oc-codex-multi-auth 6.3.1 → 6.3.3

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAsM/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAojH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAwM/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAyqH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -41,8 +41,8 @@ import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLab
 import { resolveDisplayEmail } from "./lib/account-display.js";
 import { CodexAuthError } from "./lib/errors.js";
 import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
-import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
-import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, } from "./lib/error-sentinels.js";
+import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, isInvalidatedAuthTokenError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
+import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, isInvalidatedAuthTokenMessage, } from "./lib/error-sentinels.js";
 import { applyFastSessionDefaults, upsertBackendModelIdentityMessage, } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
@@ -1861,6 +1861,63 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     }
                                                     break;
                                                 }
+                                                // A 401 token-invalidated response means the access token presented for
+                                                // THIS account was rejected by the backend even though the proactive
+                                                // refresh above either ran or judged the token still fresh. Without an
+                                                // explicit handler the 401 fell straight through to `return errorResponse`
+                                                // below, so persisted family routing kept pinning every request to the dead
+                                                // account slot instead of failing over (issue #171). Treat it as an
+                                                // account-health failure: cool the refresh-token group down (or remove it
+                                                // past the failure threshold) and rotate to the next healthy account.
+                                                //
+                                                // Note: 401s intentionally do NOT feed the circuit breaker — the breaker
+                                                // guards against upstream faults (network / 5xx), not client-side auth
+                                                // decisions (see the 5xx handler above).
+                                                if (isInvalidatedAuthTokenError(errorBody, response.status)) {
+                                                    const accountLabel = formatAccountLabel(account, account.index, {
+                                                        maskEmail: maskEmailEnabled,
+                                                    });
+                                                    accountManager.refundToken(account, modelFamily, model);
+                                                    accountManager.recordFailure(account, modelFamily, model);
+                                                    account.lastSwitchReason = "rotation";
+                                                    runtimeMetrics.failedRequests++;
+                                                    runtimeMetrics.accountRotations++;
+                                                    runtimeMetrics.lastError = `Auth token invalidated on ${accountLabel}`;
+                                                    runtimeMetrics.lastErrorCategory = "auth-invalidated";
+                                                    const failures = await accountManager.incrementAuthFailures(account);
+                                                    if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
+                                                        const removedCount = accountManager.removeAccountsWithSameRefreshToken(account);
+                                                        if (removedCount > 0) {
+                                                            accountManager.saveToDiskDebounced();
+                                                            await showToast(removedCount > 1
+                                                                ? `Removed ${removedCount} accounts (same refresh token) after ${failures} auth-token failures. Run 'opencode auth login' to re-add.`
+                                                                : `Removed ${accountLabel} after ${failures} auth-token failures. Run 'opencode auth login' to re-add.`, "error", { duration: toastDurationMs * 2 });
+                                                            // Indices shift after removal; restart traversal with a fresh
+                                                            // attempted set so no healthy account is skipped.
+                                                            attempted.clear();
+                                                            accountCount = accountManager.getAccountCount();
+                                                            break;
+                                                        }
+                                                        logWarn(`[${PLUGIN_NAME}] Expected grouped account removal after auth-token invalidation, but removed ${removedCount}.`);
+                                                    }
+                                                    // Below the removal threshold (or grouped removal was a no-op): cool the
+                                                    // account's whole refresh-token group down so selection skips it, then
+                                                    // rotate to the next healthy account instead of returning the 401.
+                                                    const cooledCount = accountManager.markAccountsWithRefreshTokenCoolingDown(account.refreshToken, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                                    if (cooledCount <= 0) {
+                                                        accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                                    }
+                                                    accountManager.saveToDiskDebounced();
+                                                    logWarn(accountCount > 1
+                                                        ? `Auth token invalidated for account ${account.index + 1}. Cooling down and rotating to next account.`
+                                                        : `Auth token invalidated for account ${account.index + 1}. Cooling down; no other account available.`);
+                                                    if (accountCount > 1 &&
+                                                        accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                                        await showToast(`Account ${account.index + 1} sign-in expired. Switching accounts.`, "warning", { duration: toastDurationMs });
+                                                        accountManager.markToastShown(account.index);
+                                                    }
+                                                    break;
+                                                }
                                                 runtimeMetrics.failedRequests++;
                                                 runtimeMetrics.lastError = `HTTP ${response.status}`;
                                                 runtimeMetrics.lastErrorCategory = "http";
@@ -1927,6 +1984,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 }
                                             }
                                             accountManager.recordSuccess(account, modelFamily, model);
+                                            // A successful request proves the account's credentials are good
+                                            // again, so reset the auth-failure counter that a prior 401
+                                            // token-invalidated response (or refresh failure) may have bumped.
+                                            // Otherwise stale counts could accumulate across requests and
+                                            // eventually remove a now-healthy account.
+                                            accountManager.clearAuthFailures(account);
                                             // RC-8: closes a half-open gate or prunes the failure window so a
                                             // sequence of successes keeps the breaker healthy.
                                             circuitBreaker.recordSuccess();
@@ -2248,6 +2311,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         if (isDeactivatedWorkspaceError(errorBody, response.status)) {
                                             throw createDeactivatedWorkspaceError();
                                         }
+                                        // A 401 here proves the token is invalid even when the body
+                                        // carries only a generic "Unauthorized" string. The status is
+                                        // dropped once we throw a plain Error, so normalize to the
+                                        // canonical message the catch below matches — otherwise a
+                                        // non-specific 401 would leave a dead routing slot unflagged
+                                        // for codex-doctor --fix (issue #171).
+                                        if (isInvalidatedAuthTokenError(errorBody, response.status)) {
+                                            throw new Error("Your authentication token has been invalidated. Please try signing in again.");
+                                        }
                                         throw new Error(message);
                                     }
                                     lastError = new Error("Codex response did not include quota headers");
@@ -2450,6 +2522,21 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             removeFromActive.add(getWorkspaceIdentityKey(account));
                                             flaggedChanged = true;
                                         }
+                                        else if (isInvalidatedAuthTokenMessage(message)) {
+                                            // The cached access token probed OK locally but the backend
+                                            // rejected it (401 invalidated). Surface it so `codex-doctor
+                                            // --fix` repairs the active routing instead of leaving a dead
+                                            // slot selected (issue #171).
+                                            const flaggedRecord = {
+                                                ...account,
+                                                flaggedAt: Date.now(),
+                                                flaggedReason: "token-invalid",
+                                                lastError: message,
+                                            };
+                                            flaggedUpdates.set(getWorkspaceIdentityKey(flaggedRecord), flaggedRecord);
+                                            removeFromActive.add(getWorkspaceIdentityKey(account));
+                                            flaggedChanged = true;
+                                        }
                                         console.log(`[${i + 1}/${total}] ${label}: ERROR (${message.slice(0, 160)})`);
                                     }
                                 }