opencode-auth-load-balancer 0.3.0 → 0.4.1

package/dist/notify.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderRecovery } from './pending/recovery';
 import type { PoolAccount } from './types';
 /** The slice of the opencode SDK client we need to show a toast. */
 export interface ToastClient {
@@ -45,3 +46,10 @@ export declare function notifyOnSwitch(client: ToastClient, providerID: string,
  * toast never affects the request.
  */
 export declare function notifyModelFallback(client: ToastClient, providerID: string, account: PoolAccount, fromModel: string, toModel: string, fromTier?: string): Promise<void>;
+/** Announce a durable provider wait. Coordinator-level signatures dedupe it. */
+export declare function notifyPending(client: ToastClient, providerID: string, recovery: Extract<ProviderRecovery, {
+    state: 'quota-blocked';
+}>, now?: number): Promise<void>;
+export declare function notifyPendingResumed(client: ToastClient, providerID: string): Promise<void>;
+export declare function notifyPendingRestored(client: ToastClient, providerID: string, count: number): Promise<void>;
+export declare function notifyPendingRestoreError(client: ToastClient, providerID: string, messageID: string): Promise<void>;

package/dist/pending/coordinator.d.ts

@@ -0,0 +1,135 @@
+import type { LockHandle } from '../pool/lock';
+import type { ProviderAdapter } from '../providers/types';
+import type { SchedulerConfig } from '../scheduler/config';
+import type { PoolFile } from '../types';
+import { type ProviderRecovery } from './recovery';
+import type { PendingRef, PendingSchedule, PendingTurn } from './types';
+export type CapacityWaitResult = 'available' | 'unusable';
+interface RestoreUserMessage {
+    id: string;
+    sessionID: string;
+    role: 'user';
+    agent: string;
+    model: {
+        providerID: string;
+        modelID: string;
+    };
+    system?: string;
+    tools?: Record<string, boolean>;
+}
+interface RestoreAssistantMessage {
+    id: string;
+    sessionID: string;
+    role: 'assistant';
+    parentID: string;
+    finish?: string;
+    error?: unknown;
+}
+type RestoreMessage = RestoreUserMessage | RestoreAssistantMessage;
+interface RestoreResult<T> {
+    data?: T;
+    error?: unknown;
+    response?: {
+        status: number;
+    };
+}
+interface RestoreReadOptions {
+    path: {
+        id: string;
+        messageID: string;
+    };
+    query: {
+        directory: string;
+    };
+}
+interface RestoreSessionOptions {
+    path: {
+        id: string;
+    };
+    query: {
+        directory: string;
+    };
+}
+interface RestorePromptOptions extends RestoreSessionOptions {
+    body: {
+        messageID: string;
+        model: {
+            providerID: string;
+            modelID: string;
+        };
+        agent: string;
+        system?: string;
+        tools?: Record<string, boolean>;
+        parts: [];
+    };
+}
+export interface PendingRestoreClient {
+    session: {
+        message(options: RestoreReadOptions): Promise<RestoreResult<{
+            info: RestoreMessage;
+            parts: unknown[];
+        }>>;
+        messages(options: RestoreSessionOptions): Promise<RestoreResult<{
+            info: RestoreMessage;
+            parts: unknown[];
+        }[]>>;
+        prompt(options: RestorePromptOptions): Promise<RestoreResult<unknown>>;
+    };
+}
+export interface PendingCoordinatorDependencies {
+    now(): number;
+    sleep(ms: number, signal?: AbortSignal): Promise<void>;
+    readPool(): Promise<PoolFile>;
+    refreshUsage(now: number): Promise<void>;
+    upsert(ref: PendingRef, schedule: PendingSchedule): Promise<PendingTurn>;
+    remove(ref: PendingRef | string): Promise<boolean>;
+    acquireLease(key: string): Promise<LockHandle>;
+    list(workspace: string, providerID?: string): Promise<PendingTurn[]>;
+    removeSession(workspace: string, sessionID: string): Promise<number>;
+    onPending(ref: PendingRef, recovery: Extract<ProviderRecovery, {
+        state: 'quota-blocked';
+    }>): Promise<void> | void;
+    onResumed(ref: PendingRef): Promise<void> | void;
+    onRestored(count: number): Promise<void> | void;
+    onRestoreError(ref: PendingRef, error: unknown): Promise<void> | void;
+}
+export interface PendingCoordinatorOptions {
+    workspace: string;
+    adapter: ProviderAdapter;
+    config: SchedulerConfig;
+    dependencies?: Partial<PendingCoordinatorDependencies>;
+}
+export declare class PendingCoordinator {
+    readonly workspace: string;
+    readonly providerID: string;
+    private readonly adapter;
+    private readonly config;
+    private readonly dependencies;
+    private readonly leases;
+    private readonly acquiring;
+    private readonly active;
+    private readonly restoring;
+    private readonly pendingToasts;
+    private disposing;
+    constructor(options: PendingCoordinatorOptions);
+    private ensureLease;
+    private releaseLease;
+    private notifyPending;
+    private clear;
+    waitForCapacity(ref: PendingRef, initial: Extract<ProviderRecovery, {
+        state: 'quota-blocked';
+    }>, outerSignal?: AbortSignal): Promise<CapacityWaitResult>;
+    /** Remove a completed/terminal turn and release any execution lease it owns. */
+    complete(ref: PendingRef): Promise<void>;
+    /** Explicit user cancellation removes durable state; shutdown preserves it. */
+    abort(ref: PendingRef): Promise<void>;
+    private restoreOnce;
+    private restoreWithRetry;
+    /** Restore this workspace/provider's durable references independently. */
+    restore(client: PendingRestoreClient): Promise<void>;
+    /** Remove all pending providers for a deleted session in this workspace. */
+    removeSession(sessionID: string): Promise<number>;
+    /** Mark shutdown before aborting sleepers so their abort path preserves rows. */
+    dispose(): Promise<void>;
+}
+export {};

