount so tombstone-filtered upserts do not block re-login.
+                    await kiroDb.clearRemovedAccount(id);
                     await this.repository.save(acc);
                     this.accountManager?.addAccount?.(acc);
-                    // clear tombstone ONLY on deliberate user login; never in auto-sync (would revive removed accounts)
-                    await kiroDb.clearRemovedAccount(id);
+                    if (!isPlaceholderEmail(acc.email)) {
+                        try {
+                            await kiroDb.cleanupSupersededIdentities(acc.id, acc.email, acc.authMethod, acc.profileArn);
+                        }
+                        catch (cleanupError) {
+                            logger.warn('IDC auth cleanup: failed to tombstone superseded same-identity accounts', {
+                                keepId: acc.id,
+                                error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+                            });
+                        }
+                    }
                     return { type: 'success', key: token.accessToken };
                 }
                 catch (e) {

package/dist/core/auth/token-keepalive.d.ts

@@ -0,0 +1,27 @@
+import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
+import type { AccountManager } from '../../plugin/accounts.js';
+import type { TokenRefresher } from './token-refresher.js';
+export interface KeepAliveConfig {
+    readonly token_keepalive_enabled: boolean;
+    readonly token_keepalive_interval_ms: number;
+    readonly token_expiry_buffer_ms: number;
+}
+export declare class KeepAliveController {
+    private readonly config;
+    private readonly accountManager;
+    private readonly tokenRefresher;
+    private readonly repository;
+    private initialDelayTimer;
+    private intervalTimer;
+    private running;
+    private disposed;
+    private activeLeaderLockRelease;
+    constructor(config: KeepAliveConfig, accountManager: AccountManager, tokenRefresher: TokenRefresher, repository: AccountRepository);
+    start(): void;
+    dispose(): void;
+    runOnceForTest(): Promise<void>;
+    private tick;
+    private refreshNearExpiryAccounts;
+    private refreshAccountIfNeeded;
+    private releaseLeaderLock;
+}

package/dist/core/auth/token-keepalive.js

@@ -0,0 +1,137 @@
+import { accessTokenExpired } from '../../kiro/auth.js';
+import { isPermanentError } from '../../plugin/health.js';
+import * as logger from '../../plugin/logger.js';
+import { tryAcquireKeepAliveLock } from '../../plugin/storage/locked-operations.js';
+const INITIAL_TICK_DELAY_MS = 5000;
+const noopToast = () => { };
+function hasUnref(timer) {
+    return typeof timer === 'object' && timer !== null && 'unref' in timer;
+}
+function unrefTimer(timer) {
+    if (hasUnref(timer)) {
+        timer.unref();
+    }
+}
+function normalizeError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+export class KeepAliveController {
+    config;
+    accountManager;
+    tokenRefresher;
+    repository;
+    initialDelayTimer = null;
+    intervalTimer = null;
+    running = false;
+    disposed = false;
+    activeLeaderLockRelease = null;
+    constructor(config, accountManager, tokenRefresher, repository) {
+        this.config = config;
+        this.accountManager = accountManager;
+        this.tokenRefresher = tokenRefresher;
+        this.repository = repository;
+    }
+    start() {
+        if (!this.config.token_keepalive_enabled) {
+            return;
+        }
+        if (this.initialDelayTimer || this.intervalTimer) {
+            return;
+        }
+        this.disposed = false;
+        this.initialDelayTimer = setTimeout(() => {
+            this.initialDelayTimer = null;
+            void this.tick();
+        }, INITIAL_TICK_DELAY_MS);
+        this.intervalTimer = setInterval(() => {
+            void this.tick();
+        }, this.config.token_keepalive_interval_ms);
+        unrefTimer(this.initialDelayTimer);
+        unrefTimer(this.intervalTimer);
+    }
+    dispose() {
+        this.disposed = true;
+        if (this.initialDelayTimer) {
+            clearTimeout(this.initialDelayTimer);
+            this.initialDelayTimer = null;
+        }
+        if (this.intervalTimer) {
+            clearInterval(this.intervalTimer);
+            this.intervalTimer = null;
+        }
+        void this.releaseLeaderLock();
+    }
+    async runOnceForTest() {
+        await this.tick();
+    }
+    async tick() {
+        if (this.disposed) {
+            return;
+        }
+        if (this.running) {
+            logger.debug('Kiro token keep-alive tick skipped because previous tick is still running');
+            return;
+        }
+        this.running = true;
+        try {
+            const release = await tryAcquireKeepAliveLock();
+            if (!release) {
+                return;
+            }
+            this.activeLeaderLockRelease = release;
+            try {
+                await this.refreshNearExpiryAccounts();
+            }
+            finally {
+                await this.releaseLeaderLock();
+            }
+        }
+        catch (error) {
+            logger.error('Kiro token keep-alive tick failed', normalizeError(error));
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    async refreshNearExpiryAccounts() {
+        this.repository.invalidateCache();
+        const accounts = this.accountManager.getAccounts();
+        for (const account of accounts) {
+            if (this.disposed) {
+                return;
+            }
+            try {
+                await this.refreshAccountIfNeeded(account);
+            }
+            catch (error) {
+                logger.error('Kiro token keep-alive account refresh failed', {
+                    email: account.email,
+                    message: normalizeError(error).message
+                });
+            }
+        }
+    }
+    async refreshAccountIfNeeded(account) {
+        if (!account.isHealthy || isPermanentError(account.unhealthyReason)) {
+            return;
+        }
+        const auth = this.accountManager.toAuthDetails(account);
+        if (!accessTokenExpired(auth, this.config.token_expiry_buffer_ms)) {
+            return;
+        }
+        await this.tokenRefresher.refreshIfNeeded(account, auth, noopToast);
+    }
+    async releaseLeaderLock() {
+        const release = this.activeLeaderLockRelease;
+        if (!release) {
+            return;
+        }
+        this.activeLeaderLockRelease = null;
+        try {
+            await release();
+        }
+        catch (error) {
+            logger.warn('Failed to release Kiro token keep-alive leader lock', normalizeError(error));
+        }
+    }
+}

