nterminal 1.3.4 → 1.3.5

package/dist/server/accounts/accountService.js

@@ -4,6 +4,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import os from 'node:os';
 import path from 'node:path';
+import { ProviderRequestError, requestAccountUsage, requestTokenRefresh, unavailableUsage } from './providerRequests.js';
 const VAULT_DIRECTORY = 'credential-vault';
 const VAULT_INDEX = 'index.json';
 const VAULT_KEY = 'key';
@@ -19,13 +20,8 @@ const UNKNOWN_EXPIRY_RETRY_MS = 15 * 60_000;
 const UNKNOWN_EXPIRY_REFRESH_INTERVAL_MS = 7 * 24 * 60 * 60_000;
 const PROVIDER_TERMINATE_GRACE_MS = 2_000;
 const TERMINATION_ACKNOWLEDGEMENT_TTL_MS = 5 * 60_000;
-const CODEX_TOKEN_URL = 'https://auth.openai.com/oauth/token';
-// Keep this aligned with Codex CLI's public OAuth client. Codex refreshes via
-// JSON (unlike Claude's form-encoded endpoint), and the client identifier is
-// validated by auth.openai.com.
-const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
-const CLAUDE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
-const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+const USAGE_CACHE_TTL_MS = 2 * 60_000;
+const USAGE_FAILURE_TTL_MS = 30_000;
 export class AccountServiceError extends Error {
     code;
     constructor(code, message = code) {
@@ -36,7 +32,7 @@ export class AccountServiceError extends Error {
     get statusCode() {
         if (this.code === 'preview_mode')
             return 403;
-        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending'].includes(this.code))
+        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending', 'active_cli_refresh_deferred'].includes(this.code))
             return 409;
         return 400;
     }
@@ -52,8 +48,14 @@ export class AccountService {
     operationInFlight = false;
     disposed = false;
     retryAfter = new Map();
-    // In-memory acknowledgement set by an explicit user request to stop a provider.
-    // It permits one imminent account change even when a process takes time to exit.
+    usageCache = new Map();
+    usageInFlight = new Map();
+    fetcher;
+    onDiagnostic;
+    diagnosticSignatures = new Map();
+    // In-memory acknowledgement set once an explicit stop left no provider
+    // processes. It only bridges the pane-status poll lag; live processes always
+    // block, so a session started afterwards cannot race an account change.
     terminationAcknowledgements = new Map();
     processSnapshotInFlight = null;
     processProbe;
@@ -70,6 +72,8 @@ export class AccountService {
         // vault instead of touching production account metadata.
         this.vaultPath = path.join(path.dirname(config.statePath), VAULT_DIRECTORY);
         this.now = options.now ?? (() => new Date());
+        this.fetcher = options.fetcher ?? ((...args) => fetch(...args));
+        this.onDiagnostic = options.onDiagnostic ?? (() => undefined);
         this.processLister = options.processLister ?? (async (provider) => providerProcesses(provider, await this.listProcessSnapshot()));
         this.paneProcessResolver = options.paneProcessResolver ?? (options.processLister
             ? async () => new Map()
@@ -95,7 +99,7 @@ export class AccountService {
     async synchronize() {
         return this.mutate(async () => {
             const index = await this.readIndex();
-            await this.captureActiveCredentials(index);
+            await this.captureActiveCredentials(index, undefined, true);
         });
     }
     select(provider, profileId) {
@@ -116,6 +120,80 @@ export class AccountService {
     refresh(provider, profileId) {
         return this.mutate(() => this.refreshUnlocked(provider, profileId));
     }
+    usage(provider) {
+        if (this.config.previewMode)
+            return Promise.reject(new AccountServiceError('preview_mode'));
+        if (this.disposed)
+            return Promise.reject(new AccountServiceError('account_operation_busy'));
+        const pending = this.usageInFlight.get(provider);
+        if (pending)
+            return pending;
+        const request = this.readUsage(provider);
+        this.usageInFlight.set(provider, request);
+        void request.finally(() => {
+            if (this.usageInFlight.get(provider) === request)
+                this.usageInFlight.delete(provider);
+        }).catch(() => undefined);
+        return request;
+    }
+    async readUsage(provider) {
+        const index = await this.readIndex();
+        const profiles = index.profiles.filter((profile) => profile.provider === provider);
+        const results = [];
+        const signal = AbortSignal.timeout(10_000);
+        let cursor = 0;
+        const worker = async () => {
