oc-auth-switcher 0.6.0 → 0.7.1

package/dist/cli.js

@@ -4,6 +4,7 @@
 // src/accounts.ts
 import fs from "fs";
 import path2 from "path";
+import { randomUUID } from "crypto";
 
 // src/constants.ts
 import path from "path";
@@ -14,6 +15,12 @@ var STATE_FILE = path.join(configDir, "auth-switcher-state.json");
 var DEFAULT_THRESHOLD = 0.95;
 var AUTH_FAILURE_COOLDOWN = 10 * 60 * 1000;
 var REJECTION_FALLBACK_SECONDS = 60 * 60;
+var METRIC_MODEL_FAMILY = {
+  session5h: null,
+  weekly7d: null,
+  weekly7dSonnet: "sonnet",
+  weekly7dFable: "fable"
+};
 
 // node_modules/@ex-machina/opencode-anthropic-auth/dist/constants.js
 var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
@@ -63,18 +70,52 @@ function safeReadJSON(filePath, fallback) {
   }
   return fallback;
 }
-function safeWriteJSON(filePath, data) {
+var writeQueues = new Map;
+var MAX_RENAME_ATTEMPTS = 3;
+var RENAME_RETRY_CODES = new Set(["ENOENT", "EEXIST", "EPERM"]);
+function errorCode(error) {
+  return error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+}
+async function writeJSON(filePath, data, options) {
   ensureDir(filePath);
   const content = JSON.stringify(data, null, 2);
-  const tmpPath = filePath + ".tmp";
   const bakPath = filePath + ".bak";
+  const rename = options.rename ?? fs.promises.rename;
+  const retryDelayMs = options.retryDelayMs ?? 5;
   if (fs.existsSync(filePath)) {
     try {
-      fs.copyFileSync(filePath, bakPath);
+      await fs.promises.copyFile(filePath, bakPath);
     } catch {}
   }
-  fs.writeFileSync(tmpPath, content, { mode: 384 });
-  fs.renameSync(tmpPath, filePath);
+  let lastError;
+  for (let attempt = 1;attempt <= MAX_RENAME_ATTEMPTS; attempt++) {
+    const tmpPath = `${filePath}.${process.pid}-${randomUUID()}.tmp`;
+    try {
+      await fs.promises.writeFile(tmpPath, content, { mode: 384 });
+      await rename(tmpPath, filePath);
+      return;
+    } catch (error) {
+      lastError = error;
+      await fs.promises.rm(tmpPath, { force: true }).catch(() => {});
+      if (!RENAME_RETRY_CODES.has(errorCode(error) ?? "") || attempt === MAX_RENAME_ATTEMPTS) {
+        break;
+      }
+      await new Promise((resolve) => setTimeout(resolve, retryDelayMs * attempt));
+    }
+  }
+  throw lastError;
+}
+function safeWriteJSON(filePath, data, options = {}) {
+  const previous = writeQueues.get(filePath) ?? Promise.resolve();
+  const current = previous.catch(() => {}).then(() => writeJSON(filePath, data, options)).catch((error) => {
+    console.warn(`[oc-auth-switcher] Could not safely write ${path2.basename(filePath)}:`, error instanceof Error ? error.message : String(error));
+  });
+  writeQueues.set(filePath, current);
+  current.finally(() => {
+    if (writeQueues.get(filePath) === current)
+      writeQueues.delete(filePath);
+  });
+  return current;
 }
 function loadAccounts() {
   const raw = safeReadJSON(ACCOUNTS_FILE, {
@@ -84,9 +125,9 @@ function loadAccounts() {
   return { accounts };
 }
 function saveAccounts(data) {
-  safeWriteJSON(ACCOUNTS_FILE, data);
+  return safeWriteJSON(ACCOUNTS_FILE, data);
 }
-function addAccount(account) {
+async function addAccount(account) {
   const data = loadAccounts();
   const idx = data.accounts.findIndex((a) => a.name === account.name);
   if (idx >= 0) {
@@ -94,23 +135,23 @@ function addAccount(account) {
   } else {
     data.accounts.push(account);
   }
-  saveAccounts(data);
+  await saveAccounts(data);
   return data;
 }
-function removeAccount(name) {
+async function removeAccount(name) {
   const data = loadAccounts();
   data.accounts = data.accounts.filter((a) => a.name !== name);
-  saveAccounts(data);
+  await saveAccounts(data);
   return data;
 }
-function updateAccountTokens(name, access, refresh, expires) {
+async function updateAccountTokens(name, access, refresh, expires) {
   const data = loadAccounts();