package/dist/core/auth/token-refresher.d.ts

@@ -7,17 +7,36 @@ interface TokenRefresherConfig {
     auto_sync_kiro_cli: boolean;
     account_selection_strategy: 'sticky' | 'round-robin' | 'lowest-usage';
 }
+/** Outcome of a forced refresh; `dead` distinguishes refresh-token-dead
+ *  (needs re-login) from a transient failure (network/5xx). */
+export interface ForceRefreshResult {
+    ok: boolean;
+    dead: boolean;
+}
+/**
+ * Decide whether a refresh failure means the refresh token / OIDC client is
+ * dead (permanent, needs re-login) or is merely transient (network/5xx).
+ * A missing/unusable-credential decode error (e.g. a corrupted refresh_token
+ * that never reaches the wire, or an empty response) is treated as dead:
+ * the stored credentials are unusable, so the account needs a re-login.
+ */
+export declare function isRefreshErrorDead(error: unknown): boolean;
 export declare class TokenRefresher {
     private config;
     private accountManager;
     private syncFromKiroCli;
     private repository;
+    private readonly inFlight;
+    private readonly lastDeadToastAt;
     constructor(config: TokenRefresherConfig, accountManager: AccountManager, syncFromKiroCli: () => Promise<void>, repository: AccountRepository);
     refreshIfNeeded(account: ManagedAccount, auth: KiroAuthDetails, showToast: ToastFunction): Promise<{
         account: ManagedAccount;
         shouldContinue: boolean;
     }>;
-    forceRefresh(account: ManagedAccount, showToast: ToastFunction): Promise<boolean>;
+    forceRefresh(account: ManagedAccount, showToast: ToastFunction): Promise<ForceRefreshResult>;
+    private startOrJoinRefresh;
+    private runLockedRefresh;
+    private readLatestAuth;
     private handleRefreshError;
 }
 export {};