package/dist/pending/lease.d.ts

@@ -0,0 +1,3 @@
+import { type LockHandle, type LockOptions } from '../pool/lock';
+export declare function pendingLeasePath(key: string): string;
+export declare function acquirePendingLease(key: string, options?: LockOptions): Promise<LockHandle>;

package/dist/pending/recovery.d.ts

@@ -0,0 +1,16 @@
+import type { ScoreConfig } from '../scheduler/score-core';
+import type { PoolAccount } from '../types';
+export type ProviderRecovery = {
+    state: 'available';
+} | {
+    state: 'quota-blocked';
+    nextCheckAt: number;
+    resumeAt: number | null;
+} | {
+    state: 'unusable';
+};
+/**
+ * Determine whether a provider can serve now, is provably blocked only by
+ * account-wide quota, or has no account that waiting for quota can repair.
+ */
+export declare function classifyProviderRecovery(accounts: readonly PoolAccount[], providerID: string, cfg: Pick<ScoreConfig, 'exhaustedAt'>, now: number, pollMs: number): ProviderRecovery;

package/dist/pending/store.d.ts

@@ -0,0 +1,12 @@
+import type { PendingFile, PendingRef, PendingSchedule, PendingTurn } from './types';
+export declare class PendingReadError extends Error {
+    readonly path: string;
+    readonly reason: unknown;
+    constructor(path: string, reason: unknown);
+}
+export declare function pendingKey(ref: PendingRef): string;
+export declare function readPending(): Promise<PendingFile>;
+export declare function upsertPending(ref: PendingRef, schedule: PendingSchedule): Promise<PendingTurn>;
+export declare function removePending(refOrKey: PendingRef | string): Promise<boolean>;
+export declare function removePendingSession(workspace: string, sessionID: string): Promise<number>;
+export declare function listPendingForWorkspace(workspace: string, providerID?: string): Promise<PendingTurn[]>;

package/dist/pending/types.d.ts

@@ -0,0 +1,23 @@
+export interface PendingRef {
+    workspace: string;
+    providerID: string;
+    sessionID: string;
+    messageID: string;
+}
+/** Durable scheduling metadata. Prompt content remains owned by OpenCode. */
+export interface PendingTurn extends PendingRef {
+    key: string;
+    createdAt: number;
+    updatedAt: number;
+    nextCheckAt: number;
+    resumeAt: number | null;
+}
+export interface PendingFile {
+    version: 1;
+    turns: PendingTurn[];
+}
+export interface PendingSchedule {
+    now: number;
+    nextCheckAt: number;
+    resumeAt: number | null;
+}