   const account = data.accounts.find((a) => a.name === name);
   if (account) {
     account.access = access;
     account.refresh = refresh;
     account.expires = expires;
-    saveAccounts(data);
+    await saveAccounts(data);
   }
 }
 async function refreshAccountToken(refreshTokenValue) {
@@ -201,7 +242,7 @@ function loadState() {
   return normalizeState(safeReadJSON(STATE_FILE, {}));
 }
 function saveState(state) {
-  safeWriteJSON(STATE_FILE, state);
+  return safeWriteJSON(STATE_FILE, state);
 }
 function getThresholds(config) {
   if (typeof config.threshold === "number") {
@@ -257,10 +298,252 @@ function ensureAccountsInState(state, accountNames) {
 }
 
 // src/rotation.ts
+function isTemporarilyUnavailable(state, accountName) {
+  const cooldownUntil = state.authFailures[accountName];
+  if (!cooldownUntil)
+    return false;
+  if (Date.now() > cooldownUntil) {
+    delete state.authFailures[accountName];
+    return false;
+  }
+  return true;
+}
+function isOverThreshold(usage, state, modelFamily) {
+  if (!usage)
+    return false;
+  const thresholds = getThresholds(state.config);
+  if (usage.rejected.status?.toLowerCase() === "rejected" && isRejectionRelevant(usage.rejected.prefix, modelFamily))
+    return true;
+  return metricEntries(usage, thresholds, modelFamily).some((metric) => metric.threshold > 0 && metric.util >= metric.threshold);
+}
+function getUtilizationScore(usage, state, modelFamily) {
+  if (!usage)
+    return 0;
+  const thresholds = getThresholds(state.config);
+  if (usage.rejected.status?.toLowerCase() === "rejected" && isRejectionRelevant(usage.rejected.prefix, modelFamily))
+    return Infinity;
+  const scores = metricEntries(usage, thresholds, modelFamily).filter((metric) => metric.threshold > 0).map((metric) => metric.util / metric.threshold);
+  return scores.length > 0 ? Math.max(...scores) : 0;
+}
+function getModelFamily(model) {
+  if (!model)
+    return;
+  const normalized = model.toLowerCase();
+  return ["fable", "sonnet", "opus"].find((family) => normalized.includes(family));
+}
+function isMetricRelevant(metric, modelFamily) {
+  const metricFamily = METRIC_MODEL_FAMILY[metric];
+  return modelFamily === undefined || metricFamily === null || metricFamily === modelFamily;
+}
+function rejectionFamily(prefix) {
+  if (!prefix)
+    return;
+  const normalized = prefix.toLowerCase();
+  return ["fable", "sonnet", "opus"].find((family) => normalized === `7d_${family}` || normalized === `anthropic-ratelimit-unified-7d_${family}`);
+}
+function isRejectionRelevant(prefix, modelFamily) {
+  const rejectedFamily = rejectionFamily(prefix);
+  return modelFamily === undefined || rejectedFamily === undefined || rejectedFamily === modelFamily;
+}
+function metricEntries(usage, thresholds, modelFamily) {
+  return Object.keys(METRIC_MODEL_FAMILY).filter((key) => isMetricRelevant(key, modelFamily)).map((key) => ({
+    name: key,
+    util: usage[key].utilization,
+    threshold: thresholds[key]
+  }));
+}
+function purgeExpiredCooldowns(state) {
+  const now = Date.now();
+  for (const name of Object.keys(state.authFailures)) {
+    if (state.authFailures[name] <= now) {
+      delete state.authFailures[name];
+    }
+  }
+}
+function findBestAvailable(candidates, state, exclude, modelFamily) {
+  let best = null;
+  let bestScore = Infinity;
+  for (const acct of candidates) {
+    if (exclude.has(acct.name))
+      continue;
+    if (isTemporarilyUnavailable(state, acct.name))
+      continue;
+    if (!isOverThreshold(state.usage[acct.name], state, modelFamily)) {
+      const score = getUtilizationScore(state.usage[acct.name], state, modelFamily);
+      if (!best || score < bestScore) {
+        bestScore = score;
+        best = acct;
+      }
+    }
+  }
+  if (best)
+    return best;
+  best = null;
+  bestScore = Infinity;
+  for (const acct of candidates) {