package/dist/core/auth/token-refresher.js

@@ -1,12 +1,45 @@
 import { accessTokenExpired } from '../../kiro/auth.js';
 import { KiroTokenRefreshError } from '../../plugin/errors.js';
+import { isRefreshTokenDead, toDeadReason } from '../../plugin/health.js';
 import * as logger from '../../plugin/logger.js';
+import { withRefreshLock } from '../../plugin/storage/locked-operations.js';
 import { refreshAccessToken } from '../../plugin/token.js';
+const DEAD_TOAST_DEBOUNCE_MS = 60000;
+/**
+ * Decide whether a refresh failure means the refresh token / OIDC client is
+ * dead (permanent, needs re-login) or is merely transient (network/5xx).
+ * A missing/unusable-credential decode error (e.g. a corrupted refresh_token
+ * that never reaches the wire, or an empty response) is treated as dead:
+ * the stored credentials are unusable, so the account needs a re-login.
+ */
+export function isRefreshErrorDead(error) {
+    if (error instanceof KiroTokenRefreshError) {
+        if (error.code === 'MISSING_CREDENTIALS' || error.code === 'INVALID_RESPONSE') {
+            return true;
+        }
+        if (error.code === 'NETWORK_ERROR') {
+            return false;
+        }
+        if (error.code && isRefreshTokenDead(error.code)) {
+            return true;
+        }
+        return isRefreshTokenDead(error.message);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    // Unusable stored credentials (missing/short/malformed refresh material that
+    // fails to encode or decode) are dead: the account needs a re-login.
+    if (message.includes('Missing credentials') || message.includes('Missing creds')) {
+        return true;
+    }
+    return isRefreshTokenDead(message);
+}
 export class TokenRefresher {
     config;
     accountManager;
     syncFromKiroCli;
     repository;
+    inFlight = new Map();
+    lastDeadToastAt = new Map();
     constructor(config, accountManager, syncFromKiroCli, repository) {
         this.config = config;
         this.accountManager = accountManager;
@@ -18,9 +51,7 @@ export class TokenRefresher {
             return { account, shouldContinue: false };
         }
         try {
-            const newAuth = await refreshAccessToken(auth);
-            this.accountManager.updateFromAuth(account, newAuth);
-            await this.repository.batchSave(this.accountManager.getAccounts());
+            await this.startOrJoinRefresh(account, () => auth);
             return { account, shouldContinue: false };
         }
         catch (e) {
@@ -28,28 +59,99 @@ export class TokenRefresher {
         }
     }
     async forceRefresh(account, showToast) {
-        const auth = this.accountManager.toAuthDetails(account);
         try {
-            const newAuth = await refreshAccessToken(auth);
-            this.accountManager.updateFromAuth(account, newAuth);
-            await this.repository.batchSave(this.accountManager.getAccounts());
-            return true;
+            await this.startOrJoinRefresh(account, () => this.accountManager.toAuthDetails(account));
+            return { ok: true, dead: false };
         }
         catch (e) {
+            const dead = isRefreshErrorDead(e);
             logger.error('Forced token refresh failed', {
                 email: account.email,
                 code: e instanceof KiroTokenRefreshError ? e.code : undefined,
-                message: e instanceof Error ? e.message : String(e)
+                message: e instanceof Error ? e.message : String(e),
+                dead
             });
             showToast('403: Token refresh failed after stale-token detection.', 'warning');
-            return false;
+            return { ok: false, dead };
+        }
+    }
+    startOrJoinRefresh(account, getAuthFallback) {
+        const existing = this.inFlight.get(account.id);
+        if (existing) {
+            return existing;
+        }
+        // The first in-process caller supplies the fallback auth for this shared
+        // refresh. A2 re-reads the latest DB row inside the lock, so the fallback is
+        // only used when that row is missing; joiners keep their own try/catch and
+        // preserve their method-specific error handling.
+        const refresh = this.runLockedRefresh(account, getAuthFallback).finally(() => {
+            if (this.inFlight.get(account.id) === refresh) {
+                this.inFlight.delete(account.id);
+            }
+        });
+        this.inFlight.set(account.id, refresh);
+        return refresh;
+    }
+    async runLockedRefresh(account, getAuthFallback) {
+        await withRefreshLock(account.id, async () => {
