opencode-multi-account-core 0.2.126 → 0.3.0

package/dist/index.d.ts

@@ -52,6 +52,7 @@ declare const CredentialRefreshPatchSchema: v.ObjectSchema<{
 }, undefined>;
 declare const StoredAccountSchema: v.ObjectSchema<{
     readonly uuid: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly credentialOwnerId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
     readonly accountId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
     readonly accountUuid: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
     readonly deviceId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
@@ -88,6 +89,7 @@ declare const AccountStorageSchema: v.ObjectSchema<{
     readonly version: v.LiteralSchema<1, undefined>;
     readonly accounts: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
         readonly uuid: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly credentialOwnerId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
         readonly accountId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
         readonly accountUuid: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
         readonly deviceId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
@@ -222,18 +224,26 @@ interface DiskCredentials {
     refreshToken: string;
     accessToken?: string;
     expiresAt?: number;
+    credentialOwnerId?: string;
     accountId?: string;
     accountUuid?: string;
     deviceId?: string;
 }
+interface AccountCredentialRefreshResult {
+    result: TokenRefreshResult;
+    account: StoredAccount | null;
+}
 declare class AccountStore {
     private readonly storagePath;
     constructor(filename?: string);
     private withLock;
+    private refreshLockPath;
     load(): Promise<AccountStorage>;
     readCredentials(uuid: string): Promise<DiskCredentials | null>;
+    refreshAccountCredentials(uuid: string, expected: DiskCredentials, refresh: (refreshToken: string) => Promise<TokenRefreshResult>): Promise<AccountCredentialRefreshResult>;
     mutateAccount(uuid: string, fn: (account: StoredAccount) => void): Promise<StoredAccount | null>;
     mutateStorage(fn: (storage: AccountStorage) => void): Promise<void>;
+    mutateStorageIfCredentialsMatch(uuid: string, expected: DiskCredentials, fn: (account: StoredAccount, storage: AccountStorage) => void): Promise<boolean>;
     addAccount(account: StoredAccount): Promise<void>;
     removeAccount(uuid: string): Promise<boolean>;
     setActiveUuid(uuid: string | undefined): Promise<void>;
@@ -272,7 +282,7 @@ interface AccountManagerInstance {
     markRateLimited(uuid: string, backoffMs?: number): Promise<void>;
     markRevoked(uuid: string): Promise<void>;
     markSuccess(uuid: string): Promise<void>;
-    markAuthFailure(uuid: string, result: TokenRefreshResult): Promise<void>;
+    markAuthFailure(uuid: string, result: TokenRefreshResult, expected?: DiskCredentials): Promise<void>;
     applyUsageCache(uuid: string, usage: UsageLimits): Promise<void>;
     applyProfileCache(uuid: string, profile: ProfileData): Promise<void>;
     ensureValidToken(uuid: string, client: PluginClient): Promise<TokenRefreshResult>;
@@ -355,7 +365,7 @@ interface ExecutorAccountManager {
     refresh(): Promise<void>;
     selectAccount(stickyKey?: string): Promise<ManagedAccount | null>;
     markSuccess(uuid: string): Promise<void>;
-    markAuthFailure(uuid: string, result: TokenRefreshResult): Promise<void>;
+    markAuthFailure(uuid: string, result: TokenRefreshResult, expected?: DiskCredentials): Promise<void>;
     markRevoked(uuid: string): Promise<void>;
     hasAnyUsableAccount(): boolean;
     getMinWaitTime(): number;
@@ -778,4 +788,4 @@ declare const __openCodeNativeBootstrapAuthTestUtils: {
 
 declare function zeroCostProviderModels(provider: unknown): Promise<Record<string, any>>;
 
