oc-auth-switcher 0.7.2 → 0.9.0

package/README.md

@@ -47,7 +47,7 @@ oc-auth-switcher <command> [options]
 |---------|-------------|
 | `add [name]` | Add a new account via OAuth |
 | `reauth <name>` | Re-authenticate an existing account |
-| `usage [--watch]` | Show utilization dashboard with progress bars |
+| `usage [--watch]` | Show utilization dashboard with progress bars and reset countdowns |
 | `config [options]` | View/modify thresholds |
 | `switch <name>` | Set the active account |
 | `status` | Show current active account and rotation state |

package/dist/cli.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env bun
 // @bun
 
+// src/cli.ts
+import { createHash } from "crypto";
+
 // src/accounts.ts
 import fs from "fs";
 import path2 from "path";
@@ -48,6 +51,11 @@ var OAUTH_SCOPES = [
 ];
 
 // src/accounts.ts
+function isAccessTokenFresh(account, nowMs = Date.now()) {
+  if (account.expires == null || Number.isNaN(account.expires))
+    return true;
+  return !!account.access && account.expires > nowMs;
+}
 function normalizeAccount(raw) {
   const name = raw.name || "unnamed";
   const access = raw.access || raw.accessToken || "";
@@ -255,6 +263,20 @@ function loadState(stateFile = STATE_FILE) {
 function saveState(state) {
   return safeWriteJSON(STATE_FILE, state);
 }
+async function saveStateMerged(state, accountsToMerge) {
+  const onDisk = loadState();
+  for (const name of accountsToMerge) {
+    if (state.usage[name]) {
+      onDisk.usage[name] = state.usage[name];
+    }
+    if (state.authFailures[name] !== undefined) {
+      onDisk.authFailures[name] = state.authFailures[name];
+    } else {
+      delete onDisk.authFailures[name];
+    }
+  }
+  await safeWriteJSON(STATE_FILE, onDisk);
+}
 function getThresholds(config) {
   if (typeof config.threshold === "number") {
     return {
@@ -307,6 +329,99 @@ function ensureAccountsInState(state, accountNames) {
     }
   }
 }
+function updateUsageFromHeaders(state, accountName, headers) {
+  if (!state.usage[accountName]) {
+    state.usage[accountName] = {
+      session5h: { ...EMPTY_METRIC },
+      weekly7d: { ...EMPTY_METRIC },
+      weekly7dSonnet: { ...EMPTY_METRIC },
+      weekly7dFable: { ...EMPTY_METRIC },
+      rejected: { ...EMPTY_METRIC }
+    };
+  }
+  const usage = state.usage[accountName];
+  let updated = false;
+  const metricFamilies = [
+    {
+      key: "session5h",
+      prefix: "anthropic-ratelimit-unified-5h"
+    },
+    {
+      key: "weekly7d",
+      prefix: "anthropic-ratelimit-unified-7d"
+    },
+    {
+      key: "weekly7dSonnet",
+      prefix: "anthropic-ratelimit-unified-7d_sonnet"
+    },
+    {
+      key: "weekly7dFable",
+      prefix: "anthropic-ratelimit-unified-7d_fable"
+    }
+  ];
+  for (const { key, prefix } of metricFamilies) {
+    const utilHeader = headers.get(`${prefix}-utilization`);
+    const resetHeader = headers.get(`${prefix}-reset`);
+    const statusHeader = headers.get(`${prefix}-status`);
+    if (utilHeader !== null || resetHeader !== null || statusHeader !== null) {
+      if (utilHeader !== null) {
+        const val = parseFloat(utilHeader);
+        if (!isNaN(val)) {
+          usage[key].utilization = val;
+          updated = true;
+        }
+      }
+      if (resetHeader !== null) {
+        const val = Number(resetHeader);
+        if (!isNaN(val)) {
+          usage[key].reset = val;
+          updated = true;
+        } else {
+          const parsed = Date.parse(resetHeader);
+          if (!isNaN(parsed)) {
+            usage[key].reset = parsed / 1000;
+            updated = true;
+          }
+        }
+      }
+      if (statusHeader !== null) {
+        usage[key].status = statusHeader;
+        updated = true;
+      }
+    }
+  }
+  for (const [headerName, headerValue] of headers.entries()) {
