opencode-anthropic-fix 0.0.16 → 0.0.18

package/index.mjs

@@ -4,9 +4,11 @@ import { createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { AccountManager } from "./lib/accounts.mjs";
-import { authorize, exchange } from "./lib/oauth.mjs";
+import { authorize, exchange, refreshToken } from "./lib/oauth.mjs";
 import { loadConfig, CLIENT_ID, getConfigDir } from "./lib/config.mjs";
 import { loadAccounts, saveAccounts, clearAccounts, createDefaultStats } from "./lib/storage.mjs";
+import { applyOAuthCredentials, resetAccountTracking } from "./lib/account-state.mjs";
+import { acquireRefreshLock, releaseRefreshLock } from "./lib/refresh-lock.mjs";
 import { isAccountSpecificError, parseRateLimitReason, parseRetryAfterHeader } from "./lib/backoff.mjs";
 
 // ---------------------------------------------------------------------------
@@ -101,7 +103,7 @@ async function promptManageAccounts(accountManager) {
 // Request building helpers (extracted from original fetch interceptor)
 // ---------------------------------------------------------------------------
 
-const FALLBACK_CLAUDE_CLI_VERSION = "2.1.2";
+const FALLBACK_CLAUDE_CLI_VERSION = "2.1.68";
 const CLAUDE_CODE_NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
 const CLAUDE_CODE_BETA_FLAG = "claude-code-20250219";
 const BILLING_HASH_SALT = "59cf53e54c78";
@@ -419,6 +421,9 @@ function getFirstUserText(messages) {
  * @returns {string}
  */
 function getAccountIdentifier(account) {
+  // Prefer env-provided account UUID (v2.1.51+), then account record fields
+  const envUuid = process.env.CLAUDE_CODE_ACCOUNT_UUID?.trim();
+  if (envUuid) return envUuid;
   if (account?.accountUuid && typeof account.accountUuid === "string") {
     return account.accountUuid;
   }
@@ -433,9 +438,18 @@ function getAccountIdentifier(account) {
  * @returns {{user_id: string}}
  */
 function buildRequestMetadata(input) {
-  return {
+  /** @type {Record<string, any>} */
+  const metadata = {
     user_id: `user_${input.persistentUserId}_account_${input.accountId}_session_${input.sessionId}`,
   };
+
+  // v2.1.51: pass through SDK caller metadata when available
+  const orgUuid = process.env.CLAUDE_CODE_ORGANIZATION_UUID?.trim();
+  if (orgUuid) metadata.organization_uuid = orgUuid;
+  const userEmail = process.env.CLAUDE_CODE_USER_EMAIL?.trim();
+  if (userEmail) metadata.user_email = userEmail;
+
+  return metadata;
 }
 
 /**
@@ -773,7 +787,7 @@ function normalizeThinkingBlock(thinking, model) {
     return rest;
   }
 
-  const effort = typeof thinking.budget_tokens === "number" ? budgetTokensToEffort(thinking.budget_tokens) : "high"; // safe default
+  const effort = typeof thinking.budget_tokens === "number" ? budgetTokensToEffort(thinking.budget_tokens) : "medium"; // v2.1.68 default
 
   return { type: "enabled", effort };
 }
@@ -1113,6 +1127,74 @@ function getMidStreamAccountError(parsed) {
   };
 }
 
