opencode-auth-load-balancer 0.5.1 → 0.6.0

package/dist/index.js

@@ -12337,16 +12337,64 @@ tool.schema = exports_external;
 // src/accounts.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
-// src/pool/store.ts
-import { mkdir as mkdir2, readFile as readFile2, rename, unlink, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2 } from "node:path";
-
 // src/types.ts
 function emptyUsage() {
   return { hourly: null, weekly: null, capturedAt: 0 };
 }
+var STATIC_CREDENTIAL_EXPIRES = Number.MAX_SAFE_INTEGER;
 var MANUAL_DISABLED_REASON = "manually disabled";
 
+// src/pairing.ts
+function holdsCredential(row, tokens) {
+  if (tokens.inferenceOnly)
+    return row.inferenceToken === tokens.access;
+  return !!tokens.refresh && row.refresh === tokens.refresh || !!tokens.accountId && row.accountId === tokens.accountId;
+}
+var WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+var RESET_TOLERANCE_MS = 2 * 60 * 1000;
+function resetGap(a, b, period) {
+  const d = Math.abs(a.resetAt - b.resetAt);
+  return period ? Math.min(d % period, period - d % period) : d;
+}
+function sameAccount(a, b, now) {
+  const live = (w) => w && w.resetAt > now ? w : undefined;
+  const [h1, h2] = [live(a?.hourly), live(b.hourly)];
+  if (h1 && h2 && resetGap(h1, h2, 0) > RESET_TOLERANCE_MS)
+    return false;
+  const [w1, w2] = [a?.weekly, b.weekly];
+  if (!w1?.resetAt || !w2?.resetAt)
+    return;
+  return resetGap(w1, w2, WEEK_MS) <= RESET_TOLERANCE_MS;
+}
+function orgPartner(rows, tokens) {
+  if (!tokens.orgId)
+    return;
+  const now = Date.now();
+  const candidates = rows.filter((row) => row.orgId === tokens.orgId && sameAccount(tokens.usage, row.usage, now) !== false);
+  const only = candidates.length === 1 ? candidates[0] : undefined;
+  if (!only)
+    return;
+  if (!tokens.inferenceOnly)
+    return only.refresh ? undefined : only;
+  const confirmed = sameAccount(tokens.usage, only.usage, now) === true;
+  return only.inferenceToken === undefined || tokenDead(only) || confirmed ? only : undefined;
+}
+function tokenDead(row) {
+  return !!row.disabledReason && row.disabledReason !== MANUAL_DISABLED_REASON;
+}
+function tokenSharer(rows, tokens) {
+  if (!tokens.orgId)
+    return;
+  const now = Date.now();
+  const candidates = rows.filter((row) => row.orgId === tokens.orgId && sameAccount(tokens.usage, row.usage, now) !== false);
+  const only = candidates.length === 1 ? candidates[0] : undefined;
+  return only?.inferenceToken !== undefined && !tokenDead(only) ? only : undefined;
+}
+
+// src/pool/store.ts
+import { mkdir as mkdir2, readFile as readFile2, rename, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
+
 // src/providers/http-timeouts.ts
 var OAUTH_HTTP_TIMEOUT_MS = 30000;
 var USAGE_HTTP_TIMEOUT_MS = 30000;
@@ -12389,6 +12437,19 @@ function isFiniteNumber(v) {
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function errorSummary(status, body) {
+  let detail = body;
+  try {
+    const json = JSON.parse(body);
+    if (isPlainObject2(json)) {
+      const err = json.error;
+      const parts = isPlainObject2(err) ? [err.type, err.message] : [err, json.error_description ?? json.message];
+      detail = parts.filter((part) => typeof part === "string").join(": ");
+    }
+  } catch {}
+  const line = `${status} ${detail}`.replace(/\s+/g, " ").trim();
+  return line.length > 160 ? `${line.slice(0, 159)}…` : line;
+}
 function joinBlockTexts(content, separator) {
   if (typeof content === "string")
     return content;
@@ -12582,6 +12643,30 @@ function versionCacheFilePath() {
   cachedVersion = { override, xdg, path };
   return path;
 }
+var syncPathMemo = new Map;
+function dataFilePath(file) {
+  const override = process.env.OPENCODE_AUTH_LB_DIR;
+  const xdg = process.env.XDG_DATA_HOME;
+  const key = `${override ?? ""}\x00${xdg ?? ""}`;
+  const hit = syncPathMemo.get(file);
+  if (hit?.key === key)
+    return hit.path;
+  const path = join2(resolveDataDir({ override, xdgDataHome: xdg }, homedir()), file);
+  syncPathMemo.set(file, { key, path });
+  return path;
+}
+function syncStateFilePath() {
+  return dataFilePath("auth-load-balancer-sync.json");
+}
+function syncOriginFilePath() {
+  return dataFilePath("auth-load-balancer-sync-origin.json");
+}
+function syncIntentFilePath() {
+  return dataFilePath("auth-load-balancer-sync-intent.json");
+}
+function syncStatusFilePath() {
+  return dataFilePath("auth-load-balancer-sync-status.json");
+}
 
 // src/pool/store.ts
 function emptyPool() {
@@ -12696,6 +12781,24 @@ function normalizeAccounts(rows) {
     if (row.accountId !== null && typeof row.accountId !== "string") {
       row.accountId = null;
     }
+    if (typeof row.inferenceToken !== "string" || row.inferenceToken === "")
+      delete row.inferenceToken;
+    if (typeof row.orgId !== "string" || row.orgId === "")
+      delete row.orgId;
+    if (!isFiniteNumber(row.refreshExpires) || row.refreshExpires <= 0)
+      delete row.refreshExpires;
+    if (row.inferenceToken === undefined || !isFiniteNumber(row.inferenceExpires) || row.inferenceExpires <= 0)
+      delete row.inferenceExpires;
+    if (row.lostLogins !== undefined) {
+      const lost = isPlainObject2(row.lostLogins) ? row.lostLogins : {};
+      for (const login of ["oauth", "token"]) {
+        const entry = lost[login];
+        if (!isPlainObject2(entry) || !isFiniteNumber(entry.at) || typeof entry.reason !== "string")
+          delete lost[login];
+      }
+      if (lost.oauth === undefined && lost.token === undefined)
+        delete row.lostLogins;
+    }
     if (row.tokenGen !== undefined && !Number.isFinite(row.tokenGen)) {
       row.tokenGen = 0;
     }
@@ -12810,87 +12913,16 @@ async function readPoolAccount(id) {
   return findAccount(await readPool(), id);
 }
 
-// src/accounts.ts
-function makeAccount(providerID, label, tokens) {
-  return {
-    id: randomUUID2(),
-    providerID,
-    label,
-    access: tokens.access,
-    refresh: tokens.refresh,
-    expires: tokens.expires,
-    tokenGen: 0,
-    accountId: tokens.accountId ?? null,
-    usage: emptyUsage(),
-    cooldownUntil: 0,
-    disabledReason: null
-  };
-}
-function applyTokens(row, tokens) {
-  if (tokens.refresh)
-    row.refresh = tokens.refresh;
-  row.access = tokens.access;
-  row.expires = tokens.expires;
-  row.disabledReason = null;
-  if (tokens.accountId)
-    row.accountId = tokens.accountId;
-  return row;
-}
-async function addAccount(providerID, tokens, label) {
-  return mutatePool((pool) => {
-    const intent = pool.relogin?.providerID === providerID ? pool.relogin : undefined;
-    if (intent)
-      delete pool.relogin;
-    const existing = pool.accounts.find((a) => a.providerID === providerID && (tokens.refresh && a.refresh === tokens.refresh || tokens.accountId && a.accountId === tokens.accountId));
-    if (existing)
-      return applyTokens(existing, tokens);
-    const target = intent ? pool.accounts.find((account) => account.id === intent.accountId) : undefined;
-    if (target)
-      return applyTokens(target, tokens);
-    const used = new Set(pool.accounts.map((a) => a.label));
-    let n = 1;
-    while (used.has(`${providerID}-${n}`))
-      n++;
-    const account = makeAccount(providerID, label ?? `${providerID}-${n}`, tokens);
-    pool.accounts.push(account);
-    return account;
-  });
-}
-function importableTokens(auth, tokensFromApiKey) {
-  if (auth.type === "api")
-    return tokensFromApiKey && auth.key ? tokensFromApiKey(auth.key) : null;
-  if (auth.type !== "oauth" || !auth.access || !auth.refresh)
-    return null;
-  return {
-    access: auth.access,
-    refresh: auth.refresh,
-    expires: auth.expires ?? 0
-  };
-}
-async function bootstrapFromOpencodeAuth(providerID, getAuth, tokensFromApiKey) {
-  const auth = await getAuth().catch(() => null);
-  const tokens = auth && importableTokens(auth, tokensFromApiKey);
-  if (!tokens)
-    return;
-  if ((await readPool()).accounts.some((a) => a.providerID === providerID))
-    return;
-  await mutatePool((pool) => {
-    if (pool.accounts.some((a) => a.providerID === providerID))
-      return;
-    pool.accounts.push(makeAccount(providerID, `${providerID}-1`, tokens));
-  });
-}
-
 // src/scheduler/score-core.ts
 var DAY_MS = 24 * 60 * 60 * 1000;
-var WEEK_MS = 7 * DAY_MS;
+var WEEK_MS2 = 7 * DAY_MS;
 var HOUR_MS = 60 * 60 * 1000;
 var HOURLY_WINDOW_MS = 5 * HOUR_MS;
 var RESET_CUSHION_DAYS = 0.25;
 var SCORE_DEFAULTS = {
   hourlyInfluence: 0.5,
   minResetMs: 5 * 60 * 1000,
-  weekWindowMs: WEEK_MS,
+  weekWindowMs: WEEK_MS2,
   exhaustedAt: 0.999,
   migrateAt: 0.95,
   weeklyDrainTarget: 0.98
@@ -12952,7 +12984,7 @@ function weeklyUrgency(account, cfg, now) {
   if (drainable === 0)
     return 0;
   const resetAt = weekly?.resetAt ?? 0;
-  const ms = resetAt > now ? resetAt - now : weekly ? resetAt === 0 ? cfg.minResetMs : WEEK_MS - (now - resetAt) % WEEK_MS : cfg.weekWindowMs;
+  const ms = resetAt > now ? resetAt - now : weekly ? resetAt === 0 ? cfg.minResetMs : WEEK_MS2 - (now - resetAt) % WEEK_MS2 : cfg.weekWindowMs;
   const days = Math.max(ms, cfg.minResetMs) / DAY_MS + RESET_CUSHION_DAYS;
   return drainable / (days * days);
 }
@@ -12980,6 +13012,157 @@ function compareRanked(x, y) {
   return x.weeklyUtil - y.weeklyUtil;
 }
 
+// src/usage-merge.ts
+function rollWeeklyAnchorForward(anchor, now) {
+  if (!Number.isFinite(anchor) || anchor <= 0)
+    return 0;
+  if (anchor > now)
+    return anchor;
+  const periods = Math.floor((now - anchor) / WEEK_MS2) + 1;
+  return anchor + periods * WEEK_MS2;
+}
+function preserveWeeklyAnchor(incoming, stored, now) {
+  if (!incoming || incoming.resetAt > 0)
+    return incoming;
+  const anchor = rollWeeklyAnchorForward(stored?.resetAt ?? 0, now);
+  if (anchor === 0)
+    return incoming;
+  return { utilization: incoming.utilization, resetAt: anchor };
+}
+
+// src/accounts.ts
+function makeAccount(providerID, label, tokens) {
+  const account = {
+    id: randomUUID2(),
+    providerID,
+    label,
+    access: tokens.access,
+    refresh: tokens.refresh,
+    expires: tokens.expires,
+    tokenGen: 0,
+    accountId: tokens.accountId ?? null,
+    usage: tokens.usage ?? emptyUsage(),
+    cooldownUntil: 0,
+    disabledReason: null
+  };
+  if (tokens.inferenceOnly) {
+    account.inferenceToken = tokens.access;
+    if (tokens.inferenceExpires)
+      account.inferenceExpires = tokens.inferenceExpires;
+  }
+  if (tokens.orgId)
+    account.orgId = tokens.orgId;
+  if (tokens.refreshExpires)
+    account.refreshExpires = tokens.refreshExpires;
+  return account;
+}
+function recordLostLogin(row, login, reason) {
+  row.lostLogins = { ...row.lostLogins, [login]: { at: Date.now(), reason } };
+}
+function clearLostLogin(row, login) {
+  if (!row.lostLogins?.[login])
+    return;
+  delete row.lostLogins[login];
+  if (!row.lostLogins.oauth && !row.lostLogins.token)
+    delete row.lostLogins;
+}
+function mergeLoginUsage(row, usage) {