+    const normalizedName = headerName.toLowerCase();
+    const statusMatch = normalizedName.match(/^anthropic-ratelimit-unified-(.+)-status$/);
+    if (!statusMatch || !quotaWindowScope(statusMatch[1]) || headerValue.toLowerCase() !== "rejected") {
+      continue;
+    }
+    const prefix = normalizedName.slice(0, -"-status".length);
+    const resetHeader = headers.get(`${prefix}-reset`) ?? headers.get("anthropic-ratelimit-unified-reset");
+    let reset = resetHeader ? Number(resetHeader) : NaN;
+    if (isNaN(reset) && resetHeader) {
+      const parsed = Date.parse(resetHeader);
+      if (!isNaN(parsed))
+        reset = parsed / 1000;
+    }
+    if (!Number.isFinite(reset) || reset <= 0) {
+      const retryAfterHeader = headers.get("retry-after");
+      const retryAfter = retryAfterHeader === null ? NaN : Number(retryAfterHeader);
+      reset = Date.now() / 1000 + (Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : REJECTION_FALLBACK_SECONDS);
+    }
+    usage.rejected = {
+      utilization: 1,
+      reset: Math.max(usage.rejected.reset, reset),
+      status: "rejected",
+      prefix
+    };
+    updated = true;
+  }
+  if (updated) {
+    usage.timestamp = new Date().toISOString();
+  }
+  return updated;
+}
 
 // src/rotation.ts
 function isTemporarilyUnavailable(state, accountName) {
@@ -371,7 +486,7 @@ function purgeExpiredCooldowns(state) {
     }
   }
 }
-function findBestAvailable(candidates, state, exclude, modelFamily) {
+function pickByScore(candidates, state, exclude, modelFamily, predicate) {
   let best = null;
   let bestScore = Infinity;
   for (const acct of candidates) {
@@ -379,22 +494,7 @@ function findBestAvailable(candidates, state, exclude, modelFamily) {
       continue;
     if (isTemporarilyUnavailable(state, acct.name))
       continue;
-    if (!isOverThreshold(state.usage[acct.name], state, modelFamily)) {
-      const score = getUtilizationScore(state.usage[acct.name], state, modelFamily);
-      if (!best || score < bestScore) {
-        bestScore = score;
-        best = acct;
-      }
-    }
-  }
-  if (best)
-    return best;
-  best = null;
-  bestScore = Infinity;
-  for (const acct of candidates) {
-    if (exclude.has(acct.name))
-      continue;
-    if (isTemporarilyUnavailable(state, acct.name))
+    if (!predicate(acct))
       continue;
     const score = getUtilizationScore(state.usage[acct.name], state, modelFamily);
     if (!best || score < bestScore) {
@@ -404,6 +504,12 @@ function findBestAvailable(candidates, state, exclude, modelFamily) {
   }
   return best;
 }
+function findBestAvailable(candidates, state, exclude, modelFamily) {
+  const underThreshold = (acct) => !isOverThreshold(state.usage[acct.name], state, modelFamily);
+  const fresh = (acct) => isAccessTokenFresh(acct);
+  const stale = (acct) => !isAccessTokenFresh(acct);
+  return pickByScore(candidates, state, exclude, modelFamily, (acct) => underThreshold(acct) && fresh(acct)) ?? pickByScore(candidates, state, exclude, modelFamily, (acct) => underThreshold(acct) && stale(acct)) ?? pickByScore(candidates, state, exclude, modelFamily, fresh) ?? pickByScore(candidates, state, exclude, modelFamily, stale);
+}
 function selectAccount(accounts, state, model) {
   if (accounts.length === 0) {
     throw new Error("No accounts available");
@@ -438,6 +544,9 @@ function selectAccount(accounts, state, model) {
   }
   return { account: current, switched: false };
 }
+function markAuthFailure(state, accountName) {
+  state.authFailures[accountName] = Date.now() + AUTH_FAILURE_COOLDOWN;
+}
 function clearAuthFailure(state, accountName) {
   delete state.authFailures[accountName];
 }
@@ -692,6 +801,11 @@ function progressBar(value, threshold, width = 30) {
   const label = `${(value * 100).toFixed(1)}%`;
   return `${bar} ${color}${label}${RESET}`;
 }