+            while (cursor < profiles.length && !this.disposed) {
+                const profile = profiles[cursor++];
+                const usage = signal.aborted ? unavailableUsage(this.now(), 'usage_timeout') : await this.readProfileUsage(index, profile, signal);
+                if (usage)
+                    results.push({ profileId: profile.id, usage });
+            }
+        };
+        await Promise.all([worker(), worker()]);
+        for (const id of this.usageCache.keys())
+            if (!index.profiles.some((profile) => profile.id === id))
+                this.usageCache.delete(id);
+        return { provider, profiles: results };
+    }
+    async readProfileUsage(index, profile, signal) {
+        const provider = profile.provider;
+        const cached = this.usageCache.get(profile.id);
+        let usage;
+        const credentialHash = profile.credentialHash;
+        try {
+            if (index.active[provider] !== profile.id && cached && cached.until > this.now().getTime() && cached.credentialHash === credentialHash)
+                return cached.usage;
+            const credentials = index.active[provider] === profile.id
+                ? await this.readCredentialFile(provider) : await this.readVaultCredentials(profile.id);
+            if (!credentials || hashCredential(credentials) !== credentialHash)
+                throw new AccountServiceError('account_credential_changed');
+            if (cached && cached.until > this.now().getTime() && cached.credentialHash === credentialHash)
+                return cached.usage;
+            usage = await requestAccountUsage(provider, credentials, this.now(), this.fetcher, signal);
+        }
+        catch (error) {
+            usage = unavailableUsage(this.now(), error instanceof AccountServiceError ? error.code : 'usage_unavailable');
+        }
+        // A switch, login, removal, or refresh can finish while a quota request is
+        // in flight. Never associate its response with a different credential.
+        const latest = await this.readIndex();
+        const current = latest.profiles.find((entry) => entry.id === profile.id && entry.provider === provider);
+        if (!current)
+            return null;
+        if (current.credentialHash !== credentialHash || latest.active[provider] !== index.active[provider]) {
+            usage = unavailableUsage(this.now(), 'account_credential_changed');
+        }
+        else if (latest.active[provider] === profile.id) {
+            const live = await this.readCredentialFile(provider).catch(() => null);
+            if (!live || hashCredential(live) !== credentialHash)
+                usage = unavailableUsage(this.now(), 'account_credential_changed');
+        }
+        if (usage.code !== 'account_credential_changed' && credentialHash) {
+            this.usageCache.set(profile.id, { credentialHash, until: this.now().getTime() + (usage.status === 'available' ? USAGE_CACHE_TTL_MS : USAGE_FAILURE_TTL_MS), usage });
+        }
+        return usage;
+    }
     terminateProviderSessions(provider) {
         return this.mutate(() => this.terminateProviderSessionsUnlocked(provider));
     }
@@ -143,7 +221,7 @@ export class AccountService {
         }));
         const pendingReady = new Map();
         await Promise.all(['codex', 'claude'].map(async (provider) => {
-            pendingReady.set(provider, Boolean(refreshed.pending[provider] && await this.readCredentialFile(provider)));
+            pendingReady.set(provider, Boolean(refreshed.pending[provider] && await this.readCredentialFile(provider).catch(() => null)));
         }));
         return {
             providers: ['codex', 'claude'].map((provider) => this.providerStatus(refreshed, provider, running, processes.get(provider) ?? [], processCheckUnavailable, pendingReady.get(provider) === true))
@@ -154,7 +232,7 @@ export class AccountService {
         await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (index.pending[provider])
             throw new AccountServiceError('account_login_already_pending');
-        await this.captureActiveCredentials(index);
+        await this.captureActiveCredentials(index, provider);
         const profile = index.profiles.find((candidate) => candidate.id === profileId && candidate.provider === provider);
         if (!profile)
             throw new AccountServiceError('account_not_found');
@@ -187,7 +265,7 @@ export class AccountService {
         const index = await this.readIndex();
         if (index.pending[provider])
             throw new AccountServiceError('account_login_already_pending');
-        await this.captureActiveCredentials(index);