+            const { latestAuth } = await this.readLatestAuth(account);
+            if (latestAuth && !accessTokenExpired(latestAuth, this.config.token_expiry_buffer_ms)) {
+                this.accountManager.updateFromAuth(account, latestAuth);
+                return;
+            }
+            const newAuth = await refreshAccessToken(latestAuth ?? getAuthFallback());
+            this.accountManager.updateFromAuth(account, newAuth);
+            await this.repository.batchSave(this.accountManager.getAccounts());
+        });
+    }
+    async readLatestAuth(account) {
+        this.repository.invalidateCache();
+        const accounts = await this.repository.findAll();
+        const latestAccount = accounts.find((a) => a.id === account.id) ?? null;
+        if (!latestAccount) {
+            return { latestAccount: null, latestAuth: null };
+        }
+        account.email = latestAccount.email;
+        account.authMethod = latestAccount.authMethod;
+        account.region = latestAccount.region;
+        if (latestAccount.oidcRegion !== undefined) {
+            account.oidcRegion = latestAccount.oidcRegion;
+        }
+        else {
+            delete account.oidcRegion;
+        }
+        if (latestAccount.clientId !== undefined) {
+            account.clientId = latestAccount.clientId;
+        }
+        else {
+            delete account.clientId;
+        }
+        if (latestAccount.clientSecret !== undefined) {
+            account.clientSecret = latestAccount.clientSecret;
+        }
+        else {
+            delete account.clientSecret;
+        }
+        if (latestAccount.profileArn !== undefined) {
+            account.profileArn = latestAccount.profileArn;
+        }
+        else {
+            delete account.profileArn;
         }
+        account.refreshToken = latestAccount.refreshToken;
+        account.accessToken = latestAccount.accessToken;
+        account.expiresAt = latestAccount.expiresAt;
+        return {
+            latestAccount,
+            latestAuth: this.accountManager.toAuthDetails(account)
+        };
     }
     async handleRefreshError(error, account, showToast) {
+        const message = error instanceof Error ? error.message : String(error);
         logger.error('Token refresh failed', {
             email: account.email,
             code: error instanceof KiroTokenRefreshError ? error.code : undefined,
-            message: error instanceof Error ? error.message : String(error)
+            message
         });
         if (this.config.auto_sync_kiro_cli) {
             await this.syncFromKiroCli();
@@ -62,23 +164,23 @@ export class TokenRefresher {
             showToast('Credentials recovered from Kiro CLI sync.', 'info');
             return { account: stillAcc, shouldContinue: true };
         }
-        if (error instanceof KiroTokenRefreshError &&
-            (error.code === 'ExpiredTokenException' ||
-                error.code === 'InvalidTokenException' ||
-                error.code === 'ExpiredClientException' ||
-                error.code === 'HTTP_401' ||
-                error.code === 'HTTP_403' ||
-                error.message.includes('Invalid refresh token provided') ||
-                error.message.includes('Invalid grant provided') ||
-                error.message.includes('Client is expired'))) {
-            this.accountManager.markUnhealthy(account, error.message);
+        // Mark unhealthy ONLY when the refresh token itself is dead. A transient
+        // failure (network / 5xx) leaves the account healthy so it can retry.
+        if (isRefreshErrorDead(error)) {
+            this.accountManager.markUnhealthy(account, toDeadReason(message));
             await this.repository.batchSave(this.accountManager.getAccounts());
+            const now = Date.now();
+            const lastToastAt = this.lastDeadToastAt.get(account.id) ?? 0;
+            if (now - lastToastAt >= DEAD_TOAST_DEBOUNCE_MS) {
+                showToast(`Kiro account ${account.email} sign-in expired — run "opencode auth login" and select kiro-auth to re-authenticate.`, 'warning');
+                this.lastDeadToastAt.set(account.id, now);
+            }
             return { account, shouldContinue: true };
         }
         logger.error('Token refresh unrecoverable', {
             email: account.email,
             code: error instanceof KiroTokenRefreshError ? error.code : undefined,
-            message: error instanceof Error ? error.message : String(error)
+            message
         });
         throw error;
     }