+function resetSuffix(metric, now) {
+  if (!metric.reset || metric.reset * 1000 <= now)
+    return "";
+  return `  ${DIM}resets ${formatRelativeDuration(metric.reset * 1000, now)}${RESET}`;
+}
 function tryCopy(cmd, args, text) {
   return new Promise((resolve) => {
     try {
@@ -853,6 +967,132 @@ async function refreshExpiredAccounts(data, state) {
     }
   }
 }
+var PROBE_CONCURRENCY = 3;
+var PROBE_API_URL = "https://api.anthropic.com/v1/messages?beta=true";
+var PROBE_MODELS = [
+  "claude-sonnet-4-5",
+  "claude-opus-4-5"
+];
+var PROBE_BETA_HEADERS = "oauth-2025-04-20,interleaved-thinking-2025-05-14";
+var PROBE_USER_AGENT = "claude-cli/2.1.87 (external, cli)";
+var PROBE_VERSION = "2023-06-01";
+var CLAUDE_CODE_VERSION = "2.1.87";
+var CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+var CCH_SALT = "59cf53e54c78";
+var CCH_POSITIONS = [4, 7, 20];
+function computeCCH(messageText) {
+  return createHash("sha256").update(messageText).digest("hex").slice(0, 5);
+}
+function computeVersionSuffix(messageText) {
+  const chars = CCH_POSITIONS.map((i) => messageText[i] || "0").join("");
+  return createHash("sha256").update(`${CCH_SALT}${chars}${CLAUDE_CODE_VERSION}`).digest("hex").slice(0, 3);
+}
+function buildBillingHeader(messageText) {
+  const suffix = computeVersionSuffix(messageText);
+  const cch = computeCCH(messageText);
+  return "x-anthropic-billing-header: " + `cc_version=${CLAUDE_CODE_VERSION}.${suffix}; ` + `cc_entrypoint=sdk-cli; ` + `cch=${cch};`;
+}
+async function probeAccount(account, state) {
+  const result = { name: account.name, success: false };
+  if (!account.access || account.expires <= Date.now()) {
+    if (!account.refresh) {
+      result.error = "missing refresh token";
+      return result;
+    }
+    const refreshResult = await refreshAccountToken(account.refresh);
+    if (!refreshResult.ok || !refreshResult.access) {
+      result.error = `token refresh failed: ${refreshResult.error || "unknown"}`;
+      markAuthFailure(state, account.name);
+      return result;
+    }
+    account.access = refreshResult.access;
+    account.refresh = refreshResult.refresh;
+    account.expires = refreshResult.expires;
+    await updateAccountTokens(account.name, refreshResult.access, refreshResult.refresh, refreshResult.expires);
+    clearAuthFailure(state, account.name);
+  }
+  let lastStatus = 0;
+  let lastBody = "";
+  for (const model of PROBE_MODELS) {
+    try {
+      const messageText = ".";
+      const billingHeader = buildBillingHeader(messageText);
+      const response = await fetch(PROBE_API_URL, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${account.access}`,
+          "anthropic-beta": PROBE_BETA_HEADERS,
+          "anthropic-version": PROBE_VERSION,
+          "user-agent": PROBE_USER_AGENT,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          model,
+          max_tokens: 1,
+          system: [
+            { type: "text", text: billingHeader },
+            { type: "text", text: CLAUDE_CODE_IDENTITY }
+          ],
+          messages: [{ role: "user", content: messageText }]
+        })
+      });
+      lastStatus = response.status;
+      const updated = updateUsageFromHeaders(state, account.name, response.headers);
+      if (response.status === 401 || response.status === 403) {
+        result.error = `auth error ${response.status}`;
+        markAuthFailure(state, account.name);
+        return result;
+      }
+      if (response.status === 429 && updated) {
+        result.success = true;
+        result.model = model;
+        clearAuthFailure(state, account.name);
+        return result;
+      }
+      if (response.ok || updated) {
+        result.success = true;
+        result.model = model;
+        clearAuthFailure(state, account.name);
+        return result;
+      }