+  if (!usage)
+    return;
+  row.usage = {
+    hourly: usage.hourly ?? row.usage.hourly,
+    weekly: usage.weekly ? preserveWeeklyAnchor(usage.weekly, row.usage.weekly, usage.capturedAt) : row.usage.weekly,
+    capturedAt: usage.weekly ? usage.capturedAt : row.usage.capturedAt
+  };
+}
+function applyTokens(row, tokens) {
+  if (tokens.refresh)
+    row.refresh = tokens.refresh;
+  row.access = tokens.access;
+  row.expires = tokens.expires;
+  row.disabledReason = null;
+  if (tokens.accountId)
+    row.accountId = tokens.accountId;
+  if (tokens.orgId)
+    row.orgId = tokens.orgId;
+  if (tokens.refreshExpires)
+    row.refreshExpires = tokens.refreshExpires;
+  clearLostLogin(row, "oauth");
+  mergeLoginUsage(row, tokens.usage);
+  return row;
+}
+function attachToken(row, tokens) {
+  row.inferenceToken = tokens.access;
+  delete row.inferenceExpires;
+  if (tokens.inferenceExpires)
+    row.inferenceExpires = tokens.inferenceExpires;
+  if (!row.refresh) {
+    row.access = tokens.access;
+    row.expires = tokens.expires;
+  }
+  if (tokens.orgId)
+    row.orgId = tokens.orgId;
+  row.disabledReason = null;
+  clearLostLogin(row, "token");
+  mergeLoginUsage(row, tokens.usage);
+  return row;
+}
+async function dropInferenceToken(accountId, token, reason) {
+  await mutatePool((pool) => {
+    const row = findAccount(pool, accountId);
+    if (row?.inferenceToken !== token)
+      return;
+    delete row.inferenceToken;
+    delete row.inferenceExpires;
+    recordLostLogin(row, "token", reason);
+  });
+}
+async function addAccount(providerID, tokens, label) {
+  return mutatePool((pool) => {
+    const intent = pool.relogin?.providerID === providerID ? pool.relogin : undefined;
+    if (intent)
+      delete pool.relogin;
+    return placeTokens(pool, providerID, tokens, label, intent?.accountId);
+  });
+}
+function placeTokens(pool, providerID, tokens, label, hintedId) {
+  const rows = pool.accounts.filter((a) => a.providerID === providerID);
+  const target = rows.find((a) => holdsCredential(a, tokens)) ?? (hintedId === undefined ? undefined : rows.find((a) => a.id === hintedId)) ?? orgPartner(rows, tokens);
+  if (target)
+    return tokens.inferenceOnly ? attachToken(target, tokens) : applyTokens(target, tokens);
+  const used = new Set(pool.accounts.map((a) => a.label));
+  let n = 1;
+  while (used.has(`${providerID}-${n}`))
+    n++;
+  const account = makeAccount(providerID, label ?? `${providerID}-${n}`, tokens);
+  pool.accounts.push(account);
+  return account;
+}
+function importableTokens(auth, tokensFromApiKey) {
+  if (auth.type === "api")
+    return tokensFromApiKey && auth.key ? tokensFromApiKey(auth.key) : null;
+  if (auth.type !== "oauth" || !auth.access || !auth.refresh)
+    return null;
+  return {
+    access: auth.access,
+    refresh: auth.refresh,
+    expires: auth.expires ?? 0
+  };
+}
+async function bootstrapFromOpencodeAuth(providerID, getAuth, tokensFromApiKey) {
+  const auth = await getAuth().catch(() => null);
+  const tokens = auth && importableTokens(auth, tokensFromApiKey);
+  if (!tokens)
+    return;
+  if ((await readPool()).accounts.some((a) => a.providerID === providerID))
+    return;
+  await mutatePool((pool) => {
+    if (pool.accounts.some((a) => a.providerID === providerID))
+      return;
+    pool.accounts.push(makeAccount(providerID, `${providerID}-1`, tokens));
+  });
+}
+
 // src/pending/recovery.ts
 function exhaustedWindows(account, cfg, now) {
   const windows = [];
@@ -13038,6 +13221,11 @@ var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 var CODE_CALLBACK_URL = "https://platform.claude.com/oauth/code/callback";
 var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+var MESSAGES_URL = "https://api.anthropic.com/v1/messages";
+var ANTHROPIC_VERSION = "2023-06-01";
+var USAGE_PROBE_MODEL = "claude-haiku-4-5";
+var SETUP_TOKEN_DOCS_URL = "https://code.claude.com/docs/en/authentication#generate-a-long-lived-token";
+var ORGANIZATION_ID_HEADER = "anthropic-organization-id";
 var OAUTH_SCOPES = [
   "org:create_api_key",
   "user:profile",
@@ -13046,6 +13234,8 @@ var OAUTH_SCOPES = [
   "user:mcp_servers",
   "user:file_upload"
 ];
+var INFERENCE_SCOPE = "user:inference";
+var INFERENCE_TOKEN_LIFETIME_S = 365 * 24 * 60 * 60;
 var TOOL_PREFIX = "mcp_";
 var DEFAULT_OPUS_FALLBACK_MODEL = "claude-sonnet-4-6";
 var DEFAULT_FAMILY_ORDER = [
@@ -13132,6 +13322,11 @@ function isInvalidGrant(error) {
   }
   return error.message.includes("invalid_grant");
 }
+var REFRESH_FAILURE_RE = /^Token refresh failed: (\d+) — ([\s\S]*)$/;
+function refusalReason(error) {
+  const m = REFRESH_FAILURE_RE.exec(error.message);
+  return m ? errorSummary(Number(m[1]), m[2] ?? "") : error.message;
+}
 function genOf(account) {
   return account.tokenGen ?? 0;
 }
@@ -13155,10 +13350,15 @@ function applyTokensTo(account, tokens) {
   account.expires = tokens.expires;
   if (tokens.accountId)
     account.accountId = tokens.accountId;
+  if (tokens.refreshExpires)
+    account.refreshExpires = tokens.refreshExpires;
 }
 function refreshLockDir(providerID, accountId) {
   return `${poolFilePath()}.refresh.${providerID}.${accountId}.lock`;
 }
+function withRefreshLock(providerID, accountId, fn) {
+  return withLock(refreshLockDir(providerID, accountId), REFRESH_LOCK, fn);
+}
 async function commitRefresh(accountId, attempt, next) {
   return mutatePool((pool) => {
     const stored = findAccount(pool, accountId);
@@ -13173,13 +13373,22 @@ async function commitRefresh(accountId, attempt, next) {
     return next;
   });
 }
-async function resolveInvalidGrant(adapter, accountId, attempt) {
+async function resolveInvalidGrant(adapter, accountId, attempt, reason) {
   return mutatePool((pool) => {
     const stored = findAccount(pool, accountId);
     if (!stored)
       return null;
     if (!sameGeneration(stored, attempt))
       return tokensOf(stored);
+    recordLostLogin(stored, "oauth", reason);
+    if (stored.inferenceToken !== undefined) {
+      stored.access = stored.inferenceToken;
+      stored.refresh = "";
+      stored.expires = STATIC_CREDENTIAL_EXPIRES;
+      stored.tokenGen = attempt.gen + 1;
+      delete stored.refreshExpires;
+      return tokensOf(stored);
+    }
     stored.disabledReason = disableReason(adapter, stored.label);
     return null;
   });
@@ -13197,9 +13406,9 @@ async function runRefresh(adapter, account, now) {
       const next = await adapter.refresh(attempt.refresh);
       return await commitRefresh(account.id, attempt, next);
     } catch (error) {
-      if (!isInvalidGrant(error))
+      if (!(error instanceof Error) || !isInvalidGrant(error))
         throw error;
-      const adopted = await resolveInvalidGrant(adapter, account.id, attempt);
+      const adopted = await resolveInvalidGrant(adapter, account.id, attempt, refusalReason(error));
       if (adopted)
         return adopted;
       throw error;
@@ -13395,22 +13604,81 @@ function deriveSessionKey(headers, body) {
   }
 }
 
-// src/usage-merge.ts
-function rollWeeklyAnchorForward(anchor, now) {
-  if (!Number.isFinite(anchor) || anchor <= 0)
-    return 0;
-  if (anchor > now)
-    return anchor;
-  const periods = Math.floor((now - anchor) / WEEK_MS) + 1;
-  return anchor + periods * WEEK_MS;
+// src/token-mint.ts
+var DAY_MS2 = 24 * 60 * 60 * 1000;
+var RENEW_WITHIN_MS = 30 * DAY_MS2;
+var MIN_LIFETIME_MS = 2 * RENEW_WITHIN_MS;
+var RETRY_MS = 6 * 60 * 60 * 1000;
+var LAST_ATTEMPT_MAX = 256;
+var lastAttempt = new Map;
+function autoTokenEnabled(env = process.env) {
+  const raw = env.OPENCODE_AUTH_LB_ANTHROPIC_AUTO_TOKEN?.trim().toLowerCase();
+  return raw !== "0" && raw !== "false" && raw !== "no" && raw !== "off";
+}
+function tokenDue(account, now) {
+  if (!account.refresh || account.disabledReason)
+    return false;
+  if (account.inferenceToken === undefined)
+    return true;
+  return account.inferenceExpires !== undefined && account.inferenceExpires - now <= RENEW_WITHIN_MS;
 }
-function preserveWeeklyAnchor(incoming, stored, now) {
-  if (!incoming || incoming.resetAt > 0)
-    return incoming;
-  const anchor = rollWeeklyAnchorForward(stored?.resetAt ?? 0, now);
-  if (anchor === 0)
-    return incoming;
-  return { utilization: incoming.utilization, resetAt: anchor };
+async function mintToken(adapter, accountId) {
+  const mint = adapter.mintInferenceToken;
+  if (!mint)
+    return false;
+  return withRefreshLock(adapter.id, accountId, async () => {
+    const latest = await readPoolAccount(accountId);
+    if (!latest || !tokenDue(latest, Date.now()))
+      return false;
+    const attempt = {
+      refresh: latest.refresh,
+      gen: genOf(latest)
+    };
+    const minted = await mint(attempt.refresh);
+    return mutatePool((pool) => {
+      const row = findAccount(pool, accountId);
+      if (!row || !sameGeneration(row, attempt))
+        return false;
+      if (minted.refresh !== row.refresh) {
+        row.refresh = minted.refresh;
+        row.tokenGen = attempt.gen + 1;
+      }
+      if (minted.refreshExpires)
+        row.refreshExpires = minted.refreshExpires;
+      const now = Date.now();
+      if (minted.expires - now < MIN_LIFETIME_MS || !tokenDue(row, now))
+        return false;
+      row.inferenceToken = minted.access;
+      row.inferenceExpires = minted.expires;
+      clearLostLogin(row, "token");
+      return true;
+    });
+  });
+}
+async function maintainTokens(adapter, now, poolSnapshot) {
+  if (!adapter.mintInferenceToken || !autoTokenEnabled())
+    return;
+  const pool = poolSnapshot ?? await readPool();
+  let due;
+  for (const account of pool.accounts) {
+    if (account.providerID !== adapter.id || !tokenDue(account, now))
+      continue;
+    const last = lastAttempt.get(account.id);
+    if (last !== undefined && now - last < RETRY_MS)
+      continue;
+    setBounded(lastAttempt, account.id, now, LAST_ATTEMPT_MAX);
+    due ??= [];
+    due.push(account.id);
+  }
+  if (due)
+    await Promise.all(due.map((id) => mintToken(adapter, id).catch(ignore)));
+}
+async function mintAtLogin(adapter, account) {
+  const now = Date.now();
+  if (!adapter.mintInferenceToken || !autoTokenEnabled() || !tokenDue(account, now))
+    return false;
+  setBounded(lastAttempt, account.id, now, LAST_ATTEMPT_MAX);
+  return mintToken(adapter, account.id).catch(() => false);
 }
 
 // src/providers/types.ts
@@ -13661,6 +13929,24 @@ async function postToken(body) {
     signal: AbortSignal.timeout(OAUTH_HTTP_TIMEOUT_MS)
   });
 }
+var ASSUMED_LOGIN_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
+function uuidOf(value) {
+  return isPlainObject2(value) && typeof value.uuid === "string" && value.uuid ? value.uuid : undefined;
+}
+function withAccount(tokens, json, atLogin) {
+  const accountId = uuidOf(json.account);
+  const orgId = uuidOf(json.organization);
+  if (accountId)
+    tokens.accountId = accountId;
+  if (orgId)
+    tokens.orgId = orgId;