-export { ACCOUNTS_FILENAME, ANSI, type AccountManagerClass, type AccountManagerDependencies, type AccountManagerInstance, type AccountMetadataPatch, type AccountSelectionStrategy, AccountSelectionStrategySchema, type AccountStorage, AccountStorageSchema, AccountStore, type BuildFailoverPlanOptions, CODEX_STARTUP_PROBE_MAX_BYTES, CODEX_UNKNOWN_RATE_LIMIT_BACKOFF_MS, type CascadeState, CascadeStateManager, type ChainConfig, ChainConfigSchema, type ChainEntryConfig, ChainEntryConfigSchema, type ClaimsManager, type ClaimsMap, type ConfigLoader, type CoreConfig, type CredentialRefreshPatch, CredentialRefreshPatchSchema, type DiskCredentials, type ExecutorAccountManager, type ExecutorDependencies, type ExecutorRuntimeFactory, type FailoverCandidate, type FailoverPlan, type FailoverSkip, type KeyAction, type ManagedAccount, type MenuItem, type NativePluginLifecycle, type NativePluginLifecycleOptions, type NativePluginLoaderResult, type NativePluginManagedAccount, type NativePluginManagerClass, type NativePluginManagerLike, type NativePluginRefreshQueueLike, type NativePluginRuntimeFactoryLike, type NativePluginStoreLike, type OAuthAdapter, type OAuthAdapterPlanLabels, type OAuthAdapterTransformConfig, type OAuthCredentials, OAuthCredentialsSchema, type OpenCodeNativeAuthLoaderOptions, type OpenCodeNativeAuthMethod, type OpenCodeNativeAuthMethodsOptions, type OpenCodeNativeBootstrapAccount, type OpenCodeNativeBootstrapAuthOptions, type OpenCodeNativeBootstrapStore, type OpenCodeNativeLoaderContext, type PluginClient, type PluginConfig, PluginConfigSchema, type PoolChainConfig, PoolChainConfigSchema, type PoolConfig, PoolConfigSchema, PoolManager, type ProactiveRefreshDependencies, type ProactiveRefreshQueueClass, type ProactiveRefreshQueueInstance, type ProfileData, type QuotaResetPaceOptions, type QuotaRoutingWindow, type RateLimitAccountManager, type RateLimitDependencies, type RuntimeFactoryLike, type SelectOptions, type SseStartupSupervisorOptions, type StoredAccount, StoredAccountSchema, type SupervisedTurnResponse, TokenRefreshError, type TokenRefreshResult, type TurnFailureClass, type TurnFailurePhase, type TurnFailureSignal, type TurnResponseSupervisor, type UsageLimitEntry, UsageLimitEntrySchema, type UsageLimits, UsageLimitsSchema, __openCodeNativeBootstrapAuthTestUtils, anthropicOAuthAdapter, classifyCodexFailure, classifyCodexJsonEventFailure, classifyCodexSseStartupFailure, confirm, createAccountManagerForProvider, createClaimsManager, createConfigLoader, createExecutorForProvider, createMinimalClient, createOpenCodeNativeAuthLoader, createOpenCodeNativeAuthMethods, createOpenCodeNativePluginLifecycle, createProactiveRefreshQueueForProvider, createRateLimitHandlers, debugLog, deduplicateAccounts, drainSseFrames, formatWaitTime, getAccountLabel, getClearedOAuthBody, getConfig, getConfigDir, getErrorCode, initCoreConfig, isClaimedByOther, isCodexStartupOutputEvent, isCodexStartupOutputFrame, isTTY, isTokenRefreshError, loadAccounts, loadConfig, loadPoolChainConfig, migrateFromAuthJson, openAIOAuthAdapter, parseCodexRetryAfterSeconds, parseKey, readClaims, readStorageFromDisk, releaseClaim, resetConfigCache, savePoolChainConfig, scoreQuotaResetPace, select, setAccountsFilename, setConfigGetter, showToast, sleep, superviseCodexResponseStartup, superviseSseResponseStartup, syncOpenCodeNativeBootstrapAuth, updateConfigField, withDirectoryLock, writeClaim, zeroCostProviderModels };
+export { ACCOUNTS_FILENAME, ANSI, type AccountCredentialRefreshResult, type AccountManagerClass, type AccountManagerDependencies, type AccountManagerInstance, type AccountMetadataPatch, type AccountSelectionStrategy, AccountSelectionStrategySchema, type AccountStorage, AccountStorageSchema, AccountStore, type BuildFailoverPlanOptions, CODEX_STARTUP_PROBE_MAX_BYTES, CODEX_UNKNOWN_RATE_LIMIT_BACKOFF_MS, type CascadeState, CascadeStateManager, type ChainConfig, ChainConfigSchema, type ChainEntryConfig, ChainEntryConfigSchema, type ClaimsManager, type ClaimsMap, type ConfigLoader, type CoreConfig, type CredentialRefreshPatch, CredentialRefreshPatchSchema, type DiskCredentials, type