+      lastBody = await response.text().catch(() => "");
+      if (response.status === 400 && lastBody.includes("model")) {
+        continue;
+      }
+    } catch (err) {
+      result.error = err instanceof Error ? err.message : String(err);
+      return result;
+    }
+  }
+  result.error = `HTTP ${lastStatus}: ${lastBody.slice(0, 100)}`;
+  return result;
+}
+async function probeAllAccounts(accounts) {
+  const state = loadState();
+  const results = [];
+  const probeErrors = [];
+  for (let i = 0;i < accounts.length; i += PROBE_CONCURRENCY) {
+    const batch = accounts.slice(i, i + PROBE_CONCURRENCY);
+    const batchResults = await Promise.allSettled(batch.map((account) => probeAccount(account, state)));
+    for (const settled of batchResults) {
+      if (settled.status === "fulfilled") {
+        results.push(settled.value);
+        if (!settled.value.success && settled.value.error) {
+          probeErrors.push(`${settled.value.name}: ${settled.value.error}`);
+        }
+      } else {
+        probeErrors.push(`unexpected error: ${settled.reason}`);
+      }
+    }
+  }
+  await saveStateMerged(state, accounts.map((a) => a.name));
+  if (probeErrors.length > 0) {
+    for (const err of probeErrors) {
+      console.log(`  ${YELLOW}Warning: probe failed for ${err}${RESET}`);
+    }
+  }
+  return { state, results };
+}
 async function cmdUsage(args) {
   const watch = args.includes("--watch") || args.includes("-w");
   const showUsage = async () => {
@@ -886,10 +1126,10 @@ ${BOLD}${CYAN}=== Auth Switcher Usage Dashboard ===${RESET}
       const tag = isActive ? `${GREEN} [ACTIVE]${RESET}` : isCooling ? `${RED} [COOLDOWN]${RESET}` : "";
       console.log(`  ${BOLD}${account.name}${RESET}${tag}`);
       if (usage) {
-        console.log(`    5h session:  ${progressBar(usage.session5h.utilization, thresholds.session5h)}`);
-        console.log(`    7d weekly:   ${progressBar(usage.weekly7d.utilization, thresholds.weekly7d)}`);
-        console.log(`    7d sonnet:   ${progressBar(usage.weekly7dSonnet.utilization, thresholds.weekly7dSonnet)}`);
-        console.log(`    7d fable:    ${progressBar(usage.weekly7dFable.utilization, thresholds.weekly7dFable)}`);
+        console.log(`    5h session:  ${progressBar(usage.session5h.utilization, thresholds.session5h)}${resetSuffix(usage.session5h, now)}`);
+        console.log(`    7d weekly:   ${progressBar(usage.weekly7d.utilization, thresholds.weekly7d)}${resetSuffix(usage.weekly7d, now)}`);
+        console.log(`    7d sonnet:   ${progressBar(usage.weekly7dSonnet.utilization, thresholds.weekly7dSonnet)}${resetSuffix(usage.weekly7dSonnet, now)}`);
+        console.log(`    7d fable:    ${progressBar(usage.weekly7dFable.utilization, thresholds.weekly7dFable)}${resetSuffix(usage.weekly7dFable, now)}`);
         const rejection = deriveAccountHealth(account, usage, thresholds, state.authFailures[account.name], now).reasons.find((reason) => reason.kind === "rejection");
         if (rejection) {
           const reset = rejection.reset ? ` \u2014 resets ${formatResetTime(rejection.reset, now)}` : "";
@@ -908,6 +1148,18 @@ ${BOLD}${CYAN}=== Auth Switcher Usage Dashboard ===${RESET}
       console.log();
     }
   };
+  const accountsData = loadAccounts();
+  if (accountsData.accounts.length > 0) {
+    process.stdout.write(`${DIM}  Probing ${accountsData.accounts.length} account(s) for current usage...${RESET}`);
+    const { results } = await probeAllAccounts(accountsData.accounts);
+    const successCount = results.filter((r) => r.success).length;
+    const models = [...new Set(results.filter((r) => r.model).map((r) => r.model))];
+    process.stdout.write(`\r\x1B[K`);
+    if (successCount < accountsData.accounts.length) {
+      console.log(`${DIM}  Probed ${successCount}/${accountsData.accounts.length} accounts successfully${models.length ? ` (${models.join(", ")})` : ""}${RESET}