+/**
+ * Strip `mcp_` prefix from tool_use `name` fields in SSE data lines.
+ * Only modifies `name` values inside content blocks with `"type": "tool_use"`.
+ * Non-JSON lines and text blocks are left untouched.
+ *
+ * @param {string} text - Raw SSE chunk text (may contain multiple lines)
+ * @returns {string}
+ */
+function stripMcpPrefixFromSSE(text) {
+  return text.replace(/^data:\s*(.+)$/gm, (_match, jsonStr) => {
+    try {
+      const parsed = JSON.parse(jsonStr);
+      if (stripMcpPrefixFromParsedEvent(parsed)) {
+        return `data: ${JSON.stringify(parsed)}`;
+      }
+    } catch {
+      // Not valid JSON — pass through unchanged.
+    }
+    return _match;
+  });
+}
+
+/**
+ * Mutate a parsed SSE event object, removing `mcp_` prefix from tool_use
+ * name fields. Returns true if any modification was made.
+ *
+ * @param {any} parsed
+ * @returns {boolean}
+ */
+function stripMcpPrefixFromParsedEvent(parsed) {
+  if (!parsed || typeof parsed !== "object") return false;
+
+  let modified = false;
+
+  // content_block_start: { content_block: { type: "tool_use", name: "mcp_..." } }
+  if (
+    parsed.content_block &&
+    parsed.content_block.type === "tool_use" &&
+    typeof parsed.content_block.name === "string" &&
+    parsed.content_block.name.startsWith("mcp_")
+  ) {
+    parsed.content_block.name = parsed.content_block.name.slice(4);
+    modified = true;
+  }
+
+  // message_start: { message: { content: [{ type: "tool_use", name: "mcp_..." }] } }
+  if (parsed.message && Array.isArray(parsed.message.content)) {
+    for (const block of parsed.message.content) {
+      if (block.type === "tool_use" && typeof block.name === "string" && block.name.startsWith("mcp_")) {
+        block.name = block.name.slice(4);
+        modified = true;
+      }
+    }
+  }
+
+  // Top-level content array (non-streaming responses forwarded through SSE)
+  if (Array.isArray(parsed.content)) {
+    for (const block of parsed.content) {
+      if (block.type === "tool_use" && typeof block.name === "string" && block.name.startsWith("mcp_")) {
+        block.name = block.name.slice(4);
+        modified = true;
+      }
+    }
+  }
+
+  return modified;
+}
+
 /**
  * Wrap a response body stream to strip mcp_ prefix from tool names,
  * extract token usage stats from SSE events, and detect mid-stream
@@ -1131,10 +1213,12 @@ function transformResponse(response, onUsage, onAccountError) {
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
+  const EMPTY_CHUNK = new Uint8Array();
 
   /** @type {UsageStats} */
   const stats = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 };
   let sseBuffer = "";
+  let sseRewriteBuffer = "";
   let accountErrorHandled = false;
 
   /**
@@ -1184,12 +1268,41 @@ function transformResponse(response, onUsage, onAccountError) {
     }
   }
 
+  /**
+   * Rewrite complete SSE lines while preserving chunk boundaries for streaming.
+   * Buffers trailing partial lines to avoid parsing split JSON payloads.
+   * @param {string} chunk
+   * @param {boolean} [flush]
+   * @returns {string}
+   */
+  function rewriteSSEChunk(chunk, flush = false) {
+    sseRewriteBuffer += chunk;
+
+    if (!flush) {
+      const boundary = sseRewriteBuffer.lastIndexOf("\n");
+      if (boundary === -1) return "";
+      const complete = sseRewriteBuffer.slice(0, boundary + 1);
+      sseRewriteBuffer = sseRewriteBuffer.slice(boundary + 1);
+      return stripMcpPrefixFromSSE(complete);
+    }
+
+    if (!sseRewriteBuffer) return "";
+    const finalText = stripMcpPrefixFromSSE(sseRewriteBuffer);
+    sseRewriteBuffer = "";
+    return finalText;
+  }
+
   const stream = new ReadableStream({
     async pull(controller) {
       const { done, value } = await reader.read();
       if (done) {
         processSSEBuffer(true);
 
+        const rewrittenTail = rewriteSSEChunk("", true);
+        if (rewrittenTail) {
+          controller.enqueue(encoder.encode(rewrittenTail));
+        }
+
         if (
           onUsage &&
           (stats.inputTokens > 0 || stats.outputTokens > 0 || stats.cacheReadTokens > 0 || stats.cacheWriteTokens > 0)
@@ -1200,7 +1313,7 @@ function transformResponse(response, onUsage, onAccountError) {
         return;
       }
 
-      let text = decoder.decode(value, { stream: true });
+      const text = decoder.decode(value, { stream: true });
 
       if (onUsage || onAccountError) {
         // Normalize CRLF for parser only; preserve original bytes for passthrough.
@@ -1208,8 +1321,14 @@ function transformResponse(response, onUsage, onAccountError) {
         processSSEBuffer(false);
       }
 