+  const lifetime = json.refresh_token_expires_in;
+  if (isFiniteNumber(lifetime) && lifetime > 0)
+    tokens.refreshExpires = Date.now() + lifetime * 1000;
+  else if (atLogin)
+    tokens.refreshExpires = Date.now() + ASSUMED_LOGIN_LIFETIME_MS;
+  return tokens;
+}
 async function authorize() {
   const pkce = await generatePKCE();
   const state = generateState();
@@ -13697,7 +13983,7 @@ async function exchange(input, verifier, redirectUri, expectedState) {
   const json = await readExchangeResponse(result);
   if (!json)
     return null;
-  return toTokenSet(json, "");
+  return withAccount(toTokenSet(json, ""), json, true);
 }
 async function refresh(refreshToken) {
   const response = await postToken({
@@ -13706,36 +13992,78 @@ async function refresh(refreshToken) {
     client_id: CLIENT_ID
   });
   const json = await readRefreshResponse(response);
-  return toTokenSet(json, refreshToken);
+  return withAccount(toTokenSet(json, refreshToken), json, false);
 }
-
-// src/providers/anthropic/cch.ts
-import { createHash as createHash2 } from "node:crypto";
-
-// src/providers/anthropic/version.ts
-import { readFile as readFile3 } from "node:fs/promises";
-
-// src/providers/usage-http.ts
-async function fetchJson(url, headers, timeoutMs) {
-  let response;
-  try {
-    response = await fetch(url, {
-      headers,
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch {
-    return null;
-  }
-  if (!response.ok) {
-    await response.body?.cancel().catch(ignore);
-    return null;
-  }
-  return await response.json().catch(() => null);
+async function mintInferenceToken(refreshToken) {
+  const response = await postToken({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: CLIENT_ID,
+    scope: INFERENCE_SCOPE,
+    expires_in: INFERENCE_TOKEN_LIFETIME_S
+  });
+  const json = await readRefreshResponse(response);
+  return withAccount(toTokenSet(json, refreshToken), json, false);
 }
 
-// src/providers/anthropic/version.ts
-var VERSION_RE = /^\d+\.\d+\.\d+$/;
-function compareVersions2(a, b) {
+// src/providers/usage-headers.ts
+function headerWindow(utilRaw, resetRaw, divisor) {
+  const util = Number(utilRaw);
+  if (!Number.isFinite(util))
+    return null;
+  return {
+    utilization: clamp01(util / divisor),
+    resetAt: secondsToMs(Number(resetRaw))
+  };
+}
+function parseWindowPairHeaders(headers, spec) {
+  const h = headers.get(spec.hourlyUtil);
+  const w = headers.get(spec.weeklyUtil);
+  if (h === null && w === null)
+    return null;
+  const out = {};
+  const hourly = h === null ? null : headerWindow(h, headers.get(spec.hourlyReset), spec.divisor);
+  const weekly = w === null ? null : headerWindow(w, headers.get(spec.weeklyReset), spec.divisor);
+  if (hourly)
+    out.hourly = hourly;
+  if (weekly)
+    out.weekly = weekly;
+  return hourly || weekly ? out : null;
+}
+function endpointWindowFrom(w, utilOf, divisor, resetOf) {
+  if (!w)
+    return { utilization: 0, resetAt: 0 };
+  const util = utilOf(w);
+  if (!isFiniteNumber(util))
+    return null;
+  return { utilization: clamp01(util / divisor), resetAt: resetOf(w) };
+}
+
+// src/providers/usage-http.ts
+async function fetchJson(url, headers, timeoutMs) {
+  let response;
+  try {
+    response = await fetch(url, {
+      headers,
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) {
+    await response.body?.cancel().catch(ignore);
+    return null;
+  }
+  return await response.json().catch(() => null);
+}
+
+// src/providers/anthropic/cch.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// src/providers/anthropic/version.ts
+import { readFile as readFile3 } from "node:fs/promises";
+var VERSION_RE = /^\d+\.\d+\.\d+$/;
+function compareVersions2(a, b) {
   const left = a.split(".");
   const right = b.split(".");
   for (let i = 0;i < 3; i++) {
@@ -14087,39 +14415,6 @@ function createStrippedStream(response) {
   });
 }
 
-// src/providers/usage-headers.ts
-function headerWindow(utilRaw, resetRaw, divisor) {
-  const util = Number(utilRaw);
-  if (!Number.isFinite(util))
-    return null;
-  return {
-    utilization: clamp01(util / divisor),
-    resetAt: secondsToMs(Number(resetRaw))
-  };
-}
-function parseWindowPairHeaders(headers, spec) {
-  const h = headers.get(spec.hourlyUtil);
-  const w = headers.get(spec.weeklyUtil);
-  if (h === null && w === null)
-    return null;
-  const out = {};
-  const hourly = h === null ? null : headerWindow(h, headers.get(spec.hourlyReset), spec.divisor);
-  const weekly = w === null ? null : headerWindow(w, headers.get(spec.weeklyReset), spec.divisor);
-  if (hourly)
-    out.hourly = hourly;
-  if (weekly)
-    out.weekly = weekly;
-  return hourly || weekly ? out : null;
-}
-function endpointWindowFrom(w, utilOf, divisor, resetOf) {
-  if (!w)
-    return { utilization: 0, resetAt: 0 };
-  const util = utilOf(w);
-  if (!isFiniteNumber(util))
-    return null;
-  return { utilization: clamp01(util / divisor), resetAt: resetOf(w) };
-}
-
 // src/providers/anthropic/usage.ts
 var HEADER_SPEC = {
   hourlyUtil: "anthropic-ratelimit-unified-5h-utilization",
@@ -14151,7 +14446,46 @@ function parseResetAt(value) {
 function endpointWindow(w) {
   return endpointWindowFrom(w, (win) => win.utilization, 100, (win) => parseResetAt(win.resets_at));
 }
+function sendUsageProbe(access) {
+  const headers = new Headers({
+    "content-type": "application/json",
+    "anthropic-version": ANTHROPIC_VERSION
+  });
+  setOAuthHeaders(headers, access);
+  return fetch(rewriteUrl(MESSAGES_URL), {
+    method: "POST",
+    headers,
+    body: rewriteRequestBody(JSON.stringify({
+      model: USAGE_PROBE_MODEL,
+      max_tokens: 1,
+      messages: [{ role: "user", content: "quota" }]
+    })),
+    signal: AbortSignal.timeout(USAGE_HTTP_TIMEOUT_MS)
+  });
+}
+function probeSnapshot(headers, now) {
+  const partial = parseUsageHeaders(headers);
+  if (!partial)
+    return null;
+  return {
+    hourly: partial.hourly ?? null,
+    weekly: partial.weekly ?? null,
+    capturedAt: partial.weekly ? now : 0
+  };
+}
+async function probeUsage(access, now) {
+  let res;
+  try {
+    res = await sendUsageProbe(access);
+  } catch {
+    return null;
+  }
+  await res.body?.cancel().catch(ignore);
+  return probeSnapshot(res.headers, now);
+}
 async function fetchUsage(account, now) {
+  if (!account.refresh)
+    return probeUsage(account.access, now);
   const json = await fetchJson(USAGE_URL, {
     authorization: `Bearer ${account.access}`,
     "anthropic-beta": "oauth-2025-04-20",
@@ -14169,12 +14503,50 @@ async function fetchUsage(account, now) {
   };
 }
 
+// src/providers/anthropic/setup-token.ts
+var SETUP_TOKEN_RE = /^sk-ant-oat\d+-[\w-]+$/;
+async function exchangeSetupToken(input) {
+  const token = input.replace(/\s+/g, "");
+  if (!SETUP_TOKEN_RE.test(token))
+    return null;
+  let res;
+  try {
+    res = await sendUsageProbe(token);
+  } catch {
+    return null;
+  }
+  await res.body?.cancel().catch(ignore);
+  if (res.status === 401 || res.status === 403)
+    return null;
+  const tokens = {
+    access: token,
+    refresh: "",
+    expires: STATIC_CREDENTIAL_EXPIRES,
+    inferenceOnly: true
+  };
+  const orgId = res.headers.get(ORGANIZATION_ID_HEADER);
+  if (orgId)
+    tokens.orgId = orgId;
+  const usage = probeSnapshot(res.headers, Date.now());
+  if (usage)
+    tokens.usage = usage;
+  return tokens;
+}
+var setupTokenLogin = {
+  label: "setup-token",
+  url: SETUP_TOKEN_DOCS_URL,
+  instructions: "Run `claude setup-token`, approve it in the browser, then paste the token it prints (sk-ant-oat01-…) here:",
+  exchange: exchangeSetupToken
+};
+
 // src/providers/anthropic/adapter.ts
 var anthropicAdapter = {
   id: PROVIDER_ID,
   authorize,
   exchange,
   refresh,
+  tokenLogin: setupTokenLogin,
+  mintInferenceToken,
   applyAuth(headers, account) {
     setOAuthHeaders(headers, account.access);
   },
@@ -14828,7 +15200,7 @@ async function applyCooldown(accountId, fallbackMs, kind) {
     }
   }));
 }
-async function recordRotation(adapter, accountId, res, fallbackMs, now, kind, revokedKey) {
+async function recordRotation(adapter, accountId, res, fallbackMs, now, kind, revoked) {
   const partial = adapter.parseUsageHeaders(res.headers);
   const until = cooldownUntilFrom(res, fallbackMs, now);
   await bestEffort("rotation", () => mutatePool((pool) => {
@@ -14841,8 +15213,10 @@ async function recordRotation(adapter, accountId, res, fallbackMs, now, kind, re
       account.cooldownUntil = until;
       account.cooldownKind = kind;
     }
-    if (revokedKey !== undefined && account.access === revokedKey)
-      account.disabledReason = `invalid API key: re-login required (${adapter.id}:${account.label})`;
+    if (revoked && account.access === revoked.key) {
+      account.disabledReason = `credential rejected (401): re-login required (${adapter.id}:${account.label})`;
+      recordLostLogin(account, "token", revoked.reason);
+    }
   }));
 }
 async function recordModelCooldown(accountId, tier, until, partial, now) {
@@ -14951,6 +15325,7 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
     let pendingTierFallback = null;
     let tierSkipped = null;
     let clientVersionRetried = false;
+    let rejectedTokens = null;
     let usageSeeded = false;
     const waitDeadline = Date.now() + cfg.maxWaitMs;
     for (;; ) {
@@ -14959,6 +15334,7 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
       if (!usageSeeded) {
         usageSeeded = true;
         refreshAllUsageInBackground(now, pool).catch(ignore);
+        maintainTokens(adapter, now, pool).catch(ignore);
       }
       if (pendingRef && pending) {
         const recovery = classifyProviderRecovery(pool.accounts, adapter.id, cfg, now, USAGE_REFRESH_TTL_MS);
@@ -15022,10 +15398,12 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
           continue;
         }
       }
+      const token = account.inferenceToken !== undefined && !rejectedTokens?.has(account.inferenceToken) ? account.inferenceToken : undefined;
       try {
-        await ensureAccessToken(adapter, account, now);
+        if (token === undefined)
+          await ensureAccessToken(adapter, account, now);
         const headers = new Headers(baseHeaders);
-        adapter.applyAuth(headers, account);
+        adapter.applyAuth(headers, token === undefined ? account : { ...account, access: token });
         if (DEBUG)
           log(`-> ${adapter.id} via ${account.label}${sticky ? " (sticky)" : ""}${degraded ? " (degraded)" : ""}`);
         const res = await fetch(transformedUrl, {
@@ -15035,6 +15413,7 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
         });
         const cls = adapter.classifyError(res.status);
         if (cls === "account" || cls === "auth") {
+          const rejection = res.status === 401 ? errorSummary(401, await res.text().catch(() => "")) : "";
           await res.body?.cancel().catch(ignore);
           if (cls === "account" && typeof currentBody === "string") {