+        await this.captureActiveCredentials(index, provider);
         const profile = index.profiles.find((candidate) => candidate.id === profileId && candidate.provider === provider);
         if (!profile)
             throw new AccountServiceError('account_not_found');
@@ -198,6 +276,8 @@ export class AccountService {
         await this.writeIndex(index);
         await rm(this.profilePath(profile.id), { force: true });
         this.retryAfter.delete(profile.id);
+        this.usageCache.delete(profile.id);
+        this.diagnosticSignatures.delete(`account.refresh:${provider}:${profile.id}`);
         return this.status();
     }
     async beginLoginUnlocked(provider) {
@@ -205,7 +285,7 @@ export class AccountService {
         await this.assertNoRunningPanes(provider, { allowTerminationAcknowledgement: true });
         if (index.pending[provider])
             throw new AccountServiceError('account_login_already_pending');
-        await this.captureActiveCredentials(index);
+        await this.captureActiveCredentials(index, provider);
         const current = await this.archiveActiveCredential(index, provider);
         index.pending[provider] = {
             provider,
@@ -254,7 +334,7 @@ export class AccountService {
         const credentials = await this.readCredentialFile(provider);
         if (!credentials)
             throw new AccountServiceError('account_login_not_complete');
-        const profile = await this.storeProfile(index, provider, credentials, label || defaultLabel(provider, index.profiles));
+        const profile = await this.storeProfile(index, provider, credentials, label);
         index.active[provider] = profile.id;
         delete index.pending[provider];
         await this.writeIndex(index);
@@ -286,15 +366,12 @@ export class AccountService {
     }
     async refreshUnlocked(provider, profileId) {
         const index = await this.readIndex();
-        if (index.pending[provider])
-            throw new AccountServiceError('account_login_already_pending');
-        await this.captureActiveCredentials(index);
+        await this.captureActiveCredentials(index, provider, true);
         const targetId = profileId ?? index.active[provider];
         const profile = targetId ? index.profiles.find((candidate) => candidate.id === targetId && candidate.provider === provider) : undefined;
         if (!profile)
             throw new AccountServiceError('account_not_found');
-        await this.refreshProfile(index, profile);
-        await this.writeIndex(index);
+        await this.refreshAndRecord(index, profile);
         return this.status();
     }
     start() {
@@ -328,17 +405,11 @@ export class AccountService {
                 try {
                     await this.mutate(async () => {
                         const index = await this.readIndex();
-                        if (index.pending[profile.provider])
-                            return;
-                        await this.captureActiveCredentials(index);
+                        await this.captureActiveCredentials(index, profile.provider, true);
                         const current = index.profiles.find((entry) => entry.id === profile.id);
                         if (!current || !shouldRefreshProfile(current, this.now()))
                             return;
-                        if (current.refreshTokenExpiresAt && Date.parse(current.refreshTokenExpiresAt) <= this.now().getTime())
-                            return;
-                        await this.refreshProfile(index, current);
-                        await this.writeIndex(index);
-                        this.retryAfter.delete(current.id);
+                        await this.refreshAndRecord(index, current);
                     });
                 }
                 catch (error) {
@@ -347,20 +418,62 @@ export class AccountService {
                     // expiry instead of delaying the profile on stale metadata.
                     if (error instanceof AccountServiceError && ['account_operation_busy', 'account_credential_changed'].includes(error.code))
                         continue;
-                    const retryAt = error instanceof AccountServiceError && error.code === 'account_refresh_failed'
-                        ? this.now().getTime() + UNKNOWN_EXPIRY_RETRY_MS
-                        : refreshRetryAt(profile, this.now());
-                    this.retryAfter.set(profile.id, retryAt);
+                    this.retryAfter.set(profile.id, refreshRetryAt(profile, this.now()));
                 }
             }
         }
-        catch {
-            // Background filesystem failures must not become unhandled rejections.