ExecutorAccountManager, type ExecutorDependencies, type ExecutorRuntimeFactory, type FailoverCandidate, type FailoverPlan, type FailoverSkip, type KeyAction, type ManagedAccount, type MenuItem, type NativePluginLifecycle, type NativePluginLifecycleOptions, type NativePluginLoaderResult, type NativePluginManagedAccount, type NativePluginManagerClass, type NativePluginManagerLike, type NativePluginRefreshQueueLike, type NativePluginRuntimeFactoryLike, type NativePluginStoreLike, type OAuthAdapter, type OAuthAdapterPlanLabels, type OAuthAdapterTransformConfig, type OAuthCredentials, OAuthCredentialsSchema, type OpenCodeNativeAuthLoaderOptions, type OpenCodeNativeAuthMethod, type OpenCodeNativeAuthMethodsOptions, type OpenCodeNativeBootstrapAccount, type OpenCodeNativeBootstrapAuthOptions, type OpenCodeNativeBootstrapStore, type OpenCodeNativeLoaderContext, type PluginClient, type PluginConfig, PluginConfigSchema, type PoolChainConfig, PoolChainConfigSchema, type PoolConfig, PoolConfigSchema, PoolManager, type ProactiveRefreshDependencies, type ProactiveRefreshQueueClass, type ProactiveRefreshQueueInstance, type ProfileData, type QuotaResetPaceOptions, type QuotaRoutingWindow, type RateLimitAccountManager, type RateLimitDependencies, type RuntimeFactoryLike, type SelectOptions, type SseStartupSupervisorOptions, type StoredAccount, StoredAccountSchema, type SupervisedTurnResponse, TokenRefreshError, type TokenRefreshResult, type TurnFailureClass, type TurnFailurePhase, type TurnFailureSignal, type TurnResponseSupervisor, type UsageLimitEntry, UsageLimitEntrySchema, type UsageLimits, UsageLimitsSchema, __openCodeNativeBootstrapAuthTestUtils, anthropicOAuthAdapter, classifyCodexFailure, classifyCodexJsonEventFailure, classifyCodexSseStartupFailure, confirm, createAccountManagerForProvider, createClaimsManager, createConfigLoader, createExecutorForProvider, createMinimalClient, createOpenCodeNativeAuthLoader, createOpenCodeNativeAuthMethods, createOpenCodeNativePluginLifecycle, createProactiveRefreshQueueForProvider, createRateLimitHandlers, debugLog, deduplicateAccounts, drainSseFrames, formatWaitTime, getAccountLabel, getClearedOAuthBody, getConfig, getConfigDir, getErrorCode, initCoreConfig, isClaimedByOther, isCodexStartupOutputEvent, isCodexStartupOutputFrame, isTTY, isTokenRefreshError, loadAccounts, loadConfig, loadPoolChainConfig, migrateFromAuthJson, openAIOAuthAdapter, parseCodexRetryAfterSeconds, parseKey, readClaims, readStorageFromDisk, releaseClaim, resetConfigCache, savePoolChainConfig, scoreQuotaResetPace, select, setAccountsFilename, setConfigGetter, showToast, sleep, superviseCodexResponseStartup, superviseSseResponseStartup, syncOpenCodeNativeBootstrapAuth, updateConfigField, withDirectoryLock, writeClaim, zeroCostProviderModels };

package/dist/index.js

@@ -46,6 +46,7 @@ var CredentialRefreshPatchSchema = v.object({
 });
 var StoredAccountSchema = v.object({
   uuid: v.optional(v.string()),
+  credentialOwnerId: v.optional(v.string()),
   accountId: v.optional(v.string()),
   accountUuid: v.optional(v.string()),
   deviceId: v.optional(v.string()),
@@ -581,11 +582,6 @@ function createAccountManagerForProvider(dependencies) {
       if (metadata.label) account.label = metadata.label;
       if (metadata.planTier !== void 0) account.planTier = metadata.planTier;
     }
-    applyRefreshIdentityPatch(account, result) {
-      if (result.patch.accountId) account.accountId = result.patch.accountId;
-      if (result.patch.accountUuid && !account.accountUuid) account.accountUuid = result.patch.accountUuid;
-      if (result.patch.deviceId && !account.deviceId) account.deviceId = result.patch.deviceId;
-    }
     createNewAccount(auth, now, metadata) {
       const account = {
         uuid: randomUUID(),
@@ -947,32 +943,35 @@ function createAccountManagerForProvider(dependencies) {
       await this.refresh();
       await this.clearOpenCodeAuthIfNoAccountsRemain();
     }
