opencode-auth-load-balancer 0.7.1 → 0.8.0

package/dist/refresh.d.ts

@@ -21,5 +21,7 @@ export declare function withRefreshLock<T>(providerID: string, accountId: string
  *
  * Mutates the passed `account` in place so the caller sees the new token. Concurrent
  * callers that reuse the in-flight refresh have their OWN local objects updated too.
+ * Pass rejectedAccess after HTTP 401 to refresh that token regardless of expiry;
+ * a different fresh token found on disk is adopted without another OAuth POST.
  */
-export declare function ensureAccessToken(adapter: ProviderAdapter, account: PoolAccount, now: number): Promise<string>;
+export declare function ensureAccessToken(adapter: ProviderAdapter, account: PoolAccount, now: number, rejectedAccess?: string): Promise<string>;

package/dist/v1.js

@@ -13734,10 +13734,10 @@ async function resolveInvalidGrant(adapter, accountId, attempt, reason) {
     return null;
   });
 }
-async function runRefresh(adapter, account, now) {
+async function runRefresh(adapter, account, now, rejectedAccess) {
   return withLock(refreshLockDir(adapter.id, account.id), REFRESH_LOCK, async () => {
     const latest = await readPoolAccount(account.id) ?? account;
-    if (!needsRefresh(latest, Math.max(now, Date.now())))
+    if (latest.access !== rejectedAccess && !needsRefresh(latest, Math.max(now, Date.now())))
       return tokensOf(latest);
     const attempt = {
       refresh: latest.refresh,
@@ -13767,13 +13767,13 @@ async function settleRefresh(adapter, account, job) {
     throw error;
   }
 }
-async function ensureAccessToken(adapter, account, now) {
-  if (!needsRefresh(account, now))
+async function ensureAccessToken(adapter, account, now, rejectedAccess) {
+  if (account.access !== rejectedAccess && !needsRefresh(account, now))
     return account.access;
   const existing = inflight.get(account.id);
   if (existing)
     return settleRefresh(adapter, account, existing);
-  const job = runRefresh(adapter, account, now);
+  const job = runRefresh(adapter, account, now, rejectedAccess);
   inflight.set(account.id, job);
   try {
     return await settleRefresh(adapter, account, job);
@@ -15823,6 +15823,7 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
     let tierSkipped = null;
     let clientVersionRetried = false;
     let rejectedTokens = null;
+    const refreshedAfter401 = new Set;
     let usageSeeded = false;
     const waitDeadline = Date.now() + cfg.maxWaitMs;
     for (;; ) {
@@ -15938,6 +15939,12 @@ function createLoadBalancedFetch(adapter, hooks = {}, models = [], pending) {
               log(`!! ${account.label} setup-token 401 -> retrying on its OAuth login`);
             continue;
           }
+          if (res.status === 401 && account.refresh && !refreshedAfter401.has(account.id)) {
+            refreshedAfter401.add(account.id);
+            await ensureAccessToken(adapter, account, Date.now(), account.access);
+            tried.delete(account.id);
+            continue;
+          }
           const ms = cls === "auth" ? AUTH_COOLDOWN_MS : ACCOUNT_COOLDOWN_MS;
           await recordRotation(adapter, account.id, res, ms, Date.now(), cls === "auth" ? "auth" : "quota", res.status === 401 && !account.refresh ? { key: account.access, reason: rejection } : undefined);
           if (cls === "account") {

package/dist/v2-entry.d.ts

@@ -0,0 +1,6 @@
+import type { Plugin } from '@opencode/plugin';
+declare const _default: {
+    id: string;
+    setup(ctx: Plugin.Context): Promise<Plugin.Cleanup>;
+};
+export default _default;