-      text = text.replace(/"name"\s*:\s*"mcp_([^"]+)"/g, '"name": "$1"');
-      controller.enqueue(encoder.encode(text));
+      const rewrittenText = rewriteSSEChunk(text, false);
+      if (rewrittenText) {
+        controller.enqueue(encoder.encode(rewrittenText));
+      } else {
+        // Keep the pull/read loop progressing when this chunk only extends a
+        // partial line buffered for later rewrite.
+        controller.enqueue(EMPTY_CHUNK);
+      }
     },
   });
 
@@ -1247,69 +1366,132 @@ function formatSwitchReason(status, reason) {
 // Token refresh (per-account)
 // ---------------------------------------------------------------------------
 
+/**
+ * Read the latest auth fields for an account from disk.
+ * Another instance may have rotated tokens since we loaded into memory.
+ * @param {string} accountId
+ * @returns {Promise<{refreshToken: string, access?: string, expires?: number, tokenUpdatedAt: number} | null>}
+ */
+async function readDiskAccountAuth(accountId) {
+  try {
+    const diskData = await loadAccounts();
+    if (!diskData) return null;
+    const diskAccount = diskData.accounts.find((a) => a.id === accountId);
+    if (!diskAccount) return null;
+    return {
+      refreshToken: diskAccount.refreshToken,
+      access: diskAccount.access,
+      expires: diskAccount.expires,
+      tokenUpdatedAt: diskAccount.token_updated_at,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {import('./lib/accounts.mjs').ManagedAccount} account
+ * @param {number} [now]
+ */
+function markTokenStateUpdated(account, now = Date.now()) {
+  account.tokenUpdatedAt = now;
+}
+
+/**
+ * Adopt disk auth fields only when disk has fresher token state.
+ * @param {import('./lib/accounts.mjs').ManagedAccount} account
+ * @param {{refreshToken: string, access?: string, expires?: number, tokenUpdatedAt: number} | null} diskAuth
+ * @param {{ allowExpiredFallback?: boolean }} [options]
+ * @returns {boolean}
+ */
+function applyDiskAuthIfFresher(account, diskAuth, options = {}) {
+  if (!diskAuth) return false;
+  const diskTokenUpdatedAt = diskAuth.tokenUpdatedAt || 0;
+  const memTokenUpdatedAt = account.tokenUpdatedAt || 0;
+  const diskHasDifferentAuth = diskAuth.refreshToken !== account.refreshToken || diskAuth.access !== account.access;
+  const memAuthExpired = !account.expires || account.expires <= Date.now();
+  const allowExpiredFallback = options.allowExpiredFallback === true;
+  if (diskTokenUpdatedAt <= memTokenUpdatedAt && !(allowExpiredFallback && diskHasDifferentAuth && memAuthExpired)) {
+    return false;
+  }
+  account.refreshToken = diskAuth.refreshToken;
+  account.access = diskAuth.access;
+  account.expires = diskAuth.expires;
+  account.tokenUpdatedAt = Math.max(memTokenUpdatedAt, diskTokenUpdatedAt);
+  return true;
+}
+
 /**
  * Refresh an account's access token.
+ *
  * @param {import('./lib/accounts.mjs').ManagedAccount} account
  * @param {ReturnType<typeof import('@opencode-ai/sdk').createOpencodeClient>} client
+ * @param {"foreground" | "idle"} [source]
  * @returns {Promise<string>} The new access token
  * @throws {Error} If refresh fails
  */
-async function refreshAccountToken(account, client) {
-  const response = await fetch("https://console.anthropic.com/v1/oauth/token", {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify({
-      grant_type: "refresh_token",
-      refresh_token: account.refreshToken,
-      client_id: CLIENT_ID,
-    }),
+async function refreshAccountToken(account, client, source = "foreground") {
+  const lockResult = await acquireRefreshLock(account.id, {
+    timeoutMs: 2_000,
+    backoffMs: 60,
+    staleMs: 20_000,
   });
+  const lock =
+    lockResult && typeof lockResult === "object"
+      ? lockResult
+      : {
+          acquired: true,
+          lockPath: null,
+          owner: null,
+          lockInode: null,
+        };
+
+  if (!lock.acquired) {
+    const diskAuth = await readDiskAccountAuth(account.id);
+    const adopted = applyDiskAuthIfFresher(account, diskAuth, { allowExpiredFallback: true });
+    if (adopted && account.access && account.expires && account.expires > Date.now()) {
+      return account.access;
+    }
+    throw new Error("Refresh lock busy");
+  }
 