-    async markAuthFailure(uuid, result) {
-      if (!result.ok && result.permanent) {
-        await this.store.mutateStorage((storage) => {
-          const account = storage.accounts.find((entry) => entry.uuid === uuid);
-          if (!account) return;
+    async markAuthFailure(uuid, result, expected) {
+      const applyFailure = (account, storage) => {
+        if (!result.ok && result.permanent) {
           account.consecutiveAuthFailures = Math.max(
             (account.consecutiveAuthFailures ?? 0) + 1,
             getProviderConfig().max_consecutive_auth_failures
           );
           account.isAuthDisabled = true;
           account.authDisabledReason = "refresh failed permanently";
-        });
-        return;
-      }
-      await this.store.mutateStorage((storage) => {
-        const account = storage.accounts.find((entry) => entry.uuid === uuid);
-        if (!account) return;
+          return;
+        }
         account.consecutiveAuthFailures = (account.consecutiveAuthFailures ?? 0) + 1;
         const maxFailures = getProviderConfig().max_consecutive_auth_failures;
         const usableCount = storage.accounts.filter(
-          (entry) => entry.enabled && !entry.isAuthDisabled && entry.uuid !== uuid
+          (entry) => entry.enabled && !entry.isAuthDisabled && entry.uuid !== account.uuid
         ).length;
         if (account.consecutiveAuthFailures >= maxFailures && usableCount > 0) {
           account.isAuthDisabled = true;
           account.authDisabledReason = `${maxFailures} consecutive auth failures`;
         }
+      };
+      if (expected) {
+        await this.store.mutateStorageIfCredentialsMatch(uuid, expected, applyFailure);
+        return;
+      }
+      await this.store.mutateStorage((storage) => {
+        const account = storage.accounts.find((entry) => entry.uuid === uuid);
+        if (!account) return;
+        applyFailure(account, storage);
       });
     }
     async applyUsageCache(uuid, usage) {
@@ -1004,26 +1003,20 @@ function createAccountManagerForProvider(dependencies) {
           patch: { accessToken: credentials.accessToken, expiresAt: credentials.expiresAt }
         };
       }
-      const result = await refreshToken(credentials.refreshToken, uuid, client);
+      const { result, account: updated } = await this.store.refreshAccountCredentials(
+        uuid,
+        credentials,
+        (refreshTokenValue) => refreshToken(refreshTokenValue, uuid, client)
+      );
       if (!result.ok) return result;
-      const updated = await this.store.mutateAccount(uuid, (account) => {
-        account.accessToken = result.patch.accessToken;
-        account.expiresAt = result.patch.expiresAt;
-        if (result.patch.refreshToken) account.refreshToken = result.patch.refreshToken;
-        if (result.patch.uuid && result.patch.uuid !== uuid) account.uuid = result.patch.uuid;
-        this.applyRefreshIdentityPatch(account, result);
-        if (result.patch.email) account.email = result.patch.email;
-        account.consecutiveAuthFailures = 0;
-        account.isAuthDisabled = false;
-        account.authDisabledReason = void 0;
-      });
-      if (result.patch.uuid && result.patch.uuid !== uuid && this.activeAccountUuid === uuid) {
-        this.activeAccountUuid = result.patch.uuid;
-        this.store.setActiveUuid(result.patch.uuid).catch(() => {
+      const nextUuid = updated?.uuid ?? uuid;
+      if (nextUuid !== uuid && this.activeAccountUuid === uuid) {
+        this.activeAccountUuid = nextUuid;
+        this.store.setActiveUuid(nextUuid).catch(() => {
         });
       }
-      if (result.patch.uuid && result.patch.uuid !== uuid) {
-        this.replaceStickyBindingAccountUuid(uuid, result.patch.uuid);
+      if (nextUuid !== uuid) {
+        this.replaceStickyBindingAccountUuid(uuid, nextUuid);
       }
       if (updated && (uuid === this.activeAccountUuid || updated.uuid === this.activeAccountUuid)) {
         this.syncToOpenCode(updated);