+`);
+    }
+  }
   await showUsage();
   if (watch) {
     console.log(`${DIM}Refreshing every 5 seconds. Press Ctrl+C to stop.${RESET}

package/dist/index.js

@@ -433,6 +433,11 @@ function quotaWindowScope(prefix) {
 }
 
 // src/accounts.ts
+function isAccessTokenFresh(account, nowMs = Date.now()) {
+  if (account.expires == null || Number.isNaN(account.expires))
+    return true;
+  return !!account.access && account.expires > nowMs;
+}
 function normalizeAccount(raw) {
   const name = raw.name || "unnamed";
   const access = raw.access || raw.accessToken || "";
@@ -832,7 +837,7 @@ function purgeExpiredCooldowns(state) {
     }
   }
 }
-function findBestAvailable(candidates, state, exclude, modelFamily) {
+function pickByScore(candidates, state, exclude, modelFamily, predicate) {
   let best = null;
   let bestScore = Infinity;
   for (const acct of candidates) {
@@ -840,22 +845,7 @@ function findBestAvailable(candidates, state, exclude, modelFamily) {
       continue;
     if (isTemporarilyUnavailable(state, acct.name))
       continue;
-    if (!isOverThreshold(state.usage[acct.name], state, modelFamily)) {
-      const score = getUtilizationScore(state.usage[acct.name], state, modelFamily);
-      if (!best || score < bestScore) {
-        bestScore = score;
-        best = acct;
-      }
-    }
-  }
-  if (best)
-    return best;
-  best = null;
-  bestScore = Infinity;
-  for (const acct of candidates) {
-    if (exclude.has(acct.name))
-      continue;
-    if (isTemporarilyUnavailable(state, acct.name))
+    if (!predicate(acct))
       continue;
     const score = getUtilizationScore(state.usage[acct.name], state, modelFamily);
     if (!best || score < bestScore) {
@@ -865,6 +855,12 @@ function findBestAvailable(candidates, state, exclude, modelFamily) {
   }
   return best;
 }
+function findBestAvailable(candidates, state, exclude, modelFamily) {
+  const underThreshold = (acct) => !isOverThreshold(state.usage[acct.name], state, modelFamily);
+  const fresh = (acct) => isAccessTokenFresh(acct);
+  const stale = (acct) => !isAccessTokenFresh(acct);
+  return pickByScore(candidates, state, exclude, modelFamily, (acct) => underThreshold(acct) && fresh(acct)) ?? pickByScore(candidates, state, exclude, modelFamily, (acct) => underThreshold(acct) && stale(acct)) ?? pickByScore(candidates, state, exclude, modelFamily, fresh) ?? pickByScore(candidates, state, exclude, modelFamily, stale);
+}
 function selectAccount(accounts, state, model) {
   if (accounts.length === 0) {
     throw new Error("No accounts available");
@@ -906,6 +902,96 @@ function clearAuthFailure(state, accountName) {
   delete state.authFailures[accountName];
 }
 
+// src/retry.ts
+var RATE_LIMIT_STATUSES = new Set([429]);
+function isReplayableBody(body) {
+  return body == null || typeof body === "string";
+}
+function isRateLimitStatus(status) {
+  return RATE_LIMIT_STATUSES.has(status);
+}
+function finalizeRequestAccounting(state, accountName, response) {
+  updateUsageFromHeaders(state, accountName, response.headers);
+  if (response.ok) {
+    clearAuthFailure(state, accountName);
+    state.requestCount = (state.requestCount || 0) + 1;
+  }
+}
+async function retryAcrossAccounts(initial, account, options) {
+  const { accounts, state, model, bodyReplayable, attemptedAccounts, send, log } = options;
+  attemptedAccounts.add(account.name);
+  let response = initial;
+  let current = account;
+  let authRetryUsed = false;
+  const maxFetches = Math.max(accounts.length, 1) + 1;
+  let fetches = 1;
+  while (fetches < maxFetches) {
+    if (!bodyReplayable)
+      break;
+    if (isRateLimitStatus(response.status)) {
+      updateUsageFromHeaders(state, current.name, response.headers);
+      attemptedAccounts.add(current.name);