+    if (exclude.has(acct.name))
+      continue;
+    if (isTemporarilyUnavailable(state, acct.name))
+      continue;
+    const score = getUtilizationScore(state.usage[acct.name], state, modelFamily);
+    if (!best || score < bestScore) {
+      bestScore = score;
+      best = acct;
+    }
+  }
+  return best;
+}
+function selectAccount(accounts, state, model) {
+  if (accounts.length === 0) {
+    throw new Error("No accounts available");
+  }
+  purgeExpiredCooldowns(state);
+  const modelFamily = getModelFamily(model);
+  const currentIdx = accounts.findIndex((a) => a.name === state.currentAccount);
+  if (currentIdx < 0) {
+    const best = findBestAvailable(accounts, state, new Set, modelFamily);
+    const selected = best ?? accounts[0];
+    return {
+      account: selected,
+      switched: true,
+      reason: `Selecting account ${selected.name}`
+    };
+  }
+  const current = accounts[currentIdx];
+  const currentUsage = state.usage[current.name];
+  const currentOverThreshold = isOverThreshold(currentUsage, state, modelFamily);
+  const currentInCooldown = isTemporarilyUnavailable(state, current.name);
+  if (currentOverThreshold || currentInCooldown) {
+    const reason = currentInCooldown ? `${current.name} in auth-failure cooldown` : `${current.name} exceeded threshold`;
+    const best = findBestAvailable(accounts, state, new Set([current.name]), modelFamily);
+    if (best && best.name !== current.name) {
+      return {
+        account: best,
+        switched: true,
+        reason: `${reason} \u2014 switching to ${best.name}`
+      };
+    }
+    return { account: current, switched: false };
+  }
+  return { account: current, switched: false };
+}
 function clearAuthFailure(state, accountName) {
   delete state.authFailures[accountName];
 }
 
+// src/status.ts
+var MODEL_FAMILIES = ["opus", "sonnet", "fable"];
+function percentage(value) {
+  return `${(value * 100).toFixed(0)}%`;
+}
+function formatRelativeDuration(targetMs, nowMs = Date.now()) {
+  const difference = targetMs - nowMs;
+  const absoluteSeconds = Math.abs(difference) / 1000;
+  if (absoluteSeconds < 30)
+    return "now";
+  const units = [
+    ["d", 86400],
+    ["h", 3600],
+    ["m", 60]
+  ];
+  const parts = [];
+  let remaining = absoluteSeconds;
+  for (const [suffix, seconds] of units) {
+    const amount = Math.floor(remaining / seconds);
+    if (amount > 0) {
+      parts.push(`${amount}${suffix}`);
+      remaining -= amount * seconds;
+    }
+    if (parts.length === 2)
+      break;
+  }
+  if (parts.length === 0)
+    parts.push(`${Math.max(1, Math.round(remaining))}s`);
+  return difference >= 0 ? `in ${parts.join(" ")}` : `${parts.join(" ")} ago`;
+}
+function displayRejectionPrefix(prefix) {
+  return prefix?.replace(/^anthropic-ratelimit-unified-/i, "");
+}
+function rejectionFamily2(prefix) {
+  if (!prefix)
+    return;
+  const normalized = prefix.toLowerCase();
+  return MODEL_FAMILIES.find((family) => normalized === `7d_${family}` || normalized === `anthropic-ratelimit-unified-7d_${family}`);
+}
+function tokenExpiryDescription(account, nowMs) {
+  if (account.expires > nowMs) {
+    return `expires ${formatRelativeDuration(account.expires, nowMs)}`;
+  }
+  if (account.refresh) {
+    return account.expires > 0 ? `expired ${formatRelativeDuration(account.expires, nowMs)}; refresh available` : "expired; refresh available";
+  }
+  return account.expires > 0 ? `expired/unrefreshable (${formatRelativeDuration(account.expires, nowMs)})` : "expired/unrefreshable";
+}
+function deriveAccountHealth(account, usage, thresholds, cooldownUntil, nowMs = Date.now()) {
+  const availability = Object.fromEntries(MODEL_FAMILIES.map((family) => [family, true]));
+  const reasons = [];
+  const metrics = usage ? Object.keys(METRIC_MODEL_FAMILY).filter((metric) => thresholds[metric] > 0).map((metric) => ({