@@ -1043,7 +1036,7 @@ function createAccountManagerForProvider(dependencies) {
             if (!account.uuid || !isTokenExpired(account)) return;
             const result = await this.ensureValidToken(account.uuid, client);
             if (!result.ok) {
-              await this.markAuthFailure(account.uuid, result);
+              await this.markAuthFailure(account.uuid, result, account);
             }
           })
         );
@@ -1122,29 +1115,27 @@ function createAccountManagerForProvider(dependencies) {
       this.runtimeFactory?.invalidate(uuid);
       const credentials = await this.store.readCredentials(uuid);
       if (!credentials) return { ok: false, permanent: true };
-      const result = await refreshToken(credentials.refreshToken, uuid, client);
+      const { result, account: refreshedAccount } = await this.store.refreshAccountCredentials(
+        uuid,
+        credentials,
+        (refreshTokenValue) => refreshToken(refreshTokenValue, uuid, client)
+      );
       if (result.ok) {
-        const updated = await this.store.mutateAccount(uuid, (account) => {
-          account.accessToken = result.patch.accessToken;
-          account.expiresAt = result.patch.expiresAt;
-          if (result.patch.refreshToken) account.refreshToken = result.patch.refreshToken;
-          if (result.patch.uuid) account.uuid = result.patch.uuid;
-          this.applyRefreshIdentityPatch(account, result);
-          if (result.patch.email) account.email = result.patch.email;
+        const nextUuid = refreshedAccount?.uuid ?? uuid;
+        const updated = await this.store.mutateAccount(nextUuid, (account) => {
           account.enabled = true;
           account.consecutiveAuthFailures = 0;
         });
         this.runtimeFactory?.invalidate(uuid);
-        if (result.patch.uuid) {
-          this.runtimeFactory?.invalidate(result.patch.uuid);
+        if (nextUuid !== uuid) {
+          this.runtimeFactory?.invalidate(nextUuid);
         }
-        const nextUuid = result.patch.uuid ?? uuid;
-        if (this.activeAccountUuid === uuid && result.patch.uuid && result.patch.uuid !== uuid) {
-          this.activeAccountUuid = result.patch.uuid;
-          await this.store.setActiveUuid(result.patch.uuid);
+        if (this.activeAccountUuid === uuid && nextUuid !== uuid) {
+          this.activeAccountUuid = nextUuid;
+          await this.store.setActiveUuid(nextUuid);
         }
-        if (result.patch.uuid && result.patch.uuid !== uuid) {
-          this.replaceStickyBindingAccountUuid(uuid, result.patch.uuid);
+        if (nextUuid !== uuid) {
+          this.replaceStickyBindingAccountUuid(uuid, nextUuid);
         }
         if (updated && (uuid === this.activeAccountUuid || nextUuid === this.activeAccountUuid)) {
           const freshCredentials = await this.store.readCredentials(nextUuid);
@@ -1157,7 +1148,7 @@ function createAccountManagerForProvider(dependencies) {
           }
         }
       } else {
-        await this.markAuthFailure(uuid, result);
+        await this.markAuthFailure(uuid, result, credentials);
         this.runtimeFactory?.invalidate(uuid);
       }
       return result;
@@ -1185,7 +1176,7 @@ function readRoutingUsageTiers(usage) {
 
 // src/account-store.ts
 import { promises as fs5 } from "fs";
-import { randomBytes as randomBytes3 } from "crypto";
+import { createHash, randomBytes as randomBytes3 } from "crypto";
 import { dirname as dirname5, join as join5 } from "path";
 import * as v4 from "valibot";
 
@@ -1331,6 +1322,9 @@ async function withDirectoryLock(targetPath, fn, options) {
 
 // src/account-store.ts
 var FILE_MODE = 384;
+var REFRESH_LOCK_STALE_MS = 45e3;
+var REFRESH_LOCK_RETRY_DELAY_MS = 100;
+var REFRESH_LOCK_RETRIES = 31;
 function resolveStoragePath(filename) {
   return join5(getConfigDir2(), filename);
 }
@@ -1374,6 +1368,49 @@ async function ensureStorageFileExists(targetPath) {
     if (getErrorCode(error) !== "EEXIST") throw error;