-  if (!response.ok) {
-    const bodyText = await response.text().catch(() => "");
-    let errorCode = "";
-    if (bodyText) {
-      try {
-        const parsed = JSON.parse(bodyText);
-        if (parsed && typeof parsed.error === "string") {
-          errorCode = parsed.error;
-        }
-      } catch {
-        // body may be non-JSON
-      }
+  try {
+    const diskAuthBeforeRefresh = await readDiskAccountAuth(account.id);
+    const adopted = applyDiskAuthIfFresher(account, diskAuthBeforeRefresh);
+    if (source === "foreground" && adopted && account.access && account.expires && account.expires > Date.now()) {
+      return account.access;
     }
 
-    const err = new Error(`Token refresh failed: ${response.status}${errorCode ? ` (${errorCode})` : ""}`);
-    // @ts-ignore JS runtime property bag
-    err.status = response.status;
-    // @ts-ignore JS runtime property bag
-    err.errorCode = errorCode;
-    // @ts-ignore JS runtime property bag
-    err.body = bodyText;
-    throw err;
-  }
-
-  const json = await response.json();
-  account.access = json.access_token;
-  account.expires = Date.now() + json.expires_in * 1000;
-  if (json.refresh_token) {
-    account.refreshToken = json.refresh_token;
-  }
-
-  // Also persist to OpenCode's auth.json for compatibility
-  await client.auth.set({
-    path: { id: "anthropic" },
-    body: {
-      type: "oauth",
-      refresh: account.refreshToken,
-      access: account.access,
-      expires: account.expires,
-    },
-  });
+    const json = await refreshToken(account.refreshToken, { signal: AbortSignal.timeout(10_000) });
+
+    account.access = json.access_token;
+    account.expires = Date.now() + json.expires_in * 1000;
+    if (json.refresh_token) {
+      account.refreshToken = json.refresh_token;
+    }
+    markTokenStateUpdated(account);
+
+    // Also persist to OpenCode's auth.json for compatibility.
+    // This should be best-effort: a persistence hiccup should not invalidate an
+    // otherwise successful refresh token exchange.
+    try {
+      await client.auth.set({
+        path: { id: "anthropic" },
+        body: {
+          type: "oauth",
+          refresh: account.refreshToken,
+          access: account.access,
+          expires: account.expires,
+        },
+      });
+    } catch {
+      // Ignore persistence errors; in-memory tokens remain valid for this request.
+    }
 
-  return json.access_token;
+    return json.access_token;
+  } finally {
+    await releaseRefreshLock(lock);
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -1368,9 +1550,18 @@ export async function AnthropicAuthPlugin({ client }) {
   /** @type {Map<string, number>} */
   const debouncedToastTimestamps = new Map();
 
-  /** @type {Map<string, Promise<string>>} */
+  /** @type {Map<string, { promise: Promise<string>, source: "foreground" | "idle" }>} */
   const refreshInFlight = new Map();
 
+  /** @type {Map<string, number>} */
+  const idleRefreshLastAttempt = new Map();
+  /** @type {Set<string>} */
+  const idleRefreshInFlight = new Set();
+
+  const IDLE_REFRESH_ENABLED = config.idle_refresh.enabled;
+  const IDLE_REFRESH_WINDOW_MS = config.idle_refresh.window_minutes * 60 * 1000;
+  const IDLE_REFRESH_MIN_INTERVAL_MS = config.idle_refresh.min_interval_minutes * 60 * 1000;
+
   /**
    * Pending slash-command OAuth flows keyed by session ID.
    * @type {Map<string, { mode: "login" | "reauth", verifier: string, targetIndex?: number, createdAt: number }>}
@@ -1551,6 +1742,7 @@ export async function AnthropicAuthPlugin({ client }) {
         refreshToken: credentials.refresh,
         access: credentials.access,
         expires: credentials.expires,
+        token_updated_at: now,
         addedAt: now,
         lastUsed: 0,
         enabled: true,
@@ -1767,31 +1959,159 @@ export async function AnthropicAuthPlugin({ client }) {
       });
   }
 