+      const available = accounts.filter((candidate) => !attemptedAccounts.has(candidate.name));
+      if (available.length === 0)
+        break;
+      const next = selectAccount(available, state, model).account;
+      if (next.name === current.name || attemptedAccounts.has(next.name))
+        break;
+      await log(`${current.name} rate-limited (HTTP ${response.status}) — retrying on ${next.name}`);
+      const prepared = await ensureFreshToken(next, state);
+      if (!prepared) {
+        attemptedAccounts.add(next.name);
+        continue;
+      }
+      current = prepared;
+      response = await send(current);
+      fetches += 1;
+      attemptedAccounts.add(current.name);
+      continue;
+    }
+    if ((response.status === 401 || response.status === 403) && !authRetryUsed) {
+      const errorBody = await response.clone().text().catch(() => "");
+      const isScopeError = errorBody.includes("scope") || errorBody.includes("unauthorized") || errorBody.includes("invalid");
+      if (!isScopeError)
+        break;
+      markAuthFailure(state, current.name);
+      attemptedAccounts.add(current.name);
+      authRetryUsed = true;
+      const available = accounts.filter((candidate) => !attemptedAccounts.has(candidate.name) && (!state.authFailures[candidate.name] || state.authFailures[candidate.name] <= Date.now()));
+      if (available.length === 0)
+        break;
+      const next = selectAccount(available, state, model).account;
+      if (next.name === current.name)
+        break;
+      await log(`${current.name} auth failure (HTTP ${response.status}) — retrying on ${next.name}`);
+      const prepared = await ensureFreshToken(next, state);
+      if (!prepared)
+        break;
+      current = prepared;
+      response = await send(current);
+      fetches += 1;
+      attemptedAccounts.add(current.name);
+      continue;
+    }
+    break;
+  }
+  return { response, account: current };
+}
+async function ensureFreshToken(account, state) {
+  if (isAccessTokenFresh(account))
+    return account;
+  const result = await refreshAccountToken(account.refresh);
+  if (result.ok && result.access && result.refresh && result.expires) {
+    account.access = result.access;
+    account.refresh = result.refresh;
+    account.expires = result.expires;
+    await updateAccountTokens(account.name, result.access, result.refresh, result.expires);
+    return account;
+  }
+  markAuthFailure(state, account.name);
+  return null;
+}
+
 // src/index.ts
 function selectionSnapshot(state) {
   return {
@@ -1014,7 +1100,7 @@ var AuthSwitcherPlugin = async ({ client }) => {
             const attemptedAccounts = new Set;
             while (true) {
               attemptedAccounts.add(account.name);
-              if (!account.access || account.expires <= Date.now()) {
+              if (!isAccessTokenFresh(account)) {
                 const result = await refreshAccountToken(account.refresh);
                 if (result.ok && result.access && result.refresh && result.expires) {
                   account.access = result.access;
@@ -1043,6 +1129,19 @@ var AuthSwitcherPlugin = async ({ client }) => {
               body = rewriteRequestBody(body);
             }
             const rewritten = rewriteUrl(input);
+            const bodyReplayable = isReplayableBody(init?.body);
+            const sendWithAccount = async (acct) => {
+              const headers = mergeHeaders(input, init);
+              setOAuthHeaders(headers, acct.access);
+              return fetch(rewritten.input, {
+                ...init,
+                body,
+                headers,
+                ...isInsecure() && {
+                  tls: { rejectUnauthorized: false }
+                }
+              });
+            };
             const response = await fetch(rewritten.input, {
               ...init,