   }
 }
+function sameCredentialSnapshot(account, expected) {
+  return account.refreshToken === expected.refreshToken && account.accessToken === expected.accessToken && account.expiresAt === expected.expiresAt;
+}
+function findCredentialAccount(accounts, uuid, expected) {
+  const exact = accounts.find((account) => account.uuid === uuid);
+  if (exact) return exact;
+  const ownerId = expected.credentialOwnerId ?? uuid;
+  const ownerMatches = accounts.filter((account) => account.credentialOwnerId === ownerId);
+  return ownerMatches.length === 1 ? ownerMatches[0] : void 0;
+}
+function refreshedCredentialPatch(account, previous) {
+  if (!account.accessToken || !account.expiresAt) return null;
+  const rotatedGrant = account.refreshToken !== previous.refreshToken;
+  const newerExpiry = account.expiresAt > (previous.expiresAt ?? 0);
+  const changedAccess = account.accessToken !== previous.accessToken;
+  if (account.expiresAt <= Date.now() || !rotatedGrant && !newerExpiry && !changedAccess) return null;
+  return {
+    accessToken: account.accessToken,
+    expiresAt: account.expiresAt,
+    refreshToken: account.refreshToken,
+    uuid: account.uuid,
+    accountId: account.accountId,
+    accountUuid: account.accountUuid,
+    deviceId: account.deviceId,
+    email: account.email
+  };
+}
+function applyCredentialPatch(account, patch, credentialOwnerId) {
+  account.accessToken = patch.accessToken;
+  account.expiresAt = patch.expiresAt;
+  if (patch.refreshToken) account.refreshToken = patch.refreshToken;
+  if (patch.uuid && patch.uuid !== account.uuid) {
+    account.credentialOwnerId ??= credentialOwnerId;
+    account.uuid = patch.uuid;
+  }
+  if (patch.accountId) account.accountId = patch.accountId;
+  if (patch.accountUuid && !account.accountUuid) account.accountUuid = patch.accountUuid;
+  if (patch.deviceId && !account.deviceId) account.deviceId = patch.deviceId;
+  if (patch.email) account.email = patch.email;
+  account.consecutiveAuthFailures = 0;
+  account.isAuthDisabled = false;
+  account.authDisabledReason = void 0;
+}
 var AccountStore = class {
   storagePath;
   constructor(filename) {
@@ -1383,6 +1420,10 @@ var AccountStore = class {
     await ensureStorageFileExists(this.storagePath);
     return await withDirectoryLock(this.storagePath, () => fn(this.storagePath));
   }
+  refreshLockPath(uuid, credentials) {
+    const accountKey = createHash("sha256").update(credentials.credentialOwnerId ?? uuid).digest("hex");
+    return `${this.storagePath}.refresh-${accountKey}`;
+  }
   async load() {
     const storage = await loadAccounts(this.storagePath);
     return storage ?? createEmptyStorage();
@@ -1396,11 +1437,45 @@ var AccountStore = class {
       refreshToken: account.refreshToken,
       accessToken: account.accessToken,
       expiresAt: account.expiresAt,
+      credentialOwnerId: account.credentialOwnerId,
       accountId: account.accountId,
       accountUuid: account.accountUuid,
       deviceId: account.deviceId
     };
   }
+  async refreshAccountCredentials(uuid, expected, refresh) {
+    const credentialOwnerId = expected.credentialOwnerId ?? uuid;
+    return await withDirectoryLock(this.refreshLockPath(uuid, expected), async () => {
+      const currentStorage = await readStorageFromDisk(this.storagePath, false);
+      const current = currentStorage ? findCredentialAccount(currentStorage.accounts, uuid, expected) : void 0;
+      if (!current) {
+        return { result: { ok: false, permanent: true }, account: null };
+      }
+      let refreshSnapshot = expected;
+      if (!sameCredentialSnapshot(current, expected)) {
+        const patch = refreshedCredentialPatch(current, expected);
+        if (patch) return { result: { ok: true, patch }, account: { ...current } };
+        refreshSnapshot = current;
+      }
+      const result = await refresh(current.refreshToken);
+      if (!result.ok) return { result, account: { ...current } };