+    metric,
+    utilization: usage[metric].utilization,
+    threshold: thresholds[metric],
+    family: METRIC_MODEL_FAMILY[metric]
+  })) : [];
+  for (const metric of metrics) {
+    if (metric.utilization < metric.threshold)
+      continue;
+    const families = metric.family ? [metric.family] : [...MODEL_FAMILIES];
+    for (const family of families)
+      availability[family] = false;
+    reasons.push({
+      kind: "metric",
+      message: `${metric.metric} ${percentage(metric.utilization)} >= ${percentage(metric.threshold)}${metric.family ? ` \u2014 ${metric.family} only` : ""}`,
+      families,
+      reset: usage?.[metric.metric].reset
+    });
+  }
+  if (usage?.rejected.status?.toLowerCase() === "rejected") {
+    const family = rejectionFamily2(usage.rejected.prefix);
+    const families = family ? [family] : [...MODEL_FAMILIES];
+    for (const blockedFamily of families)
+      availability[blockedFamily] = false;
+    const prefix = displayRejectionPrefix(usage.rejected.prefix);
+    reasons.push({
+      kind: "rejection",
+      message: `rejected${prefix ? ` (${prefix})` : ""}${family ? ` \u2014 ${family} only` : ""}`,
+      families,
+      reset: usage.rejected.reset
+    });
+  }
+  if (cooldownUntil && cooldownUntil > nowMs) {
+    for (const family of MODEL_FAMILIES)
+      availability[family] = false;
+    reasons.push({
+      kind: "cooldown",
+      message: `auth-failure cooldown \u2014 ${formatRelativeDuration(cooldownUntil, nowMs)}`,
+      families: [...MODEL_FAMILIES]
+    });
+  }
+  const hasUsableToken = !!account.access && account.expires > nowMs || !!account.refresh;
+  if (!hasUsableToken) {
+    for (const family of MODEL_FAMILIES)
+      availability[family] = false;
+    reasons.push({
+      kind: "token",
+      message: "expired/unrefreshable token",
+      families: [...MODEL_FAMILIES]
+    });
+  }
+  const highestUtilization = metrics.sort((a, b) => b.utilization / b.threshold - a.utilization / a.threshold)[0] ?? null;
+  const futureResets = reasons.map((reason) => reason.reset).filter((reset) => !!reset && reset * 1000 > nowMs);
+  return {
+    availability,
+    highestUtilization,
+    reasons,
+    earliestReset: futureResets.length > 0 ? Math.min(...futureResets) : undefined,
+    tokenExpiry: tokenExpiryDescription(account, nowMs)
+  };
+}
+
 // node_modules/@ex-machina/opencode-anthropic-auth/dist/pkce.js
 function base64UrlEncode(bytes) {
   let bin = "";
@@ -372,14 +655,15 @@ async function exchange(input, verifier, redirectUri, expectedState) {
 
 // src/cli.ts
 import { spawn } from "child_process";
-var RESET = "\x1B[0m";
-var BOLD = "\x1B[1m";
-var DIM = "\x1B[2m";
-var RED = "\x1B[31m";
-var GREEN = "\x1B[32m";
-var YELLOW = "\x1B[33m";
-var BLUE = "\x1B[34m";
-var CYAN = "\x1B[36m";
+var COLOR = !!process.stdout.isTTY;
+var RESET = COLOR ? "\x1B[0m" : "";
+var BOLD = COLOR ? "\x1B[1m" : "";
+var DIM = COLOR ? "\x1B[2m" : "";
+var RED = COLOR ? "\x1B[31m" : "";
+var GREEN = COLOR ? "\x1B[32m" : "";
+var YELLOW = COLOR ? "\x1B[33m" : "";
+var BLUE = COLOR ? "\x1B[34m" : "";
+var CYAN = COLOR ? "\x1B[36m" : "";
 function progressBar(value, threshold, width = 30) {
   const pct = Math.min(value, 1);
   const filled = Math.round(pct * width);
@@ -471,7 +755,7 @@ ${BOLD}Starting OAuth flow for account: ${CYAN}${name}${RESET}
 ${RED}Authentication failed${RESET}`);
     process.exit(1);
   }
-  addAccount({
+  await addAccount({
     name,
     access: exchangeResult.access,
     refresh: exchangeResult.refresh,
@@ -484,7 +768,7 @@ ${GREEN}Account "${name}" added successfully.${RESET}`);
   if (data.accounts.length === 1) {
     const state = loadState();
     state.currentAccount = name;
-    saveState(state);
+    await saveState(state);
     console.log(`
 ${YELLOW}This is the only account \u2014 set as active.${RESET}`);
   }
