orch-code 0.1.4 → 0.1.5

package/internal/auth/store_test.go

@@ -0,0 +1,73 @@
+package auth
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/furkanbeydemir/orch/internal/config"
+)
+
+func TestLoadMigratesLegacySingleCredentialMap(t *testing.T) {
+	repoRoot := t.TempDir()
+	if err := config.EnsureOrchDir(repoRoot); err != nil {
+		t.Fatalf("ensure orch dir: %v", err)
+	}
+
+	legacy := map[string]Credential{
+		"openai": {
+			Type:         "oauth",
+			AccessToken:  "token-123",
+			RefreshToken: "refresh-123",
+			AccountID:    "acc-123",
+			Email:        "user@example.com",
+			UpdatedAt:    time.Now().UTC(),
+		},
+	}
+	data, err := json.MarshalIndent(legacy, "", "  ")
+	if err != nil {
+		t.Fatalf("marshal legacy auth: %v", err)
+	}
+	path := filepath.Join(repoRoot, config.OrchDir, authFile)
+	if err := os.WriteFile(path, data, 0o600); err != nil {
+		t.Fatalf("write legacy auth: %v", err)
+	}
+
+	creds, activeID, err := List(repoRoot, "openai")
+	if err != nil {
+		t.Fatalf("list credentials: %v", err)
+	}
+	if len(creds) != 1 {
+		t.Fatalf("expected 1 credential, got %d", len(creds))
+	}
+	if activeID != "acc-123" {
+		t.Fatalf("expected acc-123 active, got %s", activeID)
+	}
+	if creds[0].ID != "acc-123" {
+		t.Fatalf("expected migrated id acc-123, got %s", creds[0].ID)
+	}
+}
+
+func TestSetActiveSwitchesReturnedCredential(t *testing.T) {
+	repoRoot := t.TempDir()
+	if err := Set(repoRoot, "openai", Credential{Type: "oauth", AccessToken: "token-1", RefreshToken: "refresh-1", AccountID: "acc-1", Email: "one@example.com"}); err != nil {
+		t.Fatalf("set first credential: %v", err)
+	}
+	if err := Set(repoRoot, "openai", Credential{Type: "oauth", AccessToken: "token-2", RefreshToken: "refresh-2", AccountID: "acc-2", Email: "two@example.com"}); err != nil {
+		t.Fatalf("set second credential: %v", err)
+	}
+
+	if err := SetActive(repoRoot, "openai", "acc-1"); err != nil {
+		t.Fatalf("set active: %v", err)
+	}
+
+	active, err := Get(repoRoot, "openai")
+	if err != nil {
+		t.Fatalf("get active credential: %v", err)
+	}
+	if active == nil || active.ID != "acc-1" {
+		t.Fatalf("expected acc-1 active, got %#v", active)
+	}
+}

package/internal/orchestrator/orchestrator.go

@@ -99,8 +99,17 @@ func (o *Orchestrator) attachProviderRuntime() {
 
 	registry := providers.NewRegistry()
 	client := openai.New(o.cfg.Provider.OpenAI)
+	var accountSession *auth.AccountSession
+	if strings.ToLower(strings.TrimSpace(o.cfg.Provider.OpenAI.AuthMode)) == "account" && strings.TrimSpace(os.Getenv(o.cfg.Provider.OpenAI.AccountTokenEnv)) == "" {
+		accountSession = auth.NewAccountSession(o.repoRoot, "openai")
+		client.SetAccountFailoverHandler(func(ctx context.Context, err error) (string, bool, error) {
+			return accountSession.Failover(ctx, openai.AccountFailoverCooldown(err), err.Error())
+		})
+		client.SetAccountSuccessHandler(func(ctx context.Context) {
+			accountSession.MarkSuccess(ctx)
+		})
+	}
 	client.SetTokenResolver(func(ctx context.Context) (string, error) {
-		_ = ctx
 		if strings.ToLower(strings.TrimSpace(o.cfg.Provider.OpenAI.AuthMode)) == "api_key" {
 			cred, err := auth.Get(o.repoRoot, "openai")
 			if err != nil || cred == nil {
@@ -111,7 +120,10 @@ func (o *Orchestrator) attachProviderRuntime() {
 			}
 			return "", nil
 		}
-		return auth.ResolveAccountAccessToken(o.repoRoot, "openai")
+		if accountSession == nil {
+			return "", nil
+		}
+		return accountSession.ResolveToken(ctx)
 	})
 	registry.Register(client)
 	router := providers.NewRouter(o.cfg, registry)

package/internal/providers/openai/client.go

@@ -18,10 +18,12 @@ import (
 )
 
 type Client struct {
-	cfg          config.OpenAIProviderConfig
-	httpClient   *http.Client
-	rand         *rand.Rand
-	resolveToken func(context.Context) (string, error)
+	cfg             config.OpenAIProviderConfig
+	httpClient      *http.Client
+	rand            *rand.Rand
+	resolveToken    func(context.Context) (string, error)
+	accountFailover func(context.Context, error) (string, bool, error)
+	accountSuccess  func(context.Context)
 }
 
 type requester interface {
@@ -49,6 +51,13 @@ func New(cfg config.OpenAIProviderConfig) *Client {
 			_ = ctx
 			return "", nil
 		},
+		accountFailover: func(ctx context.Context, err error) (string, bool, error) {
+			_, _ = ctx, err
+			return "", false, nil
+		},
+		accountSuccess: func(ctx context.Context) {
+			_ = ctx
+		},
 	}
 }
 
@@ -59,6 +68,20 @@ func (c *Client) SetTokenResolver(resolver func(context.Context) (string, error)
 	c.resolveToken = resolver
 }
 