package/dist/pool/lock.d.ts

@@ -25,7 +25,7 @@ export interface LockOptions {
     /** Re-touch the held lock this often so a live holder never looks stale. */
     readonly heartbeatMs: number;
 }
-interface LockHandle {
+export interface LockHandle {
     release(): Promise<void>;
 }
 export declare class LockTimeoutError extends Error {
@@ -36,4 +36,3 @@ export declare class LockTimeoutError extends Error {
 export declare function acquireLock(lockDir: string, opts: LockOptions): Promise<LockHandle>;
 /** Run `fn` while holding `lockDir`, releasing it even if `fn` throws. */
 export declare function withLock<T>(lockDir: string, opts: LockOptions, fn: () => Promise<T>): Promise<T>;
-export {};

package/dist/pool/paths.d.ts

@@ -13,4 +13,15 @@ interface DataDirEnv {
 export declare function resolveDataDir(env: DataDirEnv, home: string): string;
 /** Path to the load-balancer's credential pool file. */
 export declare function poolFilePath(): string;
+/** Path to the reference-only durable pending-turn file. */
+export declare function pendingFilePath(): string;
+/**
+ * Path to the cached Claude Code version discovered from the npm registry
+ * (see `providers/anthropic/version.ts`). A THIRD file rather than a field in
+ * the pool: the pool's every read-modify-write takes a cross-process lock, and
+ * this cache is a best-effort, provider-owned scratch value that must never
+ * contend with — let alone fail — a credential/usage write. Same data dir and
+ * same env-keyed memo as the two files above.
+ */
+export declare function versionCacheFilePath(): string;
 export {};