package/dist/core/request/error-handler.d.ts

@@ -1,12 +1,13 @@
 import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
 import type { AccountManager } from '../../plugin/accounts.js';
 import type { ManagedAccount } from '../../plugin/types.js';
+import type { ForceRefreshResult } from '../auth/token-refresher.js';
 type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
-interface RequestContext {
+export interface RequestContext {
     retry: number;
-    bearerRefreshAttempted?: boolean;
+    forcedRefreshAccountIds?: Set<string>;
 }
-type ForceRefreshFn = (account: ManagedAccount, showToast: ToastFunction) => Promise<boolean>;
+type ForceRefreshFn = (account: ManagedAccount, showToast: ToastFunction) => Promise<ForceRefreshResult>;
 interface ErrorHandlerConfig {
     rate_limit_max_retries: number;
     rate_limit_retry_delay_ms: number;
@@ -22,6 +23,8 @@ export declare class ErrorHandler {
         newContext?: RequestContext;
         switchAccount?: boolean;
     }>;
+    private markDeadAndSwitchOrFail;
+    private transientForbidden;
     handleNetworkError(error: any, context: RequestContext, showToast: ToastFunction): Promise<{
         shouldRetry: boolean;
         newContext?: RequestContext;

package/dist/core/request/error-handler.js

@@ -1,3 +1,4 @@
+import { isAccessTokenError, toDeadReason } from '../../plugin/health.js';
 export class ErrorHandler {
     config;
     accountManager;
@@ -45,7 +46,7 @@ export class ErrorHandler {
                     errorMessage = errorData.Message;
                 }
             }
-            catch (e) { }
+            catch { }
             if (account.failCount < 5) {
                 const delay = 1000 * Math.pow(2, account.failCount - 1);
                 showToast(`500: ${errorMessage}. Retrying in ${Math.ceil(delay / 1000)}s...`, 'warning');
@@ -93,23 +94,26 @@ export class ErrorHandler {
                 errorReason = 'Account Suspended';
                 isPermanent = true;
             }
-            const isInvalidBearer = errorReason.includes('bearer token included in the request is invalid') ||
-                errorReason.includes('The bearer token included in the request is invalid');
-            if (response.status === 403 &&
-                isInvalidBearer &&
-                !context.bearerRefreshAttempted &&
-                this.forceRefresh) {
-                const refreshed = await this.forceRefresh(account, showToast);
-                if (refreshed) {
-                    showToast('403: Stale token detected. Refreshed and retrying...', 'warning');
-                    return {
-                        shouldRetry: true,
-                        newContext: { ...context, bearerRefreshAttempted: true }
-                    };
+            const isInvalidBearer = isAccessTokenError(errorReason);
+            if (response.status === 403 && isInvalidBearer && this.forceRefresh) {
+                const forced = context.forcedRefreshAccountIds ?? new Set();
+                const alreadyForced = forced.has(account.id);
+                if (!alreadyForced) {
+                    const result = await this.forceRefresh(account, showToast);
+                    const nextForced = new Set(forced).add(account.id);
+                    if (result.ok) {
+                        showToast('403: Stale token detected. Refreshed and retrying...', 'warning');
+                        return {
+                            shouldRetry: true,
+                            newContext: { ...context, forcedRefreshAccountIds: nextForced }
+                        };
+                    }
+                    if (result.dead) {
+                        return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, nextForced, showToast);
+                    }
+                    return this.transientForbidden(errorReason, response.status, { ...context, forcedRefreshAccountIds: nextForced }, showToast);
                 }
-            }
-            if (isInvalidBearer) {
-                isPermanent = true;
+                return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, forced, showToast);
             }
             if (isPermanent) {
                 account.failCount = 10;
@@ -123,13 +127,7 @@ export class ErrorHandler {
             if (response.status === 403 &&
                 !isPermanent &&
                 context.retry < this.config.rate_limit_max_retries) {
-                const delay = this.config.rate_limit_retry_delay_ms * Math.pow(2, context.retry);
-                showToast(`403: ${errorReason}. Retrying in ${Math.ceil(delay / 1000)}s...`, 'warning');
-                await this.sleep(delay);
-                return {
-                    shouldRetry: true,
-                    newContext: { ...context, retry: context.retry + 1 }
-                };
+                return this.transientForbidden(errorReason, response.status, context, showToast);
             }
             showToast(`${response.status}: ${errorReason}`, 'error');
             return { shouldRetry: false };
@@ -138,6 +136,34 @@ export class ErrorHandler {
         showToast(`${response.status}: ${reason || response.statusText}`, 'error');
         return { shouldRetry: false };
     }
+    async markDeadAndSwitchOrFail(account, errorReason, status, context, forced, showToast) {
+        const deadReason = toDeadReason(errorReason);
+        this.accountManager.markUnhealthy(account, deadReason);
+        await this.repository.batchSave(this.accountManager.getAccounts());
+        if (this.accountManager.getAccountCount() > 1) {
+            showToast(`${status}: ${errorReason}. Re-login required. Switching account...`, 'warning');
+            return {
+                shouldRetry: true,
+                switchAccount: true,
+                newContext: { ...context, forcedRefreshAccountIds: forced }
+            };
+        }
+        showToast(`${status}: ${errorReason}. Re-login required.`, 'error');
+        return { shouldRetry: false };
+    }
+    async transientForbidden(errorReason, status, context, showToast) {
+        if (context.retry >= this.config.rate_limit_max_retries) {
+            showToast(`${status}: ${errorReason}`, 'error');
+            return { shouldRetry: false };
+        }
+        const delay = this.config.rate_limit_retry_delay_ms * Math.pow(2, context.retry);
+        showToast(`${status}: ${errorReason}. Retrying in ${Math.ceil(delay / 1000)}s...`, 'warning');
+        await this.sleep(delay);
+        return {
+            shouldRetry: true,
+            newContext: { ...context, retry: context.retry + 1 }
+        };
+    }
     async handleNetworkError(error, context, showToast) {
         if (this.isNetworkError(error) && context.retry < this.config.rate_limit_max_retries) {
             const d = this.config.rate_limit_retry_delay_ms * Math.pow(2, context.retry);