               body,
@@ -1051,48 +1150,29 @@ var AuthSwitcherPlugin = async ({ client }) => {
                 tls: { rejectUnauthorized: false }
               }
             });
-            if ((response.status === 401 || response.status === 403) && !attemptedAccounts.has("__retried__")) {
-              const errorBody = await response.clone().text().catch(() => "");
-              const isScopeError = errorBody.includes("scope") || errorBody.includes("unauthorized") || errorBody.includes("invalid");
-              if (isScopeError) {
-                markAuthFailure(state, account.name);
-                const available = accounts.filter((candidate) => !attemptedAccounts.has(candidate.name) && (!state.authFailures[candidate.name] || state.authFailures[candidate.name] <= Date.now()));
-                const next = available.length > 0 ? selectAccount(available, state, model).account : undefined;
-                if (next) {
-                  attemptedAccounts.add("__retried__");
-                  account = next;
-                  state.currentAccount = next.name;
-                  if (!next.access || next.expires <= Date.now()) {
-                    const result = await refreshAccountToken(next.refresh);
-                    if (result.ok && result.access && result.refresh && result.expires) {
-                      next.access = result.access;
-                      next.refresh = result.refresh;
-                      next.expires = result.expires;
-                      await updateAccountTokens(next.name, result.access, result.refresh, result.expires);
-                    }
+            const retried = await retryAcrossAccounts(response, account, {
+              accounts,
+              state,
+              model,
+              bodyReplayable,
+              attemptedAccounts,
+              send: sendWithAccount,
+              log: async (message) => {
+                await client.app.log({
+                  body: {
+                    service: "oc-auth-switcher",
+                    level: "info",
+                    message
                   }
-                  const retryHeaders = mergeHeaders(input, init);
-                  setOAuthHeaders(retryHeaders, next.access);
-                  const retryResponse = await fetch(rewritten.input, {
-                    ...init,
-                    body,
-                    headers: retryHeaders,
-                    ...isInsecure() && {
-                      tls: { rejectUnauthorized: false }
-                    }
-                  });
-                  updateUsageFromHeaders(state, next.name, retryResponse.headers);
-                  clearAuthFailure(state, next.name);
-                  await saveRequestState(state, initiallyLoadedSelection);
-                  return createStrippedStream(retryResponse);
-                }
+                }).catch(() => {});
               }
-            }
-            updateUsageFromHeaders(state, account.name, response.headers);
-            clearAuthFailure(state, account.name);
-            state.requestCount = (state.requestCount || 0) + 1;
+            });
+            account = retried.account;
+            state.currentAccount = account.name;
+            const finalResponse = retried.response;
+            finalizeRequestAccounting(state, account.name, finalResponse);
             await saveRequestState(state, initiallyLoadedSelection);
-            return createStrippedStream(response);
+            return createStrippedStream(finalResponse);
           }
         };
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oc-auth-switcher",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "description": "OpenCode auth plugin for multi-account Anthropic Claude Max rotation with automatic failover.",
   "type": "module",
   "main": "dist/index.js",