             const reactiveNow = Date.now();
@@ -15052,8 +15431,18 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
               continue;
             }
           }
+          if (res.status === 401 && token !== undefined && account.refresh) {
+            rejectedTokens ??= new Set;
+            rejectedTokens.add(token);
+            await bestEffort("drop-token", () => dropInferenceToken(account.id, token, rejection));
+            tried.delete(account.id);
+            lastError = new Error(`${adapter.id} account "${account.label}" rejected its setup-token`);
+            if (DEBUG)
+              log(`!! ${account.label} setup-token 401 -> retrying on its OAuth login`);
+            continue;
+          }
           const ms = cls === "auth" ? AUTH_COOLDOWN_MS : ACCOUNT_COOLDOWN_MS;
-          await recordRotation(adapter, account.id, res, ms, Date.now(), cls === "auth" ? "auth" : "quota", res.status === 401 && adapter.tokensFromApiKey && !account.refresh ? account.access : undefined);
+          await recordRotation(adapter, account.id, res, ms, Date.now(), cls === "auth" ? "auth" : "quota", res.status === 401 && !account.refresh ? { key: account.access, reason: rejection } : undefined);
           if (cls === "account") {
             waitableCooldownIds ??= new Set;
             waitableCooldownIds.add(account.id);
@@ -15108,6 +15497,47 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
   };
 }
 
+// src/login-health.ts
+var DAY_MS3 = 24 * 60 * 60 * 1000;
+var LOGIN_EXPIRY_WARNING_MS = 3 * DAY_MS3;
+function credentialTag(account) {
+  if (account.inferenceToken === undefined)
+    return "";
+  return account.refresh ? "token+oauth" : "token";
+}
+function loginWarnings(account, now) {
+  if (account.disabledReason)
+    return [];
+  const warnings = [];
+  if (account.lostLogins?.oauth)
+    warnings.push("oauth re-login");
+  if (account.lostLogins?.token)
+    warnings.push("token re-login");
+  const left = (account.refreshExpires ?? 0) - now;
+  if (account.refresh && left > 0 && left <= LOGIN_EXPIRY_WARNING_MS)
+    warnings.push(`oauth expires ${Math.ceil(left / DAY_MS3)}d`);
+  return warnings;
+}
+function ago(at, now) {
+  const mins = Math.floor((now - at) / 60000);
+  if (mins < 1)
+    return "just now";
+  if (mins < 120)
+    return `${mins}m ago`;
+  const hrs = Math.floor(mins / 60);
+  return hrs < 48 ? `${hrs}h ago` : `${Math.floor(hrs / 24)}d ago`;
+}
+function lostLoginNotes(account, now) {
+  const notes = [];
+  for (const login of ["oauth", "token"]) {
+    const lost = account.lostLogins?.[login];
+    const name = login === "oauth" ? "OAuth login" : "token";
+    if (lost)
+      notes.push(`${name} lost ${ago(lost.at, now)} — ${lost.reason}`);
+  }
+  return notes;
+}
+
 // src/status.ts
 var PROVIDER_NAMES = {
   anthropic: "Claude",
@@ -15137,6 +15567,9 @@ function toStatus(account, now, current, available, rank) {
     cooldownUntil: account.cooldownUntil,
     modelCooldownsUntil: account.modelCooldownsUntil ?? {},
     disabledReason: account.disabledReason,
+    login: credentialTag(account),
+    warnings: loginWarnings(account, now),
+    lostNotes: lostLoginNotes(account, now),
     current,
     rank
   };
@@ -15250,8 +15683,12 @@ function renderStatus(providers, now = Date.now()) {
     lines.push(`  #  ${"account".padEnd(width + 3)}weekly   5h   resets   state`);
     for (const a of p.accounts) {
       const mark = a.current ? "▶" : " ";
-      lines.push(`  ${String(a.rank).padEnd(2)} ${mark} ${padDisplayEnd(a.label, width)} ${pct(a.weeklyUtil).padStart(5)} ${pct(a.hourlyUtil).padStart(5)} ${relTime(a.weeklyResetAt, now).padStart(7)}  ${stateOf(a, now)}`);
+      const notes = [a.login, ...a.warnings].filter(Boolean).map((note) => ` · ${note}`).join("");
+      lines.push(`  ${String(a.rank).padEnd(2)} ${mark} ${padDisplayEnd(a.label, width)} ${pct(a.weeklyUtil).padStart(5)} ${pct(a.hourlyUtil).padStart(5)} ${relTime(a.weeklyResetAt, now).padStart(7)}  ${stateOf(a, now)}${notes}`);
     }
+    for (const a of p.accounts)
+      for (const note of a.lostNotes)
+        lines.push(`  ! ${a.label}: ${note}`);
     lines.push("");
   }
   return lines.join(`
@@ -15276,6 +15713,14 @@ async function notifyOnSwitch(client, providerID, account) {
     duration: 4000
   });
 }
+async function notifyPaired(client, providerID, account) {
+  await postToast(client, {
+    title: `${providerName(providerID)} account`,
+    message: `▶ ${account.label}  ·  inference: setup-token  ·  usage: OAuth`,
+    variant: "success",
+    duration: 6000
+  });
+}
 var lastFallbackToasted = new Map;
 var LAST_FALLBACK_TOASTED_MAX = 256;
 async function notifyModelFallback(client, providerID, account, fromModel, toModel, fromTier) {
@@ -15852,6 +16297,1193 @@ async function primeInUse(providerID, now) {
   });
 }
 
+// src/sync/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash as createHash6,
+  randomBytes
+} from "node:crypto";
+
+// src/sync/errors.ts
+var MESSAGES = {
+  "bad-link": "That is not a gist link with a key (https://gist.github.com/<user>/<id>#<key>).",
+  "not-set-up": "Sync is not set up on this machine.",
+  "bad-blob": "The gist does not hold a sync file.",
+  "bad-version": "The gist was written by a newer version; update this plugin.",
+  "rolled-back": "The gist holds an older snapshot than one already applied; ignoring it.",
+  decrypt: "The gist could not be decrypted: the link key is wrong or the gist was changed.",
+  "too-large": "The gist is larger than a sync file can be.",
+  "rate-limited": "GitHub is rate limiting this machine; trying again later.",
+  "not-found": "The gist no longer exists.",
+  network: "GitHub could not be reached.",
+  "no-auth": "Uploading needs GITHUB_TOKEN or GH_TOKEN (gist scope), or a logged-in gh CLI.",
+  http: "GitHub refused the request.",
+  "write-denied": "This GitHub account cannot update the gist; downloading only."
+};
+
+class SyncError extends Error {
+  code;
+  retryAfterMs;
+  constructor(code, retryAfterMs) {
+    super(MESSAGES[code]);
+    this.code = code;
+    this.retryAfterMs = retryAfterMs;
+    this.name = "SyncError";
+  }
+}
+function describeSyncError(error) {
+  return error instanceof SyncError ? error.message : "Sync failed.";
+}
+
+// src/sync/crypto.ts
+var BLOB_VERSION = 1;
+var MAX_BLOB_BYTES = 256 * 1024;
+var KEY_BYTES = 32;
+var NONCE_BYTES = 12;
+var TAG_BYTES = 16;
+var AAD = Buffer.from("opencode-auth-load-balancer/gist-sync/v1");
+var KEY_RE = /^[\w-]{43}$/;
+var B64URL_RE = /^[\w-]+$/;
+function generateKey() {
+  return randomBytes(KEY_BYTES);
+}
+function encodeKey(key) {
+  return key.toString("base64url");
+}
+function decodeKey(text) {
+  return KEY_RE.test(text) ? Buffer.from(text, "base64url") : null;
+}
+function fingerprint(secret) {
+  return createHash6("sha256").update(secret).digest("hex").slice(0, 32);
+}
+function seal(plaintext, key) {
+  const nonce = randomBytes(NONCE_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, nonce);
+  cipher.setAAD(AAD);
+  const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: BLOB_VERSION,
+    n: nonce.toString("base64url"),
+    c: data.toString("base64url"),
+    t: cipher.getAuthTag().toString("base64url")
+  });
+}
+function parseBlob(text) {
+  if (Buffer.byteLength(text) > MAX_BLOB_BYTES)
+    throw new SyncError("too-large");
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new SyncError("bad-blob");
+  }
+  if (!isPlainObject2(json))
+    throw new SyncError("bad-blob");
+  if (typeof json.v === "number" && json.v !== BLOB_VERSION)
+    throw new SyncError("bad-version");
+  const { n, c, t } = json;
+  if (json.v !== BLOB_VERSION || typeof n !== "string" || typeof c !== "string" || typeof t !== "string" || !B64URL_RE.test(n) || !B64URL_RE.test(c) || !B64URL_RE.test(t))
+    throw new SyncError("bad-blob");
+  const nonce = Buffer.from(n, "base64url");
+  const tag = Buffer.from(t, "base64url");
+  if (nonce.length !== NONCE_BYTES || tag.length !== TAG_BYTES)
+    throw new SyncError("bad-blob");
+  return { nonce, data: Buffer.from(c, "base64url"), tag };
+}
+function open(text, key) {
+  const { nonce, data, tag } = parseBlob(text);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAAD(AAD);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8");
+  } catch {
+    throw new SyncError("decrypt");
+  }
+}
+
+// src/sync/payload.ts
+var PAYLOAD_VERSION = 2;
+var MAX_ENTRIES = 64;
+var MAX_LABEL = 80;
+var MAX_SECRET = 512;
+var MAX_FIELD = 128;
+var ID_RE = /^[\w-]{1,64}$/;
+var ORIGIN_RE = /^[\da-f]{32}$/;
+var CLAUDE_TOKEN_RE = /^sk-ant-oat\d+-[\w-]+$/;
+var API_KEY_RE = /^\S{8,512}$/;
+var SECRET_SHAPES = new Map([
+  ["anthropic", CLAUDE_TOKEN_RE],
+  ["kimi-code-plan-cn", API_KEY_RE],
+  ["kimi-code-plan-global", API_KEY_RE]
+]);
+function entryKey(entry) {
+  return `${entry.origin}/${entry.id}`;
+}
+function isControl(code) {
+  return code < 32 || code >= 127 && code <= 159 || code === 1564 || code >= 8203 && code <= 8207 || code >= 8232 && code <= 8238 || code >= 8288 && code <= 8297 || code === 65279;
+}
+function printable(text) {
+  return Array.from(text, (ch) => isControl(ch.codePointAt(0) ?? 0) ? " " : ch).join("").trim();
+}
+function boundedString(value, max) {
+  return typeof value === "string" && value.length > 0 && value.length <= max ? value : undefined;
+}
+function keyOf(raw) {
+  if (!isPlainObject2(raw))
+    return null;
+  const { origin, id } = raw;
+  return typeof origin === "string" && ORIGIN_RE.test(origin) && typeof id === "string" && ID_RE.test(id) ? `${origin}/${id}` : null;
+}
+function parseEntry(raw) {
+  if (!isPlainObject2(raw))
+    return null;
+  const origin = boundedString(raw.origin, 32);
+  const id = boundedString(raw.id, 64);
+  const providerID = boundedString(raw.providerID, MAX_FIELD);
+  const label = printable(boundedString(raw.label, MAX_LABEL) ?? "");
+  const secret = boundedString(raw.secret, MAX_SECRET);
+  const shape = providerID ? SECRET_SHAPES.get(providerID) : undefined;
+  if (!origin || !ORIGIN_RE.test(origin))
+    return null;
+  if (!id || !ID_RE.test(id) || !providerID || !label || !secret)
+    return null;
+  if (!shape?.test(secret))
+    return null;
+  const expiresAt = providerID === "anthropic" && isFiniteNumber(raw.expiresAt) && raw.expiresAt > 0 ? raw.expiresAt : undefined;
+  return {
+    origin,
+    id,
+    providerID,
+    label,
+    secret,
+    ...expiresAt ? { expiresAt } : {}
+  };
+}
+function sortEntries(entries) {
+  return [...entries].sort((a, b) => {
+    const [x, y] = [entryKey(a), entryKey(b)];
+    return x < y ? -1 : x > y ? 1 : 0;
+  });
+}
+function entriesDigest(entries) {
+  return fingerprint(JSON.stringify(sortEntries(entries)));
+}
+function buildPayload(entries, at) {
+  return JSON.stringify({
+    v: PAYLOAD_VERSION,
+    at,
+    entries: sortEntries(entries)
+  });
+}
+function parsePayload(text) {
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new SyncError("bad-blob");