@@ -533,10 +817,10 @@ ${RED}Re-authentication failed${RESET}`);
   account.access = exchangeResult.access;
   account.refresh = exchangeResult.refresh;
   account.expires = exchangeResult.expires;
-  saveAccounts(data);
+  await saveAccounts(data);
   const state = loadState();
   clearAuthFailure(state, name);
-  saveState(state);
+  await saveState(state);
   console.log(`
 ${GREEN}Account "${name}" re-authenticated successfully.${RESET}`);
 }
@@ -549,7 +833,7 @@ async function refreshExpiredAccounts(data, state) {
       account.access = result.access;
       account.refresh = result.refresh;
       account.expires = result.expires;
-      updateAccountTokens(account.name, result.access, result.refresh, result.expires);
+      await updateAccountTokens(account.name, result.access, result.refresh, result.expires);
       clearAuthFailure(state, account.name);
     }
   }
@@ -560,7 +844,7 @@ async function cmdUsage(args) {
     const data = loadAccounts();
     const state = loadState();
     await refreshExpiredAccounts(data, state);
-    saveState(state);
+    await saveState(state);
     resolveStaleMetrics(state);
     ensureAccountsInState(state, data.accounts.map((a) => a.name));
     const thresholds = getThresholds(state.config);
@@ -622,7 +906,7 @@ ${BOLD}${CYAN}=== Auth Switcher Usage Dashboard ===${RESET}
     new Promise(() => {});
   }
 }
-function cmdConfig(args) {
+async function cmdConfig(args) {
   const state = loadState();
   if (args.length === 0) {
     const thresholds = getThresholds(state.config);
@@ -672,9 +956,9 @@ ${BOLD}${CYAN}=== Auth Switcher Configuration ===${RESET}
       console.log(`${GREEN}Reset to default threshold: ${(DEFAULT_THRESHOLD * 100).toFixed(0)}%${RESET}`);
     }
   }
-  saveState(state);
+  await saveState(state);
 }
-function cmdSwitch(args) {
+async function cmdSwitch(args) {
   const data = loadAccounts();
   if (data.accounts.length === 0) {
     console.error(`${RED}No accounts configured.${RESET}`);
@@ -701,26 +985,93 @@ ${RED}Usage: oc-auth-switcher switch <account-name>${RESET}`);
   console.log(`${CYAN}Switching to account: ${name}...${RESET}`);
   const state = loadState();
   state.currentAccount = name;
-  saveState(state);
+  await saveState(state);
   console.log(`${GREEN}Switched to "${name}". Will take effect on the next API request.${RESET}`);
 }
+function healthLabel(health) {
+  const usable = MODEL_FAMILIES.filter((family) => health.availability[family]);
+  const unavailable = MODEL_FAMILIES.filter((family) => !health.availability[family]);
+  if (unavailable.length === 0)
+    return `${GREEN}healthy \u2014 all models usable${RESET}`;
+  if (usable.length === 0)
+    return `${RED}unavailable \u2014 all models${RESET}`;
+  return `${YELLOW}partial \u2014 usable: ${usable.join(", ")}; unavailable: ${unavailable.join(", ")}${RESET}`;
+}
+function utilizationLabel(health) {
+  const peak = health.highestUtilization;
+  if (!peak)
+    return `${DIM}no usage data${RESET}`;
+  const utilization = `${(peak.utilization * 100).toFixed(0)}%`;
+  const threshold = `${(peak.threshold * 100).toFixed(0)}%`;
+  const family = peak.family ? ` \u2014 ${peak.family} only` : "";
+  if (peak.utilization >= peak.threshold) {
+    return `${RED}${peak.metric} ${utilization} >= ${threshold}${family}${RESET}`;
+  }
+  const color = peak.utilization >= peak.threshold * 0.8 ? YELLOW : GREEN;
+  return `${color}${peak.metric} ${utilization} / ${threshold} threshold${family}${RESET}`;
+}
+function nextAccountSummary(accounts, state, activeName) {
+  if (accounts.length === 0 || activeName && accounts.length === 1) {
+    return "(none \u2014 no alternate account)";
+  }
+  const selections = MODEL_FAMILIES.map((family) => {
+    const candidateState = structuredClone(state);
+    candidateState.currentAccount = activeName;
+    if (activeName)