+func (c *Client) SetAccountFailoverHandler(handler func(context.Context, error) (string, bool, error)) {
+	if handler == nil {
+		return
+	}
+	c.accountFailover = handler
+}
+
+func (c *Client) SetAccountSuccessHandler(handler func(context.Context)) {
+	if handler == nil {
+		return
+	}
+	c.accountSuccess = handler
+}
+
 func (c *Client) Name() string {
 	return "openai"
 }
@@ -124,11 +147,11 @@ func (c *Client) Stream(ctx context.Context, req providers.ChatRequest) (<-chan
 }
 
 func (c *Client) chatWithDoer(ctx context.Context, req providers.ChatRequest, doer requester) (providers.ChatResponse, error) {
+	mode := c.authMode()
 	key, err := c.resolveAuthToken(ctx)
 	if err != nil {
 		return providers.ChatResponse{}, err
 	}
-	mode := c.authMode()
 
 	model := strings.TrimSpace(req.Model)
 	if model == "" {
@@ -176,6 +199,12 @@ func (c *Client) chatWithDoer(ctx context.Context, req providers.ChatRequest, do
 		if doErr != nil {
 			mapped := mapHTTPError(doErr, 0, "chat")
 			lastErr = mapped
+			if nextToken, switched, switchErr := c.maybeFailoverAccount(ctx, mode, mapped); switchErr != nil {
+				return providers.ChatResponse{}, switchErr
+			} else if switched {
+				key = nextToken
+				continue
+			}
 			if isRetryable(mapped) && attempt < attempts {
 				c.sleepBackoff(attempt)
 				continue
@@ -197,6 +226,12 @@ func (c *Client) chatWithDoer(ctx context.Context, req providers.ChatRequest, do
 		if httpResp.StatusCode >= 300 {
 			mapped := mapStatusError(httpResp.StatusCode, string(data), "chat")
 			lastErr = mapped
+			if nextToken, switched, switchErr := c.maybeFailoverAccount(ctx, mode, mapped); switchErr != nil {
+				return providers.ChatResponse{}, switchErr
+			} else if switched {
+				key = nextToken
+				continue
+			}
 			if isRetryable(mapped) && attempt < attempts {
 				c.sleepBackoff(attempt)
 				continue
@@ -218,6 +253,12 @@ func (c *Client) chatWithDoer(ctx context.Context, req providers.ChatRequest, do
 			"provider": "openai",
 			"model":    model,
 		}
+		if mode == "account" {
+			if accountID, accountErr := extractAccountID(key); accountErr == nil {
+				parsed.ProviderMetadata["account_id"] = accountID
+			}
+			c.accountSuccess(ctx)
+		}
 		return parsed, nil
 	}
 
@@ -228,6 +269,43 @@ func (c *Client) chatWithDoer(ctx context.Context, req providers.ChatRequest, do
 	return providers.ChatResponse{}, lastErr
 }
 
+func (c *Client) maybeFailoverAccount(ctx context.Context, mode string, err error) (string, bool, error) {
+	if mode != "account" || !isAccountFailoverEligible(err) {
+		return "", false, nil
+	}
+	return c.accountFailover(ctx, err)
+}
+
+func isAccountFailoverEligible(err error) bool {
+	pe, ok := err.(*providers.Error)
+	if !ok {
+		return false
+	}
+	switch pe.Code {
+	case providers.ErrRateLimited, providers.ErrAuthError, providers.ErrModelUnavailable:
+		return true
+	default:
+		return false
+	}
+}
+
+func AccountFailoverCooldown(err error) time.Duration {
+	pe, ok := err.(*providers.Error)
+	if !ok {
+		return 0
+	}
+	switch pe.Code {
+	case providers.ErrRateLimited:
+		return 2 * time.Minute
+	case providers.ErrAuthError:
+		return 15 * time.Minute
+	case providers.ErrModelUnavailable:
+		return 10 * time.Minute
+	default:
+		return 0
+	}
+}
+
 func (c *Client) defaultModel(role providers.Role) string {
 	switch role {
 	case providers.RolePlanner:

package/internal/providers/openai/client_test.go

@@ -70,6 +70,58 @@ func TestChatRetriesOnRateLimit(t *testing.T) {
 	}
 }
 
+func TestChatAccountModeFailsOverToSecondToken(t *testing.T) {
+	client := New(config.OpenAIProviderConfig{
+		AuthMode:        "account",
+		BaseURL:         "https://api.openai.com/v1",
+		AccountTokenEnv: "OPENAI_ACCOUNT_TOKEN",
+		MaxRetries:      2,
+		Models:          config.ProviderRoleModels{Coder: "gpt-5.3-codex"},
+	})
+	firstToken := testAccountToken("acc-1")
+	secondToken := testAccountToken("acc-2")
+	client.SetTokenResolver(func(ctx context.Context) (string, error) {
+		return firstToken, nil
+	})
+	client.SetAccountFailoverHandler(func(ctx context.Context, err error) (string, bool, error) {
+		return secondToken, true, nil
+	})
+	markedSuccess := false
+	client.SetAccountSuccessHandler(func(ctx context.Context) {
+		markedSuccess = true
+	})
+
+	attempts := 0
+	doer := &inspectDoer{fn: func(req *http.Request) (*http.Response, error) {
+		attempts++
+		switch attempts {
+		case 1:
+			if got := req.Header.Get("ChatGPT-Account-Id"); got != "acc-1" {
+				return nil, fmt.Errorf("expected first account header acc-1, got %s", got)
+			}
+			return response(http.StatusTooManyRequests, `{"error":"rate"}`), nil
+		case 2:
+			if got := req.