+  }
+  if (!isPlainObject2(json) || !Array.isArray(json.entries))
+    throw new SyncError("bad-blob");
+  if (json.v !== PAYLOAD_VERSION)
+    throw new SyncError("bad-version");
+  if (!isFiniteNumber(json.at))
+    throw new SyncError("bad-blob");
+  if (json.entries.length > MAX_ENTRIES)
+    throw new SyncError("too-large");
+  const listed = new Set;
+  const entries = [];
+  let unreadable = 0;
+  for (const raw of json.entries) {
+    const key = keyOf(raw);
+    const entry = parseEntry(raw);
+    if (key) {
+      const seen = listed.has(key);
+      listed.add(key);
+      if (seen && entry)
+        continue;
+    }
+    if (entry)
+      entries.push(entry);
+    else
+      unreadable += 1;
+  }
+  return { at: json.at, entries, listed, unreadable };
+}
+
+// src/sync/merge.ts
+function holdsFingerprint(row, digest) {
+  return row.inferenceToken !== undefined && fingerprint(row.inferenceToken) === digest || !row.refresh && fingerprint(row.access) === digest;
+}
+function staticFingerprint(row) {
+  if (row.inferenceToken !== undefined)
+    return fingerprint(row.inferenceToken);
+  return row.refresh ? "" : fingerprint(row.access);
+}
+function recorded(map, key) {
+  return Object.hasOwn(map, key) ? map[key] : undefined;
+}
+function blockerStands(accounts, skip) {
+  const row = accounts.find((a) => a.id === skip.blocker);
+  return !!row && (skip.holds === "" || holdsFingerprint(row, skip.holds));
+}
+function hasFreedSkips(accounts, skipped) {
+  return Object.values(skipped).some((skip) => !blockerStands(accounts, skip));
+}
+function planMerge(accounts, snapshot, memory) {
+  const { origin, imported, skipped } = memory;
+  const imports = [];
+  const drops = [];
+  for (const entry of snapshot.entries) {
+    if (entry.origin === origin)
+      continue;
+    const key = entryKey(entry);
+    const previous = recorded(imported, key);
+    const skip = recorded(skipped, key);
+    const digest = fingerprint(entry.secret);
+    if (previous?.fingerprint === digest)
+      continue;
+    if (skip?.fingerprint === digest && blockerStands(accounts, skip))
+      continue;
+    const heldLocally = accounts.some((a) => a.providerID === entry.providerID && holdsFingerprint(a, digest));
+    if (previous && heldLocally)
+      drops.push([key, previous]);
+    else if (!heldLocally)
+      imports.push({ entry, ...previous ? { previous } : {} });
+  }
+  for (const [key, ref] of Object.entries(imported))
+    if (!snapshot.listed.has(key))
+      drops.push([key, ref]);
+  const forgets = Object.keys(skipped).filter((key) => !snapshot.listed.has(key));
+  return { imports, drops, forgets };
+}
+
+// src/sync/state.ts
+import { readFile as readFile5, rm as rm2 } from "node:fs/promises";
+
+// src/sync/gist.ts
+var GIST_FILE = "auth-load-balancer-sync.json";
+var API = "https://api.github.com/gists";
+var REQUEST_TIMEOUT_MS = 15000;
+var MAX_RESPONSE_BYTES = 1024 * 1024;
+var MIN_BACKOFF_MS = 60000;
+var MAX_BACKOFF_MS = 3600000;
+var DEFAULT_BACKOFF_MS = 15 * 60000;
+var GIST_ID_RE = /^[\da-f]{20,40}$/i;
+var OWNER_RE = /^[\w-]{1,39}$/;
+function parseGistLink(link) {
+  let url;
+  try {
+    url = new URL(link.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.hostname !== "gist.github.com")
+    return null;
+  const parts = url.pathname.split("/").filter(Boolean);
+  const id = parts.at(-1);
+  const owner = parts.length === 2 ? parts[0] : undefined;
+  const key = decodeKey(url.hash.slice(1));
+  if (!id || parts.length > 2 || !GIST_ID_RE.test(id) || owner !== undefined && !OWNER_RE.test(owner) || !key)
+    return null;
+  return { id, key };
+}
+function backoffFrom(res, now) {
+  const retryAfter = Number(res.headers.get("retry-after"));
+  const reset = Number(res.headers.get("x-ratelimit-reset"));
+  const wait = retryAfter > 0 ? retryAfter * 1000 : reset > 0 ? reset * 1000 - now : DEFAULT_BACKOFF_MS;
+  return Math.min(MAX_BACKOFF_MS, Math.max(MIN_BACKOFF_MS, wait));
+}
+function isRateLimited(res) {
+  return res.status === 429 || res.status === 403 && (res.headers.get("x-ratelimit-remaining") === "0" || res.headers.has("retry-after"));
+}
+async function request(url, init, now) {
+  let res;
+  try {
+    res = await globalThis.fetch(url, {
+      ...init,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  } catch {
+    throw new SyncError("network");
+  }
+  if (res.status === 404)
+    throw new SyncError("not-found");
+  if (isRateLimited(res))
+    throw new SyncError("rate-limited", backoffFrom(res, now));
+  return res;
+}
+function headers(token) {
+  return {
+    accept: "application/vnd.github+json",
+    "x-github-api-version": "2022-11-28",
+    "user-agent": "opencode-auth-load-balancer",
+    ...token ? { authorization: `Bearer ${token}` } : {}
+  };
+}
+async function boundedText(res) {
+  const declared = Number(res.headers.get("content-length"));
+  if (declared > MAX_RESPONSE_BYTES) {
+    await res.body?.cancel().catch(ignore);
+    throw new SyncError("too-large");
+  }
+  const reader = res.body?.getReader();
+  if (!reader)
+    return "";
+  const chunks = [];
+  let total = 0;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      total += value.byteLength;
+      if (total > MAX_RESPONSE_BYTES) {
+        await reader.cancel().catch(ignore);
+        throw new SyncError("too-large");
+      }
+      chunks.push(value);
+    }
+  } catch (error) {
+    throw error instanceof SyncError ? error : new SyncError("network");
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function readJson(res) {
+  if (!res.ok)
+    throw new SyncError("http");
+  const text = await boundedText(res);
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new SyncError("http");
+  }
+  if (!isPlainObject2(json))
+    throw new SyncError("http");
+  return json;
+}
+async function createGist(token, content, now = Date.now()) {
+  const res = await request(API, {
+    method: "POST",
+    headers: { ...headers(token), "content-type": "application/json" },
+    body: JSON.stringify({
+      description: "opencode-auth-load-balancer sync (encrypted)",
+      public: false,
+      files: { [GIST_FILE]: { content } }
+    })
+  }, now);
+  const json = await readJson(res);
+  const owner = isPlainObject2(json.owner) ? json.owner.login : undefined;
+  if (typeof json.id !== "string" || !GIST_ID_RE.test(json.id))
+    throw new SyncError("http");
+  return {
+    id: json.id,
+    ...typeof owner === "string" && OWNER_RE.test(owner) ? { owner } : {}
+  };
+}
+async function updateGist(token, id, content, now = Date.now()) {
+  let res;
+  try {
+    res = await request(`${API}/${id}`, {
+      method: "PATCH",
+      headers: { ...headers(token), "content-type": "application/json" },
+      body: JSON.stringify({ files: { [GIST_FILE]: { content } } })
+    }, now);
+  } catch (error) {
+    if (error instanceof SyncError && error.code === "not-found")
+      throw new SyncError("write-denied");
+    throw error;
+  }
+  if (res.status === 401 || res.status === 403)
+    throw new SyncError("write-denied");
+  await readJson(res);
+}
+async function readGist(id, etag, now = Date.now(), token) {
+  const ask = (auth) => request(`${API}/${id}`, {
+    headers: {
+      ...headers(auth),
+      ...etag ? { "if-none-match": etag } : {}
+    }
+  }, now);
+  let res = await ask(token);
+  if (res.status === 401 && token)
+    res = await ask();
+  if (res.status === 304)
+    return { changed: false };
+  const json = await readJson(res);
+  const file = isPlainObject2(json.files) ? json.files[GIST_FILE] : undefined;
+  if (!isPlainObject2(file) || typeof file.content !== "string")
+    throw new SyncError("bad-blob");
+  if (file.truncated === true || file.content.length > MAX_BLOB_BYTES)
+    throw new SyncError("too-large");
+  const next = res.headers.get("etag");
+  return {
+    changed: true,
+    content: file.content,
+    ...next ? { etag: next } : {}
+  };
+}
+
+// src/sync/state.ts
+var WRITES = ["ok", "no-token", "denied", "unreadable"];
+function newMap(from) {
+  const map = Object.create(null);
+  if (from)
+    for (const [key, value] of Object.entries(from))
+      map[key] = value;
+  return map;
+}
+function newRefs(from) {
+  return newMap(from);
+}
+var STATE_LOCK = {
+  staleMs: 30000,
+  timeoutMs: 30000,
+  retryMs: 25,
+  heartbeatMs: 5000
+};
+function isRef(value) {
+  return isPlainObject2(value) && typeof value.accountId === "string" && typeof value.fingerprint === "string";
+}
+function isSkip(value) {
+  return isPlainObject2(value) && typeof value.fingerprint === "string" && typeof value.blocker === "string" && typeof value.holds === "string";
+}
+function readMap(raw, accept) {
+  const map = newMap();
+  if (isPlainObject2(raw)) {
+    for (const [key, value] of Object.entries(raw))
+      if (accept(value))
+        map[key] = value;
+  }
+  return map;
+}
+function isWrite(value) {
+  return typeof value === "string" && WRITES.includes(value);
+}
+function parseState(text) {
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isPlainObject2(json) || json.v !== 1 || typeof json.gistId !== "string" || !GIST_ID_RE.test(json.gistId) || typeof json.key !== "string" || !decodeKey(json.key))
+    return null;
+  const { owner, etag, syncedAt, uploadedDigest, write } = json;
+  const { uploadedAt, appliedAt, retryAt, pollAt, writeCheckAt } = json;
+  return {
+    v: 1,
+    gistId: json.gistId,
+    key: json.key,
+    creator: json.creator === true,
+    imported: readMap(json.imported, isRef),
+    skipped: readMap(json.skipped, isSkip),
+    ...typeof owner === "string" ? { owner } : {},
+    ...isWrite(write) ? { write } : {},
+    ...typeof etag === "string" ? { etag } : {},
+    ...isFiniteNumber(syncedAt) ? { syncedAt } : {},
+    ...typeof uploadedDigest === "string" ? { uploadedDigest } : {},
+    ...isFiniteNumber(uploadedAt) ? { uploadedAt } : {},
+    ...isFiniteNumber(appliedAt) ? { appliedAt } : {},
+    ...isFiniteNumber(retryAt) ? { retryAt } : {},
+    ...isFiniteNumber(pollAt) ? { pollAt } : {},
+    ...isFiniteNumber(writeCheckAt) ? { writeCheckAt } : {}
+  };
+}
+async function readSyncState() {
+  const text = await readFile5(syncStateFilePath(), "utf8").catch(() => null);
+  return text === null ? null : parseState(text);
+}
+async function updateSyncState(fn) {
+  return withLock(`${syncStateFilePath()}.lock`, STATE_LOCK, async () => {
+    const next = fn(await readSyncState());
+    if (next === null)
+      await rm2(syncStateFilePath(), { force: true });
+    else
+      await writeJsonAtomic(syncStateFilePath(), JSON.stringify(next));
+    return next;
+  });
+}
+async function writeSyncStatus(status) {
+  await writeJsonAtomic(syncStatusFilePath(), JSON.stringify(status)).catch(ignore);
+}
+
+// src/sync/apply.ts
+async function exchangeSecret(adapter, secret) {
+  try {
+    if (adapter.tokenLogin)
+      return await adapter.tokenLogin.exchange(secret);
+    if (adapter.tokensFromApiKey)