+      candidateState.authFailures[activeName] = Date.now() + 60000;
+    const selected = selectAccount(accounts, candidateState, `claude-${family}`);
+    return [
+      family,
+      selected.account.name === activeName ? null : selected.account.name
+    ];
+  });
+  const names = new Set(selections.map(([_, name]) => name));
+  if (names.size === 1) {
+    return selections[0][1] ? `${selections[0][1]} (all models)` : "(none \u2014 no usable alternate account)";
+  }
+  return selections.map(([family, name]) => `${family}: ${name ?? "none"}`).join(", ");
+}
 function cmdStatus() {
   const data = loadAccounts();
   const state = loadState();
   resolveStaleMetrics(state);
+  const thresholds = getThresholds(state.config);
+  const now = Date.now();
+  const configuredActive = data.accounts.find((account) => account.name === state.currentAccount);
+  const healthByAccount = new Map(data.accounts.map((account) => [
+    account.name,
+    deriveAccountHealth(account, state.usage[account.name], thresholds, state.authFailures[account.name], now)
+  ]));
   console.log(`
 ${BOLD}${CYAN}=== Auth Switcher Status ===${RESET}
 `);
-  console.log(`  Active account:    ${BOLD}${state.currentAccount || "(none)"}${RESET}`);
-  console.log(`  Total accounts:    ${data.accounts.length}`);
-  console.log(`  Request count:     ${state.requestCount}`);
+  if (configuredActive) {
+    console.log(`  Active account: ${BOLD}${configuredActive.name}${RESET} \u2014 ${healthLabel(healthByAccount.get(configuredActive.name))}`);
+  } else {
+    console.log(`  Active account: ${BOLD}(none)${RESET}`);
+  }
+  console.log(`  Next if unavailable: ${BOLD}${nextAccountSummary(data.accounts, state, configuredActive?.name ?? null)}${RESET}`);
+  console.log(`  Accounts: ${data.accounts.length}  Requests: ${state.requestCount}`);
   console.log();
-  const failures = Object.entries(state.authFailures).filter(([_, until]) => until > Date.now());
-  if (failures.length > 0) {
-    console.log(`  ${RED}Auth cooldowns:${RESET}`);
-    for (const [name, until] of failures) {
-      const remaining = Math.ceil((until - Date.now()) / 60000);
-      console.log(`    - ${name}: ${remaining} min remaining`);
+  if (data.accounts.length === 0) {
+    console.log(`  ${DIM}No accounts configured. Run 'oc-auth-switcher add' to add one.${RESET}`);
+    console.log();
+  } else {
+    console.log(`  ${BOLD}Account health${RESET}`);
+    for (const account of data.accounts) {
+      const health = healthByAccount.get(account.name);
+      const active = account.name === configuredActive?.name ? ` ${GREEN}[ACTIVE]${RESET}` : "";
+      console.log(`  ${BOLD}${account.name}${RESET}${active} \u2014 ${healthLabel(health)}`);
+      console.log(`    Peak:  ${utilizationLabel(health)}`);
+      for (const reason of health.reasons) {
+        console.log(`    ${RED}Reason: ${reason.message}${RESET}`);
+      }
+      if (health.earliestReset) {
+        const resetMs = health.earliestReset * 1000;
+        console.log(`    Reset: ${new Date(resetMs).toLocaleString()} (${formatRelativeDuration(resetMs, now)})`);
+      }
+      const tokenColor = health.reasons.some((reason) => reason.kind === "token") ? RED : DIM;
+      console.log(`    ${tokenColor}Token: ${health.tokenExpiry}${RESET}`);
     }
     console.log();
   }
@@ -728,7 +1079,7 @@ ${BOLD}${CYAN}=== Auth Switcher Status ===${RESET}
   console.log(`  ${DIM}State file:    ${STATE_FILE}${RESET}`);
   console.log();
 }
-function cmdRemove(args) {
+async function cmdRemove(args) {
   const name = args[0];
   if (!name) {
     console.error(`${RED}Usage: oc-auth-switcher remove <account-name>${RESET}`);
@@ -740,12 +1091,12 @@ function cmdRemove(args) {
     console.error(`${RED}Account "${name}" not found${RESET}`);
     process.exit(1);
   }
-  removeAccount(name);
+  await removeAccount(name);
   console.log(`${GREEN}Account "${name}" removed.${RESET}`);