package/dist/providers/anthropic/constants.d.ts

@@ -53,15 +53,82 @@ export declare const OPENCODE_IDENTITY_PREFIX = "You are OpenCode";
 export declare const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
 export declare const CCH_SALT = "59cf53e54c78";
 export declare const CCH_POSITIONS: number[];
-export declare const CLAUDE_CODE_VERSION = "2.1.87";
 export declare const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
-/** User-Agent for /v1/messages (matches the reference plugin's validated value). */
-export declare const USER_AGENT = "claude-cli/2.1.87 (external, cli)";
 /**
- * User-Agent for the /api/oauth/usage endpoint. This endpoint hard-rejects
- * (429) requests whose UA is not `claude-code/<version>`.
+ * Version used when nothing better is known — the floor the resolver in
+ * `version.ts` never goes below.
+ *
+ * Anthropic GATES NEW MODELS ON THE CLIENT VERSION we report (in the
+ * `claude-cli/<version>` UA and the `cc_version=` billing header): requesting a
+ * too-new model with a too-old version is rejected outright with
+ * `{"error_code":"claude_code_version_too_old"}` — e.g. `claude-fable-5-1`
+ * requires ≥ 2.1.251. A hard-pinned constant therefore BREAKS on every future
+ * model launch, which is why the live value is resolved from the npm registry
+ * (`version.ts`) and this is only the offline floor.
+ *
+ * Verified against the real API: `claude-fable-5-1` returns 400
+ * (`claude_code_version_too_old`) at `2.1.87` and 200 at this value, using the
+ * SAME `CCH_SALT`/`CCH_POSITIONS` above — the fingerprint algorithm did not
+ * change across that range, so bumping the version string alone is sufficient.
+ * Keep this at a version confirmed to work; the resolver only ever moves UP
+ * from here.
  */
-export declare const USAGE_USER_AGENT = "claude-code/2.1.87";
+export declare const FALLBACK_CLAUDE_CODE_VERSION = "2.1.258";
+/**
+ * Pin the reported Claude Code version explicitly, bypassing BOTH the npm
+ * lookup and the `FALLBACK_CLAUDE_CODE_VERSION` floor — the escape hatch for
+ * the two directions the resolver cannot guess: pinning FORWARD to a version
+ * npm has not tagged `latest` yet, or pinning BACK (e.g. to reproduce this
+ * `claude_code_version_too_old` failure, or if a future release changes the
+ * `cch` fingerprint algorithm and the newest version starts 400ing).
+ */
+export declare const CLAUDE_CODE_VERSION_ENV = "OPENCODE_AUTH_LB_ANTHROPIC_CLAUDE_CODE_VERSION";
+/**
+ * The structured error code Anthropic answers a version-gated model with:
+ *
+ * ```json
+ * {"type":"error","error":{"type":"invalid_request_error",
+ *  "message":"Claude Code 2.1.278 does not support this model; version 2.1.280 or newer is required.",
+ *  "details":{"error_code":"claude_code_version_too_old"}}}
+ * ```
+ *
+ * Matched as a SUBSTRING of the raw body rather than through a parsed path
+ * (`error.details.error_code`): the envelope's shape is Anthropic's to change,
+ * and this string appearing anywhere in a rejection is both sufficient — no
+ * other error carries it — and immune to a reshuffle that would silently break
+ * a path lookup. See `recoverClaudeCodeVersion` in version.ts.
+ */
+export declare const CLAUDE_CODE_VERSION_GATE_CODE = "claude_code_version_too_old";
+/**
+ * The MINIMUM version that rejection's human-readable message demands.
+ *
+ * Anchored on the `or newer is required` tail rather than the first version in
+ * the string, because the message names TWO: the one we just sent ("Claude
+ * Code 2.1.278 does not support this model") and the one being asked for
+ * ("version 2.1.280 or newer is required"). Capturing the leading one would
+ * adopt the version that just failed — a no-op the recovery would correctly
+ * refuse to retry, i.e. a silent regression to the old stuck behavior.
+ */
+export declare const CLAUDE_CODE_REQUIRED_VERSION_RE: RegExp;
+/**
+ * npm dist-tags for the Claude Code CLI — `{"latest":"2.1.258",…}`, ~56 bytes.
+ * Deliberately NOT `/@anthropic-ai/claude-code/latest`, which returns the whole
+ * 3.3 KB version packument for the one field we read.
+ */
+export declare const CLAUDE_CODE_REGISTRY_URL = "https://registry.npmjs.org/-/package/@anthropic-ai%2Fclaude-code/dist-tags";
+/**
+ * How long a registry answer stays authoritative on disk. Claude Code ships
+ * roughly daily, and a stale-by-a-day version only matters on the day a new
+ * model launches — so a day-long TTL keeps startup network-free almost always
+ * while still converging well inside the window that matters.
+ */
+export declare const CLAUDE_CODE_VERSION_TTL_MS: number;
+/**
+ * Bound the registry lookup. Shorter than the 30 s OAuth/usage budgets because
+ * nothing waits on this: it runs fire-and-forget at startup and a miss simply
+ * leaves the previous (cached or fallback) version in place.
+ */
+export declare const REGISTRY_HTTP_TIMEOUT_MS = 10000;
 export declare const PARAGRAPH_REMOVAL_ANCHORS: string[];
 export declare const TEXT_REPLACEMENTS: {
     match: string;

package/dist/providers/anthropic/version.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The version to report right now. Reads the env override on every call (like
+ * `resolveBaseUrl`/`poolFilePath` do for theirs) so a pin takes effect without
+ * a restart.
+ */
+export declare function claudeCodeVersion(): string;
+/** User-Agent for /v1/messages. */
+export declare function userAgent(): string;
+/**
+ * User-Agent for the /api/oauth/usage endpoint. That endpoint hard-rejects
+ * (429) requests whose UA is not `claude-code/<version>` — note the different
+ * product token and the absence of the ` (external, cli)` suffix.
+ */
+export declare function usageUserAgent(): string;
+/**
+ * Ask npm for the newest Claude Code, adopt it if newer, and persist the
+ * result. Best-effort throughout: a registry outage, a shape change, or an
+ * unwritable data dir all leave the in-memory version untouched and simply
+ * defer the next attempt to the next startup (the cache is written only on a
+ * usable answer, so a failure does NOT refresh the TTL).
+ */
+export declare function refreshClaudeCodeVersion(now: number): Promise<void>;
+/**
+ * REACTIVE recovery, driven by the gate's own rejection.
+ *
+ * `primeClaudeCodeVersion` resolves once at startup and then trusts the cache
+ * for `CLAUDE_CODE_VERSION_TTL_MS`. A model that launches INSIDE that window is
+ * therefore rejected for as long as the TTL has left to run — up to a full day
+ * of hard failures — even when npm already tags the version Anthropic is asking
+ * for, and even though the rejection itself NAMES that version. No polling
+ * cadence fixes this in general either: Anthropic can gate a model before npm
+ * tags the release, which is why the env pin exists as a manual escape hatch.
+ *
+ * So learn from the rejection instead. Adopt the minimum it demands, then ask
+ * npm for the real `latest` in the same breath — the minimum only clears the
+ * model that just failed, whereas `latest` is what the NEXT launch will want.
+ *
+ * Returns whether the reported version actually MOVED, which is precisely the
+ * condition under which a retry can succeed; the caller spends a second
+ * round-trip on true and passes the rejection through untouched on false.
+ * `res` is consumed, so callers that still need the body must pass a clone.
+ */
+export declare function recoverClaudeCodeVersion(res: Response, now: number): Promise<boolean>;
+/**
+ * Startup hook. Awaits only the LOCAL cache read — cheap, and enough to have
+ * the right version in hand before the loader returns the fetch — then leaves
+ * any registry round-trip running in the background so neither opencode's
+ * startup nor the first request ever blocks on npm.
+ */
+export declare function primeClaudeCodeVersion(now: number): Promise<void>;