+      return await adapter.exchange(secret, "", "", "");
+  } catch {
+    return null;
+  }
+  return null;
+}
+function dropRow(pool, id) {
+  pool.accounts = pool.accounts.filter((a) => a.id !== id);
+  for (const [provider, selected] of Object.entries(pool.lastSelected))
+    if (selected === id)
+      delete pool.lastSelected[provider];
+  for (const [key, session] of Object.entries(pool.sessions))
+    if (session.accountId === id)
+      delete pool.sessions[key];
+}
+function release3(pool, row) {
+  if (row.refresh) {
+    delete row.inferenceToken;
+    delete row.inferenceExpires;
+  } else
+    dropRow(pool, row.id);
+}
+function uniqueLabel(pool, label) {
+  const used = new Set(pool.accounts.map((a) => a.label));
+  let candidate = label;
+  for (let n = 2;used.has(candidate); n++)
+    candidate = `${label} (${n})`;
+  return candidate;
+}
+async function strip(ref) {
+  return mutatePool((pool) => {
+    const row = findAccount(pool, ref.accountId);
+    if (!row || !holdsFingerprint(row, ref.fingerprint))
+      return false;
+    release3(pool, row);
+    return true;
+  });
+}
+function land(pool, { entry, previous }, tokens) {
+  const digest = fingerprint(entry.secret);
+  const sameProvider = (a) => a.providerID === entry.providerID;
+  const owned = previous ? pool.accounts.find((a) => a.id === previous.accountId && holdsFingerprint(a, previous.fingerprint)) : undefined;
+  const prev = owned && sameProvider(owned) ? owned : undefined;
+  if (owned && !prev)
+    release3(pool, owned);
+  const blocker = pool.accounts.find((a) => a !== prev && sameProvider(a) && (holdsFingerprint(a, digest) || !tokens.inferenceOnly && holdsCredential(a, tokens))) ?? (tokens.inferenceOnly && !prev ? tokenSharer(pool.accounts.filter(sameProvider), tokens) : undefined);
+  if (blocker) {
+    if (prev)
+      release3(pool, prev);
+    return {
+      kind: "skipped",
+      blocker: blocker.id,
+      holds: staticFingerprint(blocker)
+    };
+  }
+  return {
+    kind: "placed",
+    row: placeTokens(pool, entry.providerID, tokens, uniqueLabel(pool, entry.label), prev?.id)
+  };
+}
+async function applyPlan(plan, memory, adapters = ADAPTERS) {
+  const result = {
+    imported: newRefs(memory.imported),
+    skipped: newMap(memory.skipped),
+    added: 0,
+    updated: 0,
+    removed: 0,
+    deferred: 0
+  };
+  for (const key of plan.forgets)
+    delete result.skipped[key];
+  for (const job of plan.imports) {
+    const { entry, previous } = job;
+    const key = entryKey(entry);
+    try {
+      const adapter = adapterFor(adapters, entry.providerID);
+      const tokens = adapter && await exchangeSecret(adapter, entry.secret);
+      if (!tokens) {
+        result.deferred += 1;
+        continue;
+      }
+      if (tokens.inferenceOnly && entry.expiresAt)
+        tokens.inferenceExpires = entry.expiresAt;
+      const landing = await mutatePool((pool) => land(pool, job, tokens));
+      if (landing.kind === "skipped") {
+        delete result.imported[key];
+        result.skipped[key] = {
+          fingerprint: fingerprint(entry.secret),
+          blocker: landing.blocker,
+          holds: landing.holds
+        };
+      } else {
+        delete result.skipped[key];
+        result.imported[key] = {
+          accountId: landing.row.id,
+          fingerprint: fingerprint(entry.secret)
+        };
+        if (previous)
+          result.updated += 1;
+        else
+          result.added += 1;
+      }
+    } catch {
+      result.deferred += 1;
+    }
+  }
+  for (const [key, ref] of plan.drops) {
+    try {
+      if (await strip(ref))
+        result.removed += 1;
+      delete result.imported[key];
+    } catch {
+      result.deferred += 1;
+    }
+  }
+  return result;
+}
+var MAX_PASSES = 3;
+async function applySnapshot(snapshot, memory, options = {}) {
+  const { adapters = ADAPTERS, afterPass } = options;
+  const total = {
+    imported: newRefs(memory.imported),
+    skipped: newMap(memory.skipped),
+    added: 0,
+    updated: 0,
+    removed: 0,
+    deferred: 0
+  };
+  for (let pass = 0;pass < MAX_PASSES; pass++) {
+    const plan = planMerge((await readPool()).accounts, snapshot, {
+      origin: memory.origin,
+      imported: total.imported,
+      skipped: total.skipped
+    });
+    const done = await applyPlan(plan, total, adapters);
+    total.imported = done.imported;
+    total.skipped = done.skipped;
+    total.added += done.added;
+    total.updated += done.updated;
+    total.removed += done.removed;
+    total.deferred = done.deferred;
+    await afterPass?.(total);
+    if (done.removed === 0)
+      break;
+  }
+  return total;
+}
+
+// src/sync/github-auth.ts
+import { execFile } from "node:child_process";
+var GH_TIMEOUT_MS = 5000;
+function ghAuthToken(exec = execFile) {
+  return new Promise((resolve, reject) => {
+    exec("gh", ["auth", "token"], { timeout: GH_TIMEOUT_MS, windowsHide: true, maxBuffer: 64 * 1024 }, (error, stdout) => error ? reject(error) : resolve(stdout));
+  });
+}
+async function discoverGithubToken(run = ghAuthToken, env = process.env) {
+  for (const name of ["GITHUB_TOKEN", "GH_TOKEN"]) {
+    const value = env[name]?.trim();
+    if (value)
+      return value;
+  }
+  const token = (await run().catch(() => "")).trim();
+  return token || null;
+}
+
+// src/sync/origin.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { readFile as readFile6 } from "node:fs/promises";
+var ORIGIN_LOCK = {
+  staleMs: 30000,
+  timeoutMs: 30000,
+  retryMs: 25,
+  heartbeatMs: 5000
+};
+async function readOrigin() {
+  const text = await readFile6(syncOriginFilePath(), "utf8").catch(() => null);
+  if (text === null)
+    return null;
+  try {
+    const json = JSON.parse(text);
+    return isPlainObject2(json) && typeof json.origin === "string" && ORIGIN_RE.test(json.origin) ? json.origin : null;
+  } catch {
+    return null;
+  }
+}
+async function machineOrigin() {
+  const known = await readOrigin();
+  if (known)
+    return known;
+  return withLock(`${syncOriginFilePath()}.lock`, ORIGIN_LOCK, async () => {
+    const raced = await readOrigin();
+    if (raced)
+      return raced;
+    const origin = randomBytes2(16).toString("hex");
+    await writeJsonAtomic(syncOriginFilePath(), JSON.stringify({ origin }));
+    return origin;
+  });
+}
+
+// src/sync/own.ts
+function staticSecret(row) {
+  if (row.providerID === "anthropic")
+    return row.inferenceToken;
+  return !row.refresh && row.expires === STATIC_CREDENTIAL_EXPIRES ? row.access : undefined;
+}
+function importedRows(accounts, imported) {
+  const ids = new Set;
+  for (const ref of Object.values(imported)) {
+    const row = accounts.find((a) => a.id === ref.accountId);
+    if (row && holdsFingerprint(row, ref.fingerprint))
+      ids.add(row.id);
+  }
+  return ids;
+}
+function ownEntries(pool, origin, imported) {
+  const fromSync = importedRows(pool.accounts, imported);
+  const entries = [];
+  for (const row of pool.accounts) {
+    if (!SECRET_SHAPES.has(row.providerID) || fromSync.has(row.id))
+      continue;
+    if (row.disabledReason || row.lostLogins?.token)
+      continue;
+    const entry = parseEntry({
+      origin,
+      id: row.id,
+      providerID: row.providerID,
+      label: printable(row.label).slice(0, MAX_LABEL).trim() || row.providerID,
+      secret: staticSecret(row),
+      expiresAt: row.inferenceExpires
+    });
+    if (entry)
+      entries.push(entry);
+  }
+  return sortEntries(entries).slice(0, MAX_ENTRIES);
+}
+function listable(own, others, origin) {
+  const taken = new Set(others.filter((e) => e.origin < origin).map((e) => fingerprint(e.secret)));
+  return own.filter((e) => !taken.has(fingerprint(e.secret))).slice(0, Math.max(0, MAX_ENTRIES - others.length));
+}
+
+// src/sync/timing.ts
+var POLL_MS = 15 * 60000;
+var PUBLISH_RETRY_MS = 5 * 60000;
+
+// src/sync/cycle.ts
+var WRITE_BACKOFF_MS = 3600000;
+var UNREADABLE_NOTE = "The gist has entries this version cannot read; update this plugin to upload.";
+function count(n, one, many) {
+  return `${n} ${n === 1 ? one : many}`;
+}
+function recordApplied(gistId, at, applied, syncedAt) {
+  return updateSyncState((cur) => cur?.gistId === gistId ? {
+    ...cur,
+    imported: applied.imported,
+    skipped: applied.skipped,
+    appliedAt: Math.max(at, cur.appliedAt ?? 0),
+    syncedAt,
+    etag: undefined
+  } : cur);
+}
+async function runCycle(deps, force, report) {
+  const { now } = deps;
+  const state = await readSyncState();
+  if (!state)
+    throw new SyncError("not-set-up");
+  const key = decodeKey(state.key) ?? Buffer.alloc(32);
+  const origin = await machineOrigin();
+  const token = await discoverGithubToken(deps.runGh);
+  if (force && !token)
+    throw new SyncError("no-auth");
+  const pool = await readPool();
+  const backedOff = state.write === "denied" && !force && now() < (state.writeCheckAt ?? 0);
+  const mayWrite = token !== null && !backedOff;
+  const before = entriesDigest(ownEntries(pool, origin, state.imported));
+  const dirty = mayWrite && before !== state.uploadedDigest;
+  report.retryMs = dirty ? PUBLISH_RETRY_MS : POLL_MS;
+  const reread = force || dirty || hasFreedSkips(pool.accounts, state.skipped);
+  const auth = token ?? undefined;
+  let read = await readGist(state.gistId, state.etag, now(), auth);
+  if (!read.changed && reread)
+    read = await readGist(state.gistId, undefined, now(), auth);
+  const standing = token === null ? "no-token" : backedOff ? "denied" : "ok";
+  if (!read.changed) {
+    const write = standing === "ok" && state.write === "unreadable" ? "unreadable" : standing;
+    await updateSyncState((cur) => cur?.gistId === state.gistId ? { ...cur, syncedAt: now(), write } : cur);
+    return "Up to date.";
+  }
+  const snapshot = parsePayload(open(read.content, key));
+  const stale = state.appliedAt !== undefined && snapshot.at < state.appliedAt;
+  if (stale && !mayWrite)
+    throw new SyncError("rolled-back");
+  const applied = stale ? null : await applySnapshot(snapshot, { origin, imported: state.imported, skipped: state.skipped }, {
+    ...deps.adapters ? { adapters: deps.adapters } : {},
+    afterPass: (soFar) => recordApplied(state.gistId, snapshot.at, soFar, now())
+  });
+  const own = ownEntries(await readPool(), origin, applied?.imported ?? state.imported);
+  const unreadable = snapshot.unreadable > 0;
+  let write = standing;
+  let wrote = null;
+  let stamped = 0;
+  let denied = false;
+  if (mayWrite && unreadable)
+    write = "unreadable";
+  if (mayWrite && !unreadable) {
+    const others = snapshot.entries.filter((e) => e.origin !== origin);
+    const next = sortEntries([...others, ...listable(own, others, origin)]);
+    const same = JSON.stringify(next) === JSON.stringify(sortEntries(snapshot.entries));
+    if (!same || stale) {
+      stamped = Math.max(now(), snapshot.at + 1, (state.uploadedAt ?? 0) + 1, (state.appliedAt ?? 0) + 1);