   const state = loadState();
   if (state.currentAccount === name) {
     state.currentAccount = null;
-    saveState(state);
+    await saveState(state);
     console.log(`${YELLOW}This was the active account. Rotation will pick a new one automatically.${RESET}`);
   }
 }
@@ -796,18 +1147,18 @@ async function main() {
       break;
     case "config":
     case "c":
-      cmdConfig(commandArgs);
+      await cmdConfig(commandArgs);
       break;
     case "switch":
     case "s":
-      cmdSwitch(commandArgs);
+      await cmdSwitch(commandArgs);
       break;
     case "status":
       cmdStatus();
       break;
     case "remove":
     case "rm":
-      cmdRemove(commandArgs);
+      await cmdRemove(commandArgs);
       break;
     case "help":
     case "--help":

package/dist/index.js

@@ -406,6 +406,7 @@ async function exchange(input, verifier, redirectUri, expectedState) {
 // src/accounts.ts
 import fs from "node:fs";
 import path2 from "node:path";
+import { randomUUID } from "node:crypto";
 
 // src/constants.ts
 import path from "node:path";
@@ -454,18 +455,52 @@ function safeReadJSON(filePath, fallback) {
   }
   return fallback;
 }
-function safeWriteJSON(filePath, data) {
+var writeQueues = new Map;
+var MAX_RENAME_ATTEMPTS = 3;
+var RENAME_RETRY_CODES = new Set(["ENOENT", "EEXIST", "EPERM"]);
+function errorCode(error) {
+  return error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+}
+async function writeJSON(filePath, data, options) {
   ensureDir(filePath);
   const content = JSON.stringify(data, null, 2);
-  const tmpPath = filePath + ".tmp";
   const bakPath = filePath + ".bak";
+  const rename = options.rename ?? fs.promises.rename;
+  const retryDelayMs = options.retryDelayMs ?? 5;
   if (fs.existsSync(filePath)) {
     try {
-      fs.copyFileSync(filePath, bakPath);
+      await fs.promises.copyFile(filePath, bakPath);
     } catch {}
   }
-  fs.writeFileSync(tmpPath, content, { mode: 384 });
-  fs.renameSync(tmpPath, filePath);
+  let lastError;
+  for (let attempt = 1;attempt <= MAX_RENAME_ATTEMPTS; attempt++) {
+    const tmpPath = `${filePath}.${process.pid}-${randomUUID()}.tmp`;
+    try {
+      await fs.promises.writeFile(tmpPath, content, { mode: 384 });
+      await rename(tmpPath, filePath);
+      return;
+    } catch (error) {
+      lastError = error;
+      await fs.promises.rm(tmpPath, { force: true }).catch(() => {});
+      if (!RENAME_RETRY_CODES.has(errorCode(error) ?? "") || attempt === MAX_RENAME_ATTEMPTS) {
+        break;
+      }
+      await new Promise((resolve) => setTimeout(resolve, retryDelayMs * attempt));
+    }
+  }
+  throw lastError;
+}
+function safeWriteJSON(filePath, data, options = {}) {
+  const previous = writeQueues.get(filePath) ?? Promise.resolve();
+  const current = previous.catch(() => {}).then(() => writeJSON(filePath, data, options)).catch((error) => {
+    console.warn(`[oc-auth-switcher] Could not safely write ${path2.basename(filePath)}:`, error instanceof Error ? error.message : String(error));
+  });
+  writeQueues.set(filePath, current);
+  current.finally(() => {
+    if (writeQueues.get(filePath) === current)
+      writeQueues.delete(filePath);
+  });
+  return current;
 }
 function loadAccounts() {
   const raw = safeReadJSON(ACCOUNTS_FILE, {
@@ -475,16 +510,16 @@ function loadAccounts() {
   return { accounts };
 }
 function saveAccounts(data) {
-  safeWriteJSON(ACCOUNTS_FILE, data);
+  return safeWriteJSON(ACCOUNTS_FILE, data);
 }
-function updateAccountTokens(name, access, refresh, expires) {
+async function updateAccountTokens(name, access, refresh, expires) {
   const data = loadAccounts();
   const account = data.accounts.find((a) => a.name === name);
   if (account) {
     account.access = access;
     account.refresh = refresh;
     account.expires = expires;
-    saveAccounts(data);