package/dist/providers/types.d.ts

@@ -97,6 +97,19 @@ export interface ProviderAdapter {
     fetchUsage(account: PoolAccount, now: number): Promise<UsageSnapshot | null>;
     /** Classify an HTTP status for rotation decisions. */
     classifyError(status: number): ErrorClass;
+    /**
+     * One-time startup warm-up, awaited by the auth loader BEFORE it returns the
+     * load-balanced fetch — so anything a request's shaping depends on is in
+     * place before the first request is served. Anthropic uses it to resolve the
+     * Claude Code version it must claim (Anthropic gates new models on it; see
+     * `providers/anthropic/version.ts`); OpenAI leaves it unset, and the loader
+     * treats an absent hook as "nothing to warm up".
+     *
+     * MUST stay cheap and MUST NOT throw — it sits on opencode's startup path.
+     * Implementations do local I/O only and push anything network-bound into the
+     * background themselves.
+     */
+    prime?(now: number): Promise<void>;
     /**
      * The model TIER `body` asks for (the `modelCooldownsUntil` key the fetch
      * loop consults BEFORE sending, to steer the request onto an account with
@@ -123,4 +136,24 @@ export interface ProviderAdapter {
      * downgraded body. null = treat the 429 as a normal account rotation.
      */
     planReactiveFallback?(res: Response, body: string, now: number, models: readonly string[]): ReactiveModelFallback | null;
+    /**
+     * REACTIVE recovery from a CLIENT-VERSION gate: a provider may reject an
+     * otherwise-valid request until the plugin claims to be a newer client
+     * (Anthropic answers a too-new model with 400 `claude_code_version_too_old`,
+     * naming the minimum it wants). Such a status classifies as `ok` — the fetch
+     * loop is one statement away from handing it to the caller — so this is the
+     * last point at which it can become a recoverable event instead of a failed
+     * turn.
+     *
+     * Return true ONLY when the version the adapter will now report actually
+     * changed: the fetch loop reads that as "a retry can succeed" and restarts
+     * the request once. Returning true without a change would buy a second,
+     * byte-identical round-trip and the same rejection.
+     *
+     * `res` is a CLONE the implementation may consume freely; the original is
+     * still returned to the caller when this resolves false. Absent on providers
+     * with no such gate (OpenAI) — the fetch loop treats that as "nothing to
+     * recover".
+     */
+    recoverClientVersion?(res: Response, now: number): Promise<boolean>;
 }