+  /**
+   * Parse refresh error details for retry/disable decisions.
+   * @param {unknown} refreshError
+   * @returns {{message: string, status: number, errorCode: string, isInvalidGrant: boolean, isTerminalStatus: boolean}}
+   */
+  function parseRefreshFailure(refreshError) {
+    const message = refreshError instanceof Error ? refreshError.message : String(refreshError);
+    const status =
+      typeof refreshError === "object" && refreshError && "status" in refreshError ? Number(refreshError.status) : NaN;
+    const errorCode =
+      typeof refreshError === "object" && refreshError && ("errorCode" in refreshError || "code" in refreshError)
+        ? String(refreshError.errorCode || refreshError.code || "")
+        : "";
+    const msgLower = message.toLowerCase();
+    const isInvalidGrant =
+      errorCode === "invalid_grant" || errorCode === "invalid_request" || msgLower.includes("invalid_grant");
+    const isTerminalStatus = status === 400 || status === 401 || status === 403;
+    return { message, status, errorCode, isInvalidGrant, isTerminalStatus };
+  }
+
   /**
    * Refresh a specific account token with single-flight protection.
    * Prevents concurrent refresh races from disabling healthy accounts.
    * @param {import('./lib/accounts.mjs').ManagedAccount} account
+   * @param {"foreground" | "idle"} [source]
    * @returns {Promise<string>}
    */
-  async function refreshAccountTokenSingleFlight(account) {
+  async function refreshAccountTokenSingleFlight(account, source = "foreground") {
     const key = account.id;
     const existing = refreshInFlight.get(key);
-    if (existing) return existing;
+    if (existing) {
+      // Foreground requests should not directly inherit idle refresh failures.
+      // Wait for idle maintenance to finish, then re-evaluate token state.
+      if (source === "foreground" && existing.source === "idle") {
+        try {
+          await existing.promise;
+        } catch {
+          // Ignore idle failure here; foreground path handles refresh decisions.
+        }
+
+        if (account.access && account.expires && account.expires > Date.now()) {
+          return account.access;
+        }
+      } else {
+        return existing.promise;
+      }
+    }
 
+    /** @type {{ promise: Promise<string>, source: "foreground" | "idle" }} */
+    const entry = { source, promise: Promise.resolve("") };
     const p = (async () => {
       try {
-        return await refreshAccountToken(account, client);
+        return await refreshAccountToken(account, client, source);
       } finally {
-        if (refreshInFlight.get(key) === p) {
+        if (refreshInFlight.get(key) === entry) {
           refreshInFlight.delete(key);
         }
       }
     })();
 
-    refreshInFlight.set(key, p);
+    entry.promise = p;
+    refreshInFlight.set(key, entry);
     return p;
   }
 