+    await saveAccounts(data);
   }
 }
 async function refreshAccountToken(refreshTokenValue) {
@@ -575,7 +610,7 @@ function loadState() {
   return normalizeState(safeReadJSON(STATE_FILE, {}));
 }
 function saveState(state) {
-  safeWriteJSON(STATE_FILE, state);
+  return safeWriteJSON(STATE_FILE, state);
 }
 function getThresholds(config) {
   if (typeof config.threshold === "number") {
@@ -865,13 +900,13 @@ function selectionSnapshot(state) {
     currentAccount: state.currentAccount
   };
 }
-function saveRequestState(state, initiallyLoaded) {
+async function saveRequestState(state, initiallyLoaded) {
   const onDisk = loadState();
   const selectionChangedSinceLoad = onDisk.currentAccount !== initiallyLoaded.currentAccount;
   if (selectionChangedSinceLoad) {
     state.currentAccount = onDisk.currentAccount;
   }
-  saveState(state);
+  await saveState(state);
 }
 function getRequestModel(body) {
   if (typeof body !== "string")
@@ -973,13 +1008,13 @@ var AuthSwitcherPlugin = async ({ client }) => {
                   account.access = result.access;
                   account.refresh = result.refresh;
                   account.expires = result.expires;
-                  updateAccountTokens(account.name, result.access, result.refresh, result.expires);
+                  await updateAccountTokens(account.name, result.access, result.refresh, result.expires);
                 } else {
                   markAuthFailure(state, account.name);
                   const available = accounts.filter((candidate) => !attemptedAccounts.has(candidate.name) && (!state.authFailures[candidate.name] || state.authFailures[candidate.name] <= Date.now()));
                   const next = available.length > 0 ? selectAccount(available, state, model).account : undefined;
                   if (!next) {
-                    saveRequestState(state, initiallyLoadedSelection);
+                    await saveRequestState(state, initiallyLoadedSelection);
                     throw new Error(`[oc-auth-switcher] All accounts failed token refresh`);
                   }
                   account = next;
@@ -1021,7 +1056,7 @@ var AuthSwitcherPlugin = async ({ client }) => {
                       next.access = result.access;
                       next.refresh = result.refresh;
                       next.expires = result.expires;
-                      updateAccountTokens(next.name, result.access, result.refresh, result.expires);
+                      await updateAccountTokens(next.name, result.access, result.refresh, result.expires);
                     }
                   }
                   const retryHeaders = mergeHeaders(input, init);
@@ -1036,7 +1071,7 @@ var AuthSwitcherPlugin = async ({ client }) => {
                   });
                   updateUsageFromHeaders(state, next.name, retryResponse.headers);
                   clearAuthFailure(state, next.name);
-                  saveRequestState(state, initiallyLoadedSelection);
+                  await saveRequestState(state, initiallyLoadedSelection);
                   return createStrippedStream(retryResponse);
                 }
               }
@@ -1044,7 +1079,7 @@ var AuthSwitcherPlugin = async ({ client }) => {
             updateUsageFromHeaders(state, account.name, response.headers);
             clearAuthFailure(state, account.name);
             state.requestCount = (state.requestCount || 0) + 1;
-            saveRequestState(state, initiallyLoadedSelection);
+            await saveRequestState(state, initiallyLoadedSelection);
             return createStrippedStream(response);
           }
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oc-auth-switcher",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "OpenCode auth plugin for multi-account Anthropic Claude Max rotation with automatic failover.",
   "type": "module",
   "main": "dist/index.js",