package/dist/providers/usage-http.d.ts

@@ -1,8 +1,9 @@
 /**
- * Shared HTTP shell for the provider usage endpoints (Anthropic `/usage`,
- * OpenAI `/wham/usage`): GET with a timeout, null on ANY failure — network
- * throw/timeout, non-ok status (body cancelled so the connection is released),
- * or a 200 whose body is not JSON. Providers keep only their own headers,
- * shape guards, and window mapping; the transport contract lives here ONCE.
+ * Shared HTTP shell for the plugin's read-only JSON GETs — the provider usage
+ * endpoints (Anthropic `/usage`, OpenAI `/wham/usage`) and the npm dist-tags
+ * lookup behind `providers/anthropic/version.ts`. GET with a timeout, null on
+ * ANY failure — network throw/timeout, non-ok status (body cancelled so the
+ * connection is released), or a 200 whose body is not JSON. Callers keep only
+ * their own headers and shape guards; the transport contract lives here ONCE.
  */
-export declare function fetchUsageJson<T>(url: string, headers: Record<string, string>, timeoutMs: number): Promise<T | null>;
+export declare function fetchJson<T>(url: string, headers: Record<string, string>, timeoutMs: number): Promise<T | null>;

package/dist/session.d.ts

@@ -4,6 +4,8 @@
  * fetch. Stripped before the request leaves for the provider.
  */
 export declare const SESSION_HEADER = "x-allb-session";
+/** OpenCode user-message id paired with SESSION_HEADER for durable turn identity. */
+export declare const MESSAGE_HEADER = "x-allb-message";
 /**
  * Derive a stable key identifying the conversation a request belongs to.
  *

package/dist/status.d.ts

@@ -1,3 +1,4 @@
+import type { PendingTurn } from './pending/types';
 import { type SchedulerConfig } from './scheduler/config';
 import { type PoolFile } from './types';
 interface AccountStatus {
@@ -50,6 +51,8 @@ export declare function pct(u: number | null | undefined): string;
  */
 export declare function displayWidth(s: string): number;
 export declare function providerName(providerID: string): string;
+/** Compact workspace-scoped pending summary appended by `auth_lb_status`. */
+export declare function renderPendingStatus(turns: readonly PendingTurn[], now?: number): string;
 /** Render the status model as a compact text dashboard (for tools/commands/CLI). */
 export declare function renderStatus(providers: ProviderStatus[], now?: number): string;
 export {};

package/dist/types.d.ts

@@ -35,6 +35,7 @@ export interface TokenSet {
     accountId?: string;
 }
 /** One pooled credential. */
+export type CooldownKind = 'quota' | 'auth' | 'transient';
 export interface PoolAccount {
     /** Stable internal id (uuid). */
     id: string;
@@ -58,6 +59,8 @@ export interface PoolAccount {
     usage: UsageSnapshot;
     /** epoch ms; the account is skipped until this time. 0 = no cooldown. */
     cooldownUntil: number;
+    /** Why the active account-wide cooldown was written. Absent on legacy rows. */
+    cooldownKind?: CooldownKind;
     /**
      * Per MODEL-TIER cooldowns: tier name (e.g. "opus", "fable") → epoch ms until
      * that tier's separate weekly cap resets. While an entry is `> now`, requests

package/dist/usage-refresh.d.ts

@@ -1,5 +1,6 @@
 import type { ProviderAdapter } from './providers/types';
 import type { PoolFile } from './types';
+export declare const USAGE_REFRESH_TTL_MS: number;
 /**
  * Max lifetime of a TRANSIENT (non-quota) cooldown. fetch.ts cools a thrown
  * network error or a header-less 429/402 for at most `ACCOUNT_COOLDOWN_MS`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-auth-load-balancer",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Load-balance opencode requests across multiple Anthropic (Claude) and OpenAI (Codex) OAuth accounts, weighted primarily by weekly usage with drain-before-reset scheduling.",
   "type": "module",
   "license": "MIT",
@@ -41,18 +41,18 @@
     "prepare": "husky"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": ">=1.17.18"
+    "@opencode-ai/plugin": ">=1.18.26"
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "^1.17.18",
-    "@opentui/core": "0.4.3",
-    "@opentui/solid": "0.4.3",
-    "@types/bun": "^1.3.14",
-    "@types/node": "^26.1.1",
-    "eslint-plugin-devup": "^2.0.19",
+    "@opencode-ai/plugin": "^1.18.26",
+    "@opentui/core": "0.5.10",
+    "@opentui/solid": "0.5.10",
+    "@types/bun": "^1.4.0",
+    "@types/node": "^26.4.1",
+    "eslint-plugin-devup": "^2.1.0",
     "husky": "^9.1",
-    "oxlint": "1.73",
-    "solid-js": "1.9.14",
+    "oxlint": "1.81",
+    "solid-js": "1.9.15",
     "typescript": "^7.0.2"
   },
   "keywords": [

package/tui/auth-load-balancer-tui.logic.ts

@@ -242,10 +242,18 @@ export const MANUAL_DISABLED_REASON = 'manually disabled'
  */
 export const RELOGIN_TTL_MS = 600_000
 