+  /**
+   * Refresh one idle (non-active) account in the background.
+   * Best-effort only: never disables accounts from background maintenance.
+   * @param {import('./lib/accounts.mjs').ManagedAccount} account
+   * @returns {Promise<void>}
+   */
+  async function refreshIdleAccount(account) {
+    if (!accountManager) return;
+    if (idleRefreshInFlight.has(account.id)) return;
+
+    idleRefreshInFlight.add(account.id);
+    const attemptedRefreshToken = account.refreshToken;
+
+    try {
+      try {
+        await refreshAccountTokenSingleFlight(account, "idle");
+        accountManager.requestSaveToDisk();
+        return;
+      } catch (err) {
+        let details = parseRefreshFailure(err);
+
+        if (!(details.isInvalidGrant || details.isTerminalStatus)) {
+          debugLog("idle refresh skipped after transient failure", {
+            accountIndex: account.index,
+            status: details.status,
+            errorCode: details.errorCode,
+            message: details.message,
+          });
+          return;
+        }
+
+        const diskAuth = await readDiskAccountAuth(account.id);
+        const retryToken = diskAuth?.refreshToken;
+        if (retryToken && retryToken !== attemptedRefreshToken && account.refreshToken === attemptedRefreshToken) {
+          account.refreshToken = retryToken;
+          if (diskAuth?.tokenUpdatedAt) {
+            account.tokenUpdatedAt = diskAuth.tokenUpdatedAt;
+          } else {
+            markTokenStateUpdated(account);
+          }
+        }
+
+        try {
+          await refreshAccountTokenSingleFlight(account, "idle");
+          accountManager.requestSaveToDisk();
+          return;
+        } catch (retryErr) {
+          details = parseRefreshFailure(retryErr);
+          debugLog("idle refresh retry failed", {
+            accountIndex: account.index,
+            status: details.status,
+            errorCode: details.errorCode,
+            message: details.message,
+          });
+          return;
+        }
+      }
+    } finally {
+      idleRefreshInFlight.delete(account.id);
+    }
+  }
+
+  /**
+   * Opportunistically refresh one near-expiry idle account in background.
+   * Runs during normal requests so inactive accounts stay healthy.
+   * @param {import('./lib/accounts.mjs').ManagedAccount} activeAccount
+   */
+  function maybeRefreshIdleAccounts(activeAccount) {
+    if (!IDLE_REFRESH_ENABLED || !accountManager) return;
+
+    const now = Date.now();
+    const excluded = new Set([activeAccount.index]);
+    const candidates = accountManager
+      .getEnabledAccounts(excluded)
+      .filter((acc) => !acc.expires || acc.expires <= now + IDLE_REFRESH_WINDOW_MS)
+      .filter((acc) => {
+        const last = idleRefreshLastAttempt.get(acc.id) ?? 0;
+        return now - last >= IDLE_REFRESH_MIN_INTERVAL_MS;
+      })
+      .sort((a, b) => (a.expires ?? 0) - (b.expires ?? 0));
+
+    const target = candidates[0];
+    if (!target) return;
+
+    idleRefreshLastAttempt.set(target.id, now);
+    void refreshIdleAccount(target);
+  }
+
   return {
     // A1-A4: System prompt transform (unchanged)
     "experimental.chat.system.transform": (input, output) => {
@@ -1836,7 +2156,11 @@ export async function AnthropicAuthPlugin({ client }) {
             // Override context limits for 1M-window models so OpenCode
             // triggers compaction at the right threshold instead of relying
             // on potentially stale models.dev data.
-            if (config.override_model_limits.enabled && (hasOneMillionContext(model.id) || isOpus46Model(model.id))) {
+            if (
+              config.override_model_limits.enabled &&
+              !isTruthyEnv(process.env.CLAUDE_CODE_DISABLE_1M_CONTEXT) &&
+              (hasOneMillionContext(model.id) || isOpus46Model(model.id))
+            ) {
               model.limit = {
                 ...(model.limit ?? {}),
                 context: config.override_model_limits.context,
@@ -1925,42 +2249,92 @@ export async function AnthropicAuthPlugin({ client }) {
                 let accessToken;
                 // Per-account token refresh
                 if (!account.access || !account.expires || account.expires < Date.now()) {
+                  const attemptedRefreshToken = account.refreshToken;
                   try {
                     accessToken = await refreshAccountTokenSingleFlight(account);
                     // Persist updated tokens (especially if refresh token rotated)
                     accountManager.requestSaveToDisk();
                   } catch (err) {
-                    // Token refresh failed — mark account as failed
-                    accountManager.markFailure(account);
-                    // Disable account on terminal refresh errors
-                    const msg = err instanceof Error ? err.message : String(err);
-                    const status = typeof err === "object" && err && "status" in err ? Number(err.status) : NaN;
-                    const errorCode =
-                      typeof err === "object" && err && "errorCode" in err ? String(err.errorCode || "") : "";
-                    const shouldDisable =
-                      status === 400 ||
-                      status === 401 ||
-                      status === 403 ||
-                      errorCode === "invalid_grant" ||
-                      errorCode === "invalid_request" ||
-                      msg.includes("invalid_grant");
-
-                    if (shouldDisable) {
-                      account.enabled = false;