+      try {
+        await updateGist(token, state.gistId, seal(buildPayload(next, stamped), key), now());
+        wrote = next.filter((e) => e.origin === origin);
+      } catch (error) {
+        if (!(error instanceof SyncError) || error.code !== "write-denied")
+          throw error;
+        denied = true;
+        write = "denied";
+      }
+    }
+  }
+  const deferred = applied?.deferred ?? 0;
+  await updateSyncState((cur) => cur?.gistId === state.gistId ? {
+    ...cur,
+    syncedAt: now(),
+    etag: wrote || stale || deferred > 0 || denied ? undefined : read.etag,
+    write,
+    writeCheckAt: denied ? now() + WRITE_BACKOFF_MS : backedOff ? cur.writeCheckAt : undefined,
+    uploadedDigest: mayWrite && !unreadable && !denied ? entriesDigest(own) : cur.uploadedDigest,
+    ...wrote ? { uploadedAt: stamped } : {}
+  } : cur);
+  const parts = [];
+  const moved = applied ? applied.added + applied.updated + applied.removed + deferred : 0;
+  if (applied && moved > 0) {
+    const tail = deferred > 0 ? `; ${count(deferred, "entry", "entries")} could not be verified yet` : "";
+    parts.push(`Synced: ${applied.added} added, ${applied.updated} updated, ${applied.removed} removed${tail}.`);
+  } else if (!wrote)
+    parts.push("Up to date.");
+  if (wrote)
+    parts.push(`Uploaded ${count(wrote.length, "credential", "credentials")}.`);
+  if (denied)
+    parts.push(new SyncError("write-denied").message);
+  if (mayWrite && unreadable && state.write !== "unreadable")
+    parts.push(UNREADABLE_NOTE);
+  return parts.join(" ");
+}
+
+// src/sync/engine.ts
+function count2(n, one, many) {
+  return `${n} ${n === 1 ? one : many}`;
+}
+function createEngine(deps) {
+  const { now } = deps;
+  async function settle(work, reqAt, scheduled) {
+    const report = { retryMs: POLL_MS };
+    let outcome;
+    try {
+      outcome = { ok: true, message: await work(report) };
+    } catch (error) {
+      outcome = {
+        ok: false,
+        message: describeSyncError(error),
+        ...error instanceof SyncError && error.retryAfterMs ? { backoffMs: error.retryAfterMs } : {}
+      };
+    }
+    if (scheduled) {
+      const wait = outcome.backoffMs ?? report.retryMs;
+      await updateSyncState((cur) => cur && (outcome.ok ? { ...cur, pollAt: now() + POLL_MS, retryAt: undefined } : { ...cur, retryAt: now() + wait }));
+    }
+    await writeSyncStatus({
+      at: now(),
+      ok: outcome.ok,
+      message: outcome.message,
+      ...reqAt === undefined ? {} : { reqAt }
+    });
+    return outcome;
+  }
+  const cycle = (force) => (report) => runCycle(deps, force, report);
+  async function create() {
+    const token = await discoverGithubToken(deps.runGh);
+    if (!token)
+      throw new SyncError("no-auth");
+    const origin = await machineOrigin();
+    const own = ownEntries(await readPool(), origin, newRefs());
+    const key = generateKey();
+    const at = now();
+    const gist = await createGist(token, seal(buildPayload(own, at), key), now());
+    await updateSyncState(() => ({
+      v: 1,
+      gistId: gist.id,
+      key: encodeKey(key),
+      creator: true,
+      ...gist.owner ? { owner: gist.owner } : {},
+      write: "ok",
+      syncedAt: now(),
+      uploadedDigest: entriesDigest(own),
+      uploadedAt: at,
+      appliedAt: at,
+      pollAt: now() + POLL_MS,
+      imported: newRefs(),
+      skipped: newMap()
+    }));
+    return `Uploaded ${count2(own.length, "credential", "credentials")}.`;
+  }
+  async function unpublishedDigest() {
+    const state = await readSyncState();
+    if (!state || state.write === "no-token" || state.write === "unreadable" || state.write === "denied" && now() < (state.writeCheckAt ?? 0))
+      return null;
+    const own = ownEntries(await readPool(), await machineOrigin(), state.imported);
+    const digest = entriesDigest(own);
+    return digest === state.uploadedDigest ? null : digest;
+  }
+  const engine = {
+    sync: (reqAt) => settle(cycle(false), reqAt, true),
+    async upload(fresh, reqAt) {
+      const state = await readSyncState();
+      return fresh || !state ? settle(create, reqAt, false) : settle(cycle(true), reqAt, true);
+    },
+    async subscribe(link, reqAt) {
+      const parsed = parseGistLink(link);
+      if (!parsed)
+        return settle(() => Promise.reject(new SyncError("bad-link")), reqAt, false);
+      await updateSyncState((cur) => {
+        const prior = cur?.gistId === parsed.id ? cur : null;
+        return {
+          v: 1,
+          gistId: parsed.id,
+          key: encodeKey(parsed.key),
+          creator: prior?.creator ?? false,
+          ...prior?.owner ? { owner: prior.owner } : {},
+          imported: prior?.imported ?? newRefs(),
+          skipped: prior?.skipped ?? newMap()
+        };
+      });
+      return settle(cycle(false), reqAt, true);
+    },
+    async forget(reqAt) {
+      return settle(async () => {
+        await updateSyncState(() => null);
+        return "Stopped syncing. Imported accounts stay in the pool.";
+      }, reqAt, false);
+    },
+    unpublishedDigest,
+    async backgroundPoll(gistId) {
+      const state = await readSyncState();
+      if (state?.gistId !== gistId || now() < Math.max(state.pollAt ?? 0, state.retryAt ?? 0))
+        return null;
+      return engine.sync();
+    },
+    async backgroundPublish(gistId, digest) {
+      const state = await readSyncState();
+      if (state?.gistId !== gistId || now() < (state.retryAt ?? 0) || await unpublishedDigest() !== digest)
+        return null;
+      return engine.sync();
+    }
+  };
+  return engine;
+}
+
+// src/sync/intent.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { access, readFile as readFile7, rename as rename2, rm as rm3 } from "node:fs/promises";
+var INTENT_TTL_MS = 10 * 60000;
+var INTENT_SKEW_MS = 60000;
+var MAX_LINK_CHARS = 2048;
+var CLAIM_WAIT_MS = 2000;
+function claimLock(timeoutMs) {
+  return { staleMs: 1e4, timeoutMs, retryMs: 10, heartbeatMs: 2000 };
+}
+var ACTIONS = [
+  "upload",
+  "upload-new",
+  "subscribe",
+  "sync",
+  "forget"
+];
+function isAction(value) {
+  return typeof value === "string" && ACTIONS.includes(value);
+}
+function parseIntent(text, now) {
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isPlainObject2(json) || !isAction(json.action) || !isFiniteNumber(json.at) || now - json.at > INTENT_TTL_MS || json.at - now > INTENT_SKEW_MS)
+    return null;
+  const link = typeof json.link === "string" && json.link.length <= MAX_LINK_CHARS ? json.link : undefined;
+  return { action: json.action, at: json.at, ...link ? { link } : {} };
+}
+function intentPending() {
+  return access(syncIntentFilePath()).then(() => true, () => false);
+}
+async function takeIntent(now, waitMs = CLAIM_WAIT_MS, afterClaim) {
+  const path = syncIntentFilePath();
+  if (!await intentPending())
+    return null;
+  try {
+    return await withLock(`${path}.lock`, claimLock(waitMs), async () => {
+      const claimed = `${path}.${randomUUID3()}.claimed`;
+      try {
+        await rename2(path, claimed);
+      } catch {
+        return null;
+      }
+      try {
+        await afterClaim?.();
+        return parseIntent(await readFile7(claimed, "utf8"), now);
+      } finally {
+        await rm3(claimed, { force: true });
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+
+// src/sync/loop.ts
+var TICK_MS = 1000;
+var CHANGE_CHECK_MS = 5000;
+var DEBOUNCE_MS = 1e4;
+var LOCK_WAIT_MS = 500;
+var DISPOSE_WAIT_MS = 2000;
+var realTimers = {
+  set(run, ms) {
+    const handle = setInterval(run, ms);
+    handle.unref();
+    return handle;
+  },
+  clear: (handle) => clearInterval(handle)
+};
+async function withCycleLock(fn, waitMs) {
+  const options = {
+    staleMs: 20000,
+    timeoutMs: waitMs,
+    retryMs: 25,
+    heartbeatMs: 5000
+  };
+  try {
+    return await withLock(`${syncStateFilePath()}.cycle.lock`, options, fn);
+  } catch (error) {
+    if (error instanceof LockTimeoutError)
+      return;
+    throw error;
+  }
+}
+var fileIntents = { pending: intentPending, take: takeIntent };
+function createSyncLoop(deps) {
+  const { engine, now } = deps;
+  const timers = deps.timers ?? realTimers;
+  const intents = deps.intents ?? fileIntents;
+  const lockWaitMs = deps.lockWaitMs ?? LOCK_WAIT_MS;
+  const disposeWaitMs = deps.disposeWaitMs ?? DISPOSE_WAIT_MS;
+  let handle;
+  let busy = false;
+  let disposed = false;
+  let inflight = Promise.resolve();
+  let checkAt = 0;
+  let pending = null;
+  function run(intent) {
+    switch (intent.action) {
+      case "upload":
+        return engine.upload(false, intent.at);
+      case "upload-new":
+        return engine.upload(true, intent.at);
+      case "subscribe":
+        return engine.subscribe(intent.link ?? "", intent.at);
+      case "sync":
+        return engine.sync(intent.at);
+      case "forget":
+        return engine.forget(intent.at);
+    }
+  }
+  async function serveRequest(t) {
+    await withCycleLock(async () => {
+      const intent = await intents.take(t);
+      if (intent)
+        await run(intent);
+    }, lockWaitMs);
+    pending = null;
+  }
+  async function publishWhenSettled(t, state) {
+    if (t < (state.retryAt ?? 0))
+      return;
+    const digest = await engine.unpublishedDigest();
+    if (digest === null) {
+      pending = null;
+      return;
+    }
+    if (pending?.digest !== digest) {
+      pending = { digest, since: t };
+      return;
+    }
+    if (t - pending.since < DEBOUNCE_MS)
+      return;
+    const outcome = await withCycleLock(() => engine.backgroundPublish(state.gistId, digest), lockWaitMs);
+    if (outcome?.ok)
+      pending = null;
+  }
+  async function background(t) {
+    if (t < checkAt)
+      return;
+    checkAt = t + CHANGE_CHECK_MS;
+    const state = await readSyncState();
+    if (!state)
+      return;
+    if (t >= Math.max(state.pollAt ?? 0, state.retryAt ?? 0)) {
+      await withCycleLock(() => engine.backgroundPoll(state.gistId), lockWaitMs);
+      return;
+    }
+    await publishWhenSettled(t, state);
+  }
+  async function step() {
+    try {
+      const t = now();
+      if (await intents.pending())
+        await serveRequest(t);
+      else
+        await background(t);
+    } catch {}
+  }
+  function tick() {
+    if (busy || disposed)
+      return Promise.resolve();
+    busy = true;
+    inflight = step().finally(() => {
+      busy = false;
+    });
+    return inflight;
+  }
+  return {
+    start() {
+      handle = timers.set(() => void tick().catch(ignore), TICK_MS);
+      tick().catch(ignore);
+    },
+    async dispose() {
+      disposed = true;
+      timers.clear(handle);
+      let timer;
+      await Promise.race([
+        inflight,
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, disposeWaitMs);
+        })
+      ]);
+      clearTimeout(timer);
+    },
+    tick
+  };
+}
+
+// src/sync/start.ts
+function syncEnabled(env = process.env) {