+      let persistedResult = result;
+      const updated = await this.mutateAccount(current.uuid ?? uuid, (account) => {
+        if (!sameCredentialSnapshot(account, refreshSnapshot)) {
+          const patch = refreshedCredentialPatch(account, refreshSnapshot);
+          persistedResult = patch ? { ok: true, patch } : { ok: false, permanent: false };
+          return;
+        }
+        applyCredentialPatch(account, result.patch, credentialOwnerId);
+      });
+      if (!updated) return { result: { ok: false, permanent: false }, account: null };
+      return { result: persistedResult, account: updated };
+    }, {
+      staleMs: REFRESH_LOCK_STALE_MS,
+      retryDelayMs: REFRESH_LOCK_RETRY_DELAY_MS,
+      retries: REFRESH_LOCK_RETRIES
+    });
+  }
   async mutateAccount(uuid, fn) {
     return await this.withLock(async (storagePath) => {
       const current = await readStorageFromDisk(storagePath, false);
@@ -1419,6 +1494,17 @@ var AccountStore = class {
       await writeStorageAtomic(storagePath, current);
     });
   }
+  async mutateStorageIfCredentialsMatch(uuid, expected, fn) {
+    return await this.withLock(async (storagePath) => {
+      const current = await readStorageFromDisk(storagePath, false);
+      if (!current) return false;
+      const account = findCredentialAccount(current.accounts, uuid, expected);
+      if (!account || !sameCredentialSnapshot(account, expected)) return false;
+      fn(account, current);
+      await writeStorageAtomic(storagePath, current);
+      return true;
+    });
+  }
   async addAccount(account) {
     await this.withLock(async (storagePath) => {
       const current = await readStorageFromDisk(storagePath, false) ?? createEmptyStorage();
@@ -1457,7 +1543,7 @@ var AccountStore = class {
 };
 
 // src/executor.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var MIN_MAX_RETRIES = 6;
 var RETRIES_PER_ACCOUNT = 3;
 var MAX_SERVER_RETRIES_PER_ATTEMPT = 2;
@@ -1519,7 +1605,7 @@ function buildStickyKeyFromFirstUserText(text) {
   if (!text) {
     return void 0;
   }
-  return createHash("sha256").update(text).digest("hex").slice(0, 16);
+  return createHash2("sha256").update(text).digest("hex").slice(0, 16);
 }
 function extractStickyKey(input, init) {
   const bodyText = init?.body ?? (input instanceof Request ? input.body : void 0);
@@ -1614,7 +1700,7 @@ function createExecutorForProvider(providerName, dependencies) {
             return { type: "retryOuter" };
           }
         }
-        await manager.markAuthFailure(accountUuid, { ok: false, permanent: false });
+        await manager.markAuthFailure(accountUuid, { ok: false, permanent: false }, account);
         await manager.refresh();
         if (!manager.hasAnyUsableAccount()) {
           void showToast2(client, "All accounts have auth failures.", "error");
@@ -1704,7 +1790,7 @@ function createExecutorForProvider(providerName, dependencies) {
     await manager.markAuthFailure(accountUuid, {
       ok: false,
       permanent: error.permanent
-    });
+    }, account);
     await manager.refresh();
     if (!manager.hasAnyUsableAccount()) {
       void showToast2(client, "All accounts have auth failures.", "error");
@@ -1833,24 +1919,15 @@ function createProactiveRefreshQueueForProvider(dependencies) {
           if (token !== this.runToken) return;
           const credentials = await this.store.readCredentials(account.uuid);
           if (!credentials || !this.needsProactiveRefresh(credentials)) continue;
-          const result = await refreshToken(credentials.refreshToken, account.uuid, this.client);
+          const { result } = await this.store.refreshAccountCredentials(
+            account.uuid,
+            credentials,
+            (refreshTokenValue) => refreshToken(refreshTokenValue, account.uuid, this.client)
+          );
           if (result.ok) {
-            await this.store.mutateAccount(account.uuid, (target) => {