+        catch (error) {
+            this.reportDiagnostic({ event: 'account.refresh_scan', state: 'retrying', code: serviceErrorCode(error) });
         }
         finally {
             this.refreshInFlight = false;
         }
     }
+    async refreshAndRecord(index, profile) {
+        const previous = profile.refresh;
+        const attemptedAt = this.now().toISOString();
+        profile.refresh = {
+            state: 'retrying', lastAttemptAt: attemptedAt, lastSuccessAt: previous?.lastSuccessAt ?? null,
+            nextRetryAt: null, code: null, httpStatus: null
+        };
+        await this.writeIndex(index);
+        try {
+            await this.refreshProfile(index, profile);
+            profile.refresh = { ...profile.refresh, state: 'success', lastAttemptAt: attemptedAt, lastSuccessAt: this.now().toISOString(), nextRetryAt: null, code: null, httpStatus: null };
+            this.retryAfter.delete(profile.id);
+            this.usageCache.delete(profile.id);
+            await this.writeIndex(index);
+            this.reportDiagnostic({ event: 'account.refresh', provider: profile.provider, profileId: profile.id, state: 'success', code: null });
+        }
+        catch (error) {
+            if (error instanceof AccountServiceError && error.code === 'account_credential_changed') {
+                this.reportDiagnostic({ event: 'account.refresh', provider: profile.provider, profileId: profile.id, state: 'deferred', code: error.code });
+                throw error;
+            }
+            const failure = error instanceof ProviderRequestError ? error : null;
+            const code = failure?.code ?? serviceErrorCode(error);
+            const state = failure?.kind === 'reauth' || code === 'refresh_token_unavailable' ? 'reauth_required' : ['active_cli_refresh_deferred', 'account_process_check_unavailable'].includes(code) ? 'deferred' : 'retrying';
+            const retryMs = failure?.kind === 'rejected' ? UNKNOWN_EXPIRY_RETRY_MS : null;
+            const retryAt = state === 'reauth_required' ? null : new Date(Math.max(retryMs ? this.now().getTime() + retryMs : refreshRetryAt(profile, this.now()), this.now().getTime() + (failure?.retryAfterMs ?? 0))).toISOString();
+            profile.refresh = { state, lastAttemptAt: attemptedAt, lastSuccessAt: previous?.lastSuccessAt ?? null, nextRetryAt: retryAt, code, httpStatus: failure?.httpStatus ?? null };
+            this.reportDiagnostic({ event: 'account.refresh', provider: profile.provider, profileId: profile.id, state, code, httpStatus: failure?.httpStatus ?? null, nextRetryAt: retryAt });
+            await this.writeIndex(index);
+            if (error instanceof AccountServiceError)
+                throw error;
+            throw new AccountServiceError(state === 'reauth_required' ? 'account_reauth_required' : 'account_refresh_unavailable');
+        }
+    }
+    reportDiagnostic(event) {
+        const key = `${event.event}:${event.provider ?? ''}:${event.profileId ?? ''}`;
+        const signature = `${event.state}:${event.code}:${event.httpStatus ?? ''}`;
+        if (this.diagnosticSignatures.get(key) === signature)
+            return;
+        this.diagnosticSignatures.set(key, signature);
+        try {
+            this.onDiagnostic(event);
+        }
+        catch { /* Logging cannot interrupt token storage. */ }
+    }
     providerStatus(index, provider, running, runningProcesses, processCheckUnavailable, pendingReady) {
         const activeId = index.active[provider] ?? null;
         const profile = activeId ? index.profiles.find((candidate) => candidate.id === activeId) ?? null : null;
@@ -386,23 +499,18 @@ export class AccountService {
         });
     }
     async assertNoRunningPanes(provider, options = {}) {
-        if (provider !== 'codex' && options.allowTerminationAcknowledgement && this.hasTerminationAcknowledgement(provider))