+  const raw = env.OPENCODE_AUTH_LB_SYNC?.trim().toLowerCase();
+  return raw !== "0" && raw !== "false" && raw !== "no" && raw !== "off";
+}
+function startSync() {
+  if (!syncEnabled())
+    return null;
+  const loop = createSyncLoop({
+    engine: createEngine({ now: Date.now }),
+    now: Date.now
+  });
+  loop.start();
+  return loop;
+}
+
 // src/index.ts
 var PROVIDER_LABELS = {
   anthropic: "Claude Pro/Max",
@@ -15871,8 +17503,17 @@ function zeroOutCost(provider) {
 function buildAuthHook(adapter, client, pending) {
   const label = PROVIDER_LABELS[adapter.id] ?? adapter.id;
   const startDeviceLogin = adapter.startDeviceLogin;
+  const tokenLogin = adapter.tokenLogin;
   const register = async (tokens) => {
-    await addAccount(adapter.id, tokens);
+    if (!tokens.usage) {
+      const usage = await adapter.fetchUsage(makeAccount(adapter.id, "", tokens), Date.now()).catch(ignore);
+      if (usage)
+        tokens.usage = usage;
+    }
+    const account = await addAccount(adapter.id, tokens);
+    const minted = await mintAtLogin(adapter, account);
+    if (minted || account.inferenceToken !== undefined && account.refresh)
+      notifyPaired(client, adapter.id, account);
     await refreshUsageInBackground(adapter, Date.now()).catch(ignore);
   };
   const oauthSuccess = (tokens) => ({
@@ -15888,6 +17529,7 @@ function buildAuthHook(adapter, client, pending) {
       zeroOutCost(provider);
       await adapter.prime?.(Date.now()).catch(ignore);
       refreshUsageInBackground(adapter, Date.now()).then(() => primeInUse(adapter.id, Date.now())).catch(ignore);
+      maintainTokens(adapter, Date.now()).catch(ignore);
       return {
         apiKey: "",
         fetch: createLoadBalancedFetch(adapter, {
@@ -15942,7 +17584,25 @@ function buildAuthHook(adapter, client, pending) {
             }
           };
         }
-      }
+      },
+      ...tokenLogin ? [
+        {
+          label: `${label} ${tokenLogin.label} (add account to load balancer)`,
+          type: "oauth",
+          authorize: async () => ({
+            url: tokenLogin.url,
+            instructions: tokenLogin.instructions,
+            method: "code",
+            callback: async (code) => {
+              const tokens = await tokenLogin.exchange(code);
+              if (!tokens)
+                return { type: "failed" };
+              await register(tokens);
+              return oauthSuccess(tokens);
+            }
+          })
+        }
+      ] : []
     ]
   };
 }
@@ -15985,76 +17645,80 @@ var OpenAILoadBalancerPlugin = createProviderPlugin(openaiAdapter);
 var KimiCodeLoadBalancerPlugin = createProviderPlugin(kimiCodeAdapter);
 var KimiCodeGlobalLoadBalancerPlugin = createProviderPlugin(kimiCodeGlobalAdapter);
 var lbResult = (output) => ({ title: "Auth Load Balancer", output });
-var AuthLoadBalancerStatusPlugin = async (input) => ({
-  tool: {
-    auth_lb_status: tool({
-      description: "Show the auth load-balancer pool: the in-use account per provider, each account's weekly and 5h usage, cooldowns, and the ranked next-candidate accounts. Refreshes stale usage from the provider usage endpoints (throttled) before rendering.",
-      args: {},
-      execute: async () => {
-        const now = Date.now();
-        const pool = await readPool();
-        await refreshAllUsageInBackground(now, pool).catch(ignore);
-        const renderedAt = Date.now();
-        const status = renderStatus(await readStatus(renderedAt), renderedAt);
-        const pending = renderPendingStatus(await listPendingForWorkspace(input.worktree || input.directory), renderedAt);
-        return lbResult(pending ? `${status}
+var AuthLoadBalancerStatusPlugin = async (input) => {
+  const sync = startSync();
+  return {
+    dispose: async () => sync?.dispose(),
+    tool: {
+      auth_lb_status: tool({
+        description: "Show the auth load-balancer pool: the in-use account per provider, each account's weekly and 5h usage, cooldowns, and the ranked next-candidate accounts. Refreshes stale usage from the provider usage endpoints (throttled) before rendering.",
+        args: {},
+        execute: async () => {
+          const now = Date.now();
+          const pool = await readPool();
+          await refreshAllUsageInBackground(now, pool).catch(ignore);
+          const renderedAt = Date.now();
+          const status = renderStatus(await readStatus(renderedAt), renderedAt);
+          const pending = renderPendingStatus(await listPendingForWorkspace(input.worktree || input.directory), renderedAt);
+          return lbResult(pending ? `${status}
 
 ${pending}` : status);
-      }
-    }),
-    auth_lb_rename: tool({
-      description: "Rename a pooled account. Match the account by its current label or its id, then set a new label. The new label appears in the switch toast, the auth_lb_status dashboard, and the TUI bar/sidebar.",
-      args: {
-        account: tool.schema.string().describe("Current label or id of the account to rename"),
-        name: tool.schema.string().describe("New label for the account")
-      },
-      execute: async ({ account, name }) => {
-        const trimmed = name.trim();
-        if (!trimmed)
-          return lbResult("New label must not be empty.");
-        const result = await mutatePool((pool) => {
-          const target = pool.accounts.find((a) => a.id === account || a.label === account);
-          if (!target)
-            return {
-              ok: false,
-              reason: "missing",
-              labels: pool.accounts.map((a) => `${a.label} (${a.providerID})`)
-            };
-          if (pool.accounts.some((a) => a.id !== target.id && a.label === trimmed))
-            return { ok: false, reason: "taken" };
-          const previous = target.label;
-          target.label = trimmed;
-          return { ok: true, previous };
-        });
-        if (!result.ok)
-          return lbResult(result.reason === "taken" ? `Label "${trimmed}" is already used by another account.` : `No account matching "${account}". Available: ${result.labels.join(", ") || "(none)"}`);
-        return lbResult(`Renamed "${result.previous}" → "${trimmed}".`);
-      }
-    }),
-    auth_lb_disable: tool({
-      description: "Disable a pooled account so the load balancer stops selecting it (match by current label or id), or re-enable a previously disabled one with `enable: true`. A disabled account is skipped by scheduling and shows as `disabled` in the auth_lb_status dashboard — separate from an account that needs re-login.",
-      args: {
-        account: tool.schema.string().describe("Current label or id of the account to disable/enable"),
-        enable: tool.schema.boolean().optional().describe("Set true to re-enable a previously disabled account; omit or false to disable it")
-      },
-      execute: async ({ account, enable }) => {
-        const result = await mutatePool((pool) => {
-          const target = pool.accounts.find((a) => a.id === account || a.label === account);
-          if (!target)
-            return {
-              ok: false,
-              labels: pool.accounts.map((a) => `${a.label} (${a.providerID})`)
-            };
-          target.disabledReason = enable ? null : MANUAL_DISABLED_REASON;
-          return { ok: true, label: target.label, enabled: !!enable };
-        });
-        if (!result.ok)
-          return lbResult(`No account matching "${account}". Available: ${result.labels.join(", ") || "(none)"}`);
-        return lbResult(result.enabled ? `Enabled "${result.label}" — back in the load-balancer rotation.` : `Disabled "${result.label}" — the load balancer will skip it until you re-enable it.`);
-      }
-    })
-  }
-});
+        }
+      }),
+      auth_lb_rename: tool({
+        description: "Rename a pooled account. Match the account by its current label or its id, then set a new label. The new label appears in the switch toast, the auth_lb_status dashboard, and the TUI bar/sidebar.",
+        args: {
+          account: tool.schema.string().describe("Current label or id of the account to rename"),
+          name: tool.schema.string().describe("New label for the account")
+        },
+        execute: async ({ account, name }) => {
+          const trimmed = name.trim();
+          if (!trimmed)
+            return lbResult("New label must not be empty.");
+          const result = await mutatePool((pool) => {
+            const target = pool.accounts.find((a) => a.id === account || a.label === account);
+            if (!target)
+              return {
+                ok: false,
+                reason: "missing",
+                labels: pool.accounts.map((a) => `${a.label} (${a.providerID})`)
+              };
+            if (pool.accounts.some((a) => a.id !== target.id && a.label === trimmed))
+              return { ok: false, reason: "taken" };
+            const previous = target.label;
+            target.label = trimmed;
+            return { ok: true, previous };
+          });
+          if (!result.ok)
+            return lbResult(result.reason === "taken" ? `Label "${trimmed}" is already used by another account.` : `No account matching "${account}". Available: ${result.labels.join(", ") || "(none)"}`);
+          return lbResult(`Renamed "${result.previous}" → "${trimmed}".`);
+        }
+      }),
+      auth_lb_disable: tool({
+        description: "Disable a pooled account so the load balancer stops selecting it (match by current label or id), or re-enable a previously disabled one with `enable: true`. A disabled account is skipped by scheduling and shows as `disabled` in the auth_lb_status dashboard — separate from an account that needs re-login.",
+        args: {
+          account: tool.schema.string().describe("Current label or id of the account to disable/enable"),
+          enable: tool.schema.boolean().optional().describe("Set true to re-enable a previously disabled account; omit or false to disable it")
+        },
+        execute: async ({ account, enable }) => {
+          const result = await mutatePool((pool) => {
+            const target = pool.accounts.find((a) => a.id === account || a.label === account);
+            if (!target)
+              return {
+                ok: false,
+                labels: pool.accounts.map((a) => `${a.label} (${a.providerID})`)
+              };
+            target.disabledReason = enable ? null : MANUAL_DISABLED_REASON;
+            return { ok: true, label: target.label, enabled: !!enable };
+          });
+          if (!result.ok)
+            return lbResult(`No account matching "${account}". Available: ${result.labels.join(", ") || "(none)"}`);
+          return lbResult(result.enabled ? `Enabled "${result.label}" — back in the load-balancer rotation.` : `Disabled "${result.label}" — the load balancer will skip it until you re-enable it.`);
+        }
+      })
+    }
+  };
+};
 export {
   AnthropicLoadBalancerPlugin,
   AuthLoadBalancerStatusPlugin,