package/dist/core/request/request-handler.d.ts

@@ -1,6 +1,7 @@
 import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
 import type { AccountManager } from '../../plugin/accounts.js';
 import type { KiroConfig } from '../../plugin/config/index.js';
+import { TokenRefresher } from '../auth/token-refresher.js';
 type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
 export declare class RequestHandler {
     private accountManager;
@@ -17,6 +18,7 @@ export declare class RequestHandler {
     private lastFailedReauthAt;
     private static kiroRequestQueue;
     constructor(accountManager: AccountManager, config: KiroConfig, repository: AccountRepository, client?: any | undefined);
+    get sharedTokenRefresher(): TokenRefresher;
     handle(input: any, init: any, showToast: ToastFunction): Promise<Response>;
     private enqueueKiroRequest;
     private handleKiroRequest;

package/dist/core/request/request-handler.js

@@ -38,6 +38,9 @@ export class RequestHandler {
         this.usageTracker = new UsageTracker(config, accountManager, repository);
         this.retryStrategy = new RetryStrategy(config);
     }
+    get sharedTokenRefresher() {
+        return this.tokenRefresher;
+    }
     async handle(input, init, showToast) {
         const url = typeof input === 'string' ? input : input.url;
         if (!KIRO_API_PATTERN.test(url)) {
@@ -67,7 +70,7 @@ export class RequestHandler {
             body.thinkingConfig?.thinkingBudget ||
             body.thinkingConfig?.budget_tokens ||
             20000;
-        let handlerContext = { retry: 0 };
+        let handlerContext = { retry: 0, forcedRefreshAccountIds: new Set() };
         let consecutiveNullAccounts = 0;
         const retryContext = this.retryStrategy.createContext();
         while (true) {
@@ -126,7 +129,7 @@ export class RequestHandler {
                         }
                     });
                 }
-                catch (e) { }
+                catch { }
             }
             const apiTimestamp = this.config.enable_log_api_request ? logger.getTimestamp() : null;
             if (apiTimestamp) {