-            return;
-        if (this.runningPanes().some((pane) => pane.provider === provider) || await this.processProbe(provider)) {
+        const acknowledged = options.allowTerminationAcknowledgement === true && this.hasTerminationAcknowledgement(provider);
+        if ((!acknowledged && this.runningPanes().some((pane) => pane.provider === provider)) || await this.processProbe(provider)) {
             throw new AccountServiceError('provider_panes_running');
         }
     }
     async terminateProviderSessionsUnlocked(provider) {
         const processes = await this.processLister(provider);
+        this.clearTerminationAcknowledgement(provider);
         await this.processTerminator(provider, processes);
-        if (provider === 'codex') {
-            this.clearTerminationAcknowledgement(provider);
-            if (await this.processProbe(provider))
-                throw new AccountServiceError('provider_panes_running');
-        }
-        else {
-            this.terminationAcknowledgements.set(provider, this.now().getTime() + TERMINATION_ACKNOWLEDGEMENT_TTL_MS);
-        }
+        if (await this.processProbe(provider))
+            throw new AccountServiceError('provider_panes_running');
+        this.terminationAcknowledgements.set(provider, this.now().getTime() + TERMINATION_ACKNOWLEDGEMENT_TTL_MS);
         return this.status();
     }
     hasTerminationAcknowledgement(provider) {
@@ -433,17 +541,28 @@ export class AccountService {
         }
         return this.processSnapshotInFlight;
     }
-    async captureActiveCredentials(index) {
+    async captureActiveCredentials(index, onlyProvider, tolerateErrors = false) {
         const before = JSON.stringify(index);
-        for (const provider of ['codex', 'claude']) {
-            if (!index.pending[provider])
+        const providers = onlyProvider ? [onlyProvider] : ['codex', 'claude'];
+        for (const provider of providers) {
+            if (index.pending[provider])
+                continue;
+            try {
                 await this.captureActiveCredential(index, provider);
+                this.diagnosticSignatures.delete(`account.refresh_scan:${provider}:`);
+            }
+            catch (error) {
+                if (!tolerateErrors)
+                    throw error;
+                this.reportDiagnostic({ event: 'account.refresh_scan', provider, state: 'retrying', code: serviceErrorCode(error) });
+            }
         }
         if (JSON.stringify(index) !== before)
             await this.writeIndex(index);
         // Only metadata is retained for active accounts. A duplicate can exist
         // briefly during a switch, until the source file and index are committed.
-        for (const id of Object.values(index.active)) {
+        for (const provider of providers) {
+            const id = index.active[provider];
             if (id)
                 await rm(this.profilePath(id), { force: true });
         }
@@ -467,7 +586,7 @@ export class AccountService {
                 await this.removeUnavailableProfile(index, previousId);
             return;
         }
-        const profile = await this.storeProfile(index, provider, credentials, defaultLabel(provider, index.profiles));
+        const profile = await this.storeProfile(index, provider, credentials);
         index.active[provider] = profile.id;
         if (previousId !== profile.id)
             await this.removeUnavailableProfile(index, previousId);
@@ -495,21 +614,27 @@ export class AccountService {
         await this.writeVaultCredentials(profile.id, credentials);
         return credentials;
     }
-    async storeProfile(index, provider, credentials, label) {
+    // A blank label only names new profiles; re-authenticating an existing
+    // account keeps the label the user gave it.