-                      accountManager.requestSaveToDisk();
-                      const name = account.email || `Account ${accountManager.getCurrentIndex() + 1}`;
-                      await toast(`Disabled ${name} (token refresh failed)`, "error");
-                    } else {
-                      // Skip this account for the remainder of this request.
-                      transientRefreshSkips.add(account.index);
+                    // Token refresh failed — check if another instance rotated the
+                    // refresh token and persisted it between attempts.
+                    let finalError = err;
+                    let details = parseRefreshFailure(err);
+
+                    // Belt-and-suspenders retry: on terminal/invalid_grant failures,
+                    // always re-read disk token and retry once before disabling.
+                    if (details.isInvalidGrant || details.isTerminalStatus) {
+                      const diskAuth = await readDiskAccountAuth(account.id);
+                      const retryToken = diskAuth?.refreshToken;
+                      if (
+                        retryToken &&
+                        retryToken !== attemptedRefreshToken &&
+                        account.refreshToken === attemptedRefreshToken
+                      ) {
+                        debugLog("refresh token on disk differs from in-memory, retrying with disk token", {
+                          accountIndex: account.index,
+                        });
+                        account.refreshToken = retryToken;
+                        if (diskAuth?.tokenUpdatedAt) {
+                          account.tokenUpdatedAt = diskAuth.tokenUpdatedAt;
+                        } else {
+                          markTokenStateUpdated(account);
+                        }
+                      } else if (retryToken && retryToken !== attemptedRefreshToken) {
+                        debugLog("skipping disk token adoption because in-memory token already changed", {
+                          accountIndex: account.index,
+                        });
+                      }
+
+                      try {
+                        accessToken = await refreshAccountTokenSingleFlight(account);
+                        accountManager.requestSaveToDisk();
+                      } catch (retryErr) {
+                        finalError = retryErr;
+                        details = parseRefreshFailure(retryErr);
+                        debugLog("retry refresh failed", {
+                          accountIndex: account.index,
+                          status: details.status,
+                          errorCode: details.errorCode,
+                          message: details.message,
+                        });
+                      }
+                    }
+
+                    if (!accessToken) {
+                      accountManager.markFailure(account);
+
+                      if (details.isInvalidGrant || details.isTerminalStatus) {
+                        const name = account.email || `Account ${accountManager.getCurrentIndex() + 1}`;
+                        debugLog("disabling account after terminal refresh failure", {
+                          accountIndex: account.index,
+                          status: details.status,
+                          errorCode: details.errorCode,
+                          message: details.message,
+                        });
+                        account.enabled = false;
+                        accountManager.requestSaveToDisk();
+                        const statusLabel = Number.isFinite(details.status)
+                          ? `HTTP ${details.status}`
+                          : "unknown status";
+                        await toast(
+                          `Disabled ${name} (token refresh failed: ${details.errorCode || statusLabel})`,
+                          "error",
+                        );
+                      } else {
+                        // Skip this account for the remainder of this request.
+                        transientRefreshSkips.add(account.index);
+                      }
+                      lastError = finalError;
+                      continue; // Try next account
                     }
-                    lastError = err;
-                    continue; // Try next account
                   }
                 } else {
                   accessToken = account.access;
                 }
 
+                // Keep non-active accounts warm without blocking the request.
+                maybeRefreshIdleAccounts(account);
+
                 const body = transformRequestBody(
                   requestInit.body,
                   {
@@ -2025,6 +2399,7 @@ export async function AnthropicAuthPlugin({ client }) {
                     if (reason === "AUTH_FAILED") {
                       account.access = undefined;
                       account.expires = undefined;
+                      markTokenStateUpdated(account);
                     }
 
                     debugLog("account-specific error, switching account", {
@@ -2077,6 +2452,7 @@ export async function AnthropicAuthPlugin({ client }) {
                       if (details.invalidateToken) {
                         account.access = undefined;
                         account.expires = undefined;
+                        markTokenStateUpdated(account);
                       }
                       accountManager.markRateLimited(account, details.reason, null);
                     }