-              target.accessToken = result.patch.accessToken;
-              target.expiresAt = result.patch.expiresAt;
-              if (result.patch.refreshToken) target.refreshToken = result.patch.refreshToken;
-              if (result.patch.uuid) target.uuid = result.patch.uuid;
-              if (result.patch.email) target.email = result.patch.email;
-              if (result.patch.accountId) target.accountId = result.patch.accountId;
-              if (result.patch.accountUuid && !target.accountUuid) target.accountUuid = result.patch.accountUuid;
-              if (result.patch.deviceId && !target.deviceId) target.deviceId = result.patch.deviceId;
-              target.consecutiveAuthFailures = 0;
-              target.isAuthDisabled = false;
-              target.authDisabledReason = void 0;
-            });
             this.onInvalidate?.(account.uuid);
           } else {
-            await this.persistFailure(account, result.permanent);
+            await this.persistFailure(account, result.permanent, credentials);
           }
         }
       } catch (error) {
@@ -1862,36 +1939,34 @@ function createProactiveRefreshQueueForProvider(dependencies) {
         }
       }
     }
-    async persistFailure(account, permanent) {
+    async persistFailure(account, permanent, expected) {
       try {
         const accountUuid = account.uuid;
         if (!accountUuid) return;
-        if (permanent) {
-          await this.store.mutateStorage((storage) => {
-            const target = storage.accounts.find((entry) => entry.uuid === accountUuid);
-            if (!target) return;
-            target.consecutiveAuthFailures = Math.max(
-              (target.consecutiveAuthFailures ?? 0) + 1,
-              getConfig2().max_consecutive_auth_failures
-            );
-            target.isAuthDisabled = true;
-            target.authDisabledReason = "refresh failed permanently (proactive refresh)";
-          });
-          return;
-        }
-        await this.store.mutateStorage((storage) => {
-          const target = storage.accounts.find((entry) => entry.uuid === accountUuid);
-          if (!target) return;
-          target.consecutiveAuthFailures = (target.consecutiveAuthFailures ?? 0) + 1;
-          const maxFailures = getConfig2().max_consecutive_auth_failures;
-          const usableCount = storage.accounts.filter(
-            (entry) => entry.enabled && !entry.isAuthDisabled && entry.uuid !== accountUuid
-          ).length;
-          if (target.consecutiveAuthFailures >= maxFailures && usableCount > 0) {
-            target.isAuthDisabled = true;
-            target.authDisabledReason = `${maxFailures} consecutive auth failures (proactive refresh)`;
+        await this.store.mutateStorageIfCredentialsMatch(
+          accountUuid,
+          expected,
+          (target, storage) => {
+            if (permanent) {
+              target.consecutiveAuthFailures = Math.max(
+                (target.consecutiveAuthFailures ?? 0) + 1,
+                getConfig2().max_consecutive_auth_failures
+              );
+              target.isAuthDisabled = true;
+              target.authDisabledReason = "refresh failed permanently (proactive refresh)";
+              return;
+            }
+            target.consecutiveAuthFailures = (target.consecutiveAuthFailures ?? 0) + 1;
+            const maxFailures = getConfig2().max_consecutive_auth_failures;
+            const usableCount = storage.accounts.filter(
+              (entry) => entry.enabled && !entry.isAuthDisabled && entry.uuid !== target.uuid
+            ).length;
+            if (target.consecutiveAuthFailures >= maxFailures && usableCount > 0) {
+              target.isAuthDisabled = true;
+              target.authDisabledReason = `${maxFailures} consecutive auth failures (proactive refresh)`;
+            }
           }
-        });
+        );
       } catch {
         debugLog2(this.client, `Failed to persist auth failure for ${account.uuid}`);
       }