+    async storeProfile(index, provider, credentials, label = '') {
         const fingerprint = fingerprintFor(provider, credentials);
         const existing = index.profiles.find((profile) => profile.provider === provider && profile.fingerprint === fingerprint);
         const now = this.now().toISOString();
         const timing = credentialTiming(provider, credentials);
         const profile = existing ?? {
-            id: randomUUID(), provider, label: sanitizeLabel(label), createdAt: now, updatedAt: now,
+            id: randomUUID(), provider, label: sanitizeLabel(label.trim() || defaultLabel(provider, index.profiles)), createdAt: now, updatedAt: now,
             expiresAt: timing.expiresAt, refreshTokenExpiresAt: timing.refreshTokenExpiresAt, fingerprint
         };
-        profile.label = sanitizeLabel(label || profile.label);
+        if (label.trim())
+            profile.label = sanitizeLabel(label);
         profile.updatedAt = now;
         profile.expiresAt = timing.expiresAt;
         profile.refreshTokenExpiresAt = timing.refreshTokenExpiresAt;
         profile.fingerprint = fingerprint;
         profile.credentialHash = hashCredential(credentials);
+        delete profile.refresh;
+        this.retryAfter.delete(profile.id);
+        this.usageCache.delete(profile.id);
         if (!existing)
             index.profiles.push(profile);
         return profile;
@@ -519,6 +644,9 @@ export class AccountService {
         profile.expiresAt = timing.expiresAt;
         profile.refreshTokenExpiresAt = timing.refreshTokenExpiresAt;
         profile.credentialHash = hashCredential(credentials);
+        delete profile.refresh;
+        this.retryAfter.delete(profile.id);
+        this.usageCache.delete(profile.id);
         return profile;
     }
     async refreshProfile(index, profile) {
@@ -533,46 +661,30 @@ export class AccountService {
         if (!refreshToken)
             throw new AccountServiceError('refresh_token_unavailable');
         if (profile.refreshTokenExpiresAt && Date.parse(profile.refreshTokenExpiresAt) <= this.now().getTime()) {
-            throw new AccountServiceError('account_refresh_failed');
+            throw new ProviderRequestError('refresh_token_expired', 'reauth');
         }
-        const request = refreshRequest(profile.provider, refreshToken);
-        let response;
+        // Idle describes a conversation, not the CLI's background auth work. Until
+        // we can delegate to its native auth owner, never compete with a live CLI.
+        if (active)
+            await this.assertNoRefreshOwner(profile.provider);
+        let refreshResponse;
         try {
-            response = await fetch(profile.provider === 'codex' ? CODEX_TOKEN_URL : CLAUDE_TOKEN_URL, {
-                method: 'POST', headers: request.headers, body: request.body, signal: AbortSignal.timeout(15_000)
-            });
-        }
-        catch {
-            throw new AccountServiceError('account_refresh_unavailable');
+            refreshResponse = await requestTokenRefresh(profile.provider, refreshToken, this.fetcher);
         }
-        if (!response.ok) {
+        catch (error) {
             // A local CLI may have rotated the shared credential while this request
             // was in flight. Prefer that credential instead of treating its old
             // refresh token rejection as a persistent account failure.
             if (active) {
                 const live = await this.readCredentialFile(profile.provider);
                 if (live && hashCredential(live) !== hashCredential(credentials)) {
-                    await this.captureActiveCredentials(index);
+                    await this.captureActiveCredentials(index, profile.provider);
                     throw new AccountServiceError('account_credential_changed');
                 }
             }
-            // A revoked/invalid refresh token cannot recover by polling. Temporary
-            // provider failures must still retry before the access token expires.
-            if (response.status === 429 || response.status >= 500)
-                throw new AccountServiceError('account_refresh_unavailable');
-            throw new AccountServiceError('account_refresh_failed');
-        }
-        let refreshed;
-        try {
-            refreshed = await response.json();
-        }
-        catch {
-            throw new AccountServiceError('account_refresh_failed');
+            throw error;
         }
-        if (!refreshed || typeof refreshed !== 'object')
-            throw new AccountServiceError('account_refresh_failed');
         const refreshedAt = this.now();
-        const refreshResponse = refreshed;
         const next = applyRefresh(profile.provider, credentials, refreshResponse, refreshedAt);
         const timing = refreshTiming(profile.provider, next, refreshResponse, refreshedAt, profile);
         if (active) {
@@ -589,7 +701,7 @@ export class AccountService {
                 // Preserve the credential that the CLI wrote, whether it refreshed the
                 // same account or completed a login for another one. This also updates
                 // expiry metadata before the next background scan.
-                await this.captureActiveCredentials(index);
+                await this.captureActiveCredentials(index, profile.provider);
                 throw new AccountServiceError('account_credential_changed');
             }
             // The live credential is shared by every pane for this OS user. The
@@ -602,6 +714,19 @@ export class AccountService {
         }
         await this.updateProfile(profile, profile.provider, next, timing);
     }
+    async assertNoRefreshOwner(provider) {
+        if (this.runningPanes().some((pane) => pane.provider === provider))
+            throw new AccountServiceError('active_cli_refresh_deferred');
+        let running;
+        try {
+            running = await this.processProbe(provider);
+        }
+        catch {
+            throw new AccountServiceError('account_process_check_unavailable');
+        }
+        if (running)
+            throw new AccountServiceError('active_cli_refresh_deferred');
+    }
     async readIndex() {
         try {
             const text = await readFile(path.join(this.vaultPath, VAULT_INDEX), 'utf8');
@@ -920,9 +1045,15 @@ function sleep(milliseconds) {
     return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 function toPublicProfile(profile) {
-    return { id: profile.id, provider: profile.provider, label: profile.label, createdAt: profile.createdAt, updatedAt: profile.updatedAt, expiresAt: profile.expiresAt, refreshTokenExpiresAt: profile.refreshTokenExpiresAt };
+    return { id: profile.id, provider: profile.provider, label: profile.label, createdAt: profile.createdAt, updatedAt: profile.updatedAt, expiresAt: profile.expiresAt, refreshTokenExpiresAt: profile.refreshTokenExpiresAt, ...(profile.refresh ? { refresh: profile.refresh } : {}) };
 }
 function shouldRefreshProfile(profile, now) {
+    if (profile.refresh?.state === 'reauth_required')
+        return false;
+    if (profile.refresh?.nextRetryAt && Date.parse(profile.refresh.nextRetryAt) > now.getTime())
+        return false;
+    if (profile.refreshTokenExpiresAt && Date.parse(profile.refreshTokenExpiresAt) - now.getTime() <= REFRESH_WINDOW_MS)
+        return true;
     if (profile.expiresAt !== null) {
         const expiresAt = Date.parse(profile.expiresAt);
         return Number.isFinite(expiresAt) && expiresAt - now.getTime() <= REFRESH_WINDOW_MS;
@@ -932,11 +1063,11 @@ function shouldRefreshProfile(profile, now) {
 }
 function refreshRetryAt(profile, now) {
     const minimum = now.getTime() + REFRESH_RETRY_MIN_MS;
-    if (!profile.expiresAt)
-        return now.getTime() + UNKNOWN_EXPIRY_RETRY_MS;
-    const expiresAt = Date.parse(profile.expiresAt);
-    if (!Number.isFinite(expiresAt))
+    const deadlines = [profile.expiresAt, profile.refreshTokenExpiresAt]
+        .flatMap((value) => value && Number.isFinite(Date.parse(value)) ? [Date.parse(value)] : []);
+    if (deadlines.length === 0)
         return now.getTime() + UNKNOWN_EXPIRY_RETRY_MS;
+    const expiresAt = Math.min(...deadlines);
     const latestSafeRetry = expiresAt - REFRESH_RETRY_SAFETY_MS;
     return Math.max(minimum, Math.min(now.getTime() + REFRESH_RETRY_MAX_MS, latestSafeRetry));
 }
@@ -952,9 +1083,9 @@ function refreshTiming(provider, document, response, refreshedAt, previous) {
     const timing = credentialTiming(provider, document);
     if (!timing.expiresAt) {
         const expiresIn = numberValue(response.expires_in);
-        timing.expiresAt = expiresIn ? new Date(refreshedAt.getTime() + expiresIn * 1000).toISOString() : previous.expiresAt;
+        timing.expiresAt = expiresIn ? safeFutureTime(refreshedAt, expiresIn) : null;
     }
-    if (!timing.refreshTokenExpiresAt)
+    if (!timing.refreshTokenExpiresAt && !stringValue(response.refresh_token))
         timing.refreshTokenExpiresAt = previous.refreshTokenExpiresAt;
     return timing;
 }
@@ -963,30 +1094,29 @@ function refreshTokenFor(provider, document) {
     const token = source.refreshToken ?? source.refresh_token;
     return typeof token === 'string' && token ? token : null;
 }
-function refreshRequest(provider, refreshToken) {
-    const values = {
-        grant_type: 'refresh_token',
-        refresh_token: refreshToken,
-        client_id: provider === 'codex' ? CODEX_CLIENT_ID : CLAUDE_CLIENT_ID
-    };
-    if (provider === 'codex') {
-        return { headers: { 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(values) };
-    }
-    return { headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams(values).toString() };
-}
 function applyRefresh(provider, document, response, now) {
     const accessToken = stringValue(response.access_token);
     const refreshToken = stringValue(response.refresh_token);
     if (!accessToken)
-        throw new AccountServiceError('account_refresh_failed');
+        throw new ProviderRequestError('provider_invalid_response', 'transient');
     if (provider === 'claude') {
         const oauth = isRecord(document.claudeAiOauth) ? { ...document.claudeAiOauth } : {};
         oauth.accessToken = accessToken;
-        if (refreshToken)
+        if (refreshToken) {
+            if (refreshToken !== oauth.refreshToken)
+                delete oauth.refreshTokenExpiresAt;
             oauth.refreshToken = refreshToken;
+        }
         const expiresIn = numberValue(response.expires_in);
-        if (expiresIn)
-            oauth.expiresAt = now.getTime() + expiresIn * 1000;
+        const accessExpiry = expiresIn ? safeFutureTime(now, expiresIn) : null;
+        if (accessExpiry)
+            oauth.expiresAt = Date.parse(accessExpiry);
+        else
+            delete oauth.expiresAt;
+        const refreshExpiresIn = numberValue(response.refresh_token_expires_in);
+        const refreshExpiry = refreshExpiresIn ? safeFutureTime(now, refreshExpiresIn) : null;
+        if (refreshExpiry)
+            oauth.refreshTokenExpiresAt = Date.parse(refreshExpiry);
         return { ...document, claudeAiOauth: oauth };
     }
     const tokens = isRecord(document.tokens) ? { ...document.tokens } : {};
@@ -1043,6 +1173,7 @@ function isRecord(value) { return Boolean(value) && typeof value === 'object' &&
 function isVaultProfile(value) { return isRecord(value) && typeof value.id === 'string' && (value.provider === 'codex' || value.provider === 'claude') && typeof value.label === 'string' && typeof value.createdAt === 'string' && typeof value.updatedAt === 'string' && (value.expiresAt === null || typeof value.expiresAt === 'string') && (value.refreshTokenExpiresAt === null || typeof value.refreshTokenExpiresAt === 'string') && typeof value.fingerprint === 'string'; }
 function stringValue(value) { return typeof value === 'string' && value ? value : null; }
 function numberValue(value) { return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null; }
+function safeFutureTime(now, seconds) { const millis = now.getTime() + seconds * 1000; return Number.isFinite(millis) && Math.abs(millis) <= 8.64e15 ? new Date(millis).toISOString() : null; }
 function isoTime(value) { if (typeof value === 'string' && Number.isFinite(Date.parse(value)))
     return new Date(value).toISOString(); if (typeof value === 'number' && Number.isFinite(value))
     return new Date(value).toISOString(); return null; }
@@ -1056,6 +1187,7 @@ catch {
     return null;
 } }
 function isNotFound(error) { return Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT'); }
+function serviceErrorCode(error) { return error instanceof AccountServiceError ? error.code : 'account_storage_unavailable'; }
 async function atomicWrite(target, value, mode) {
     const temp = `${target}.${randomUUID()}.tmp`;
     try {