+/**
+ * `now` DEFAULTS to the wall clock so the view can fire this without reading
+ * the clock itself: the call sits in an async re-login handler, and a bare
+ * `Date.now()` written inside a component body is flagged by `react(purity)`
+ * even on a non-render path the rule cannot distinguish. Tests still pass an
+ * explicit `now` — stamping the TTL from an injectable instant is what keeps
+ * the expiry assertion deterministic.
+ */
 export function setReloginTargetInPool(
   accountId: string,
   providerID: string,
-  now: number,
+  now: number = Date.now(),
   path: string = POOL_FILE,
 ): void {
   mutatePoolFile((pool) => {

package/tui/auth-load-balancer-tui.view.tsx

@@ -82,11 +82,33 @@ function routeSessionId(api: TuiPluginApi): string | undefined {
 // shared with auth-load-balancer-tui.logic.ts (imported above as `cfg`) so it is
 // computed exactly once.
 
+/** One poll sample: the pool, plus the instant it was read. */
+interface PoolSample {
+  pool: PoolShape
+  now: number
+}
+
+/**
+ * Capture the pool AND the clock together, beside each other.
+ *
+ * The timestamp deliberately lives HERE rather than in each consuming memo.
+ * A memo that calls `Date.now()` itself is impure — it depends on something
+ * Solid cannot track, so its countdowns refresh only by the coincidence that
+ * the poll signal happens to change on the same tick — and it measures every
+ * `until()` against an instant slightly LATER than the snapshot it is
+ * describing. Sampling both at once makes the memos pure functions of one
+ * reactive input and keeps each countdown consistent with the pool state it
+ * is rendered from.
+ */
+function pollSample(): PoolSample {
+  return { pool: readPool(), now: Date.now() }
+}
+
 function usePool() {
-  const [pool, setPool] = createSignal<PoolShape>(readPool())
-  const timer = setInterval(() => setPool(readPool()), POLL_MS)
+  const [sample, setSample] = createSignal<PoolSample>(pollSample())
+  const timer = setInterval(() => setSample(pollSample()), POLL_MS)
   onCleanup(() => clearInterval(timer))
-  return pool
+  return sample
 }
 
 /** Shared theme-color accessor used identically by `BottomBar` and `SidebarPanel`. */
@@ -111,12 +133,11 @@ interface Chip extends WindowDisplay {
 
 /** Always-visible bottom bar (app_bottom): the in-use account per provider. */
 function BottomBar(props: { api: TuiPluginApi }) {
-  const pool = usePool()
+  const sample = usePool()
   const color = themeColor(props.api)
   const chips = createMemo<Chip[]>(() => {
-    const p = pool()
+    const { pool: p, now } = sample()
     const accounts = p.accounts ?? []
-    const now = Date.now()
     const out: Chip[] = []
     const sid = routeSessionId(props.api)
     // Show the account THIS session is using per provider — NOT the global
@@ -190,12 +211,11 @@ function SidebarPanel(props: {
   api: TuiPluginApi
   sessionId: string | undefined
 }) {
-  const pool = usePool()
+  const sample = usePool()
   const color = themeColor(props.api)
   const groups = createMemo<Group[]>(() => {
-    const p = pool()
+    const { pool: p, now } = sample()
     const accounts = p.accounts ?? []
-    const now = Date.now()
     const providerIds = [...new Set(accounts.map((a) => a.providerID))].sort(
       compareAscii,
     )
@@ -314,7 +334,8 @@ function SidebarPanel(props: {
         return
       }
 
-      setReloginTargetInPool(id, providerID, Date.now())
+      // Timestamp intentionally left to the callee's default — see its doc.
+      setReloginTargetInPool(id, providerID)
 
       const completeRelogin = async (code?: string): Promise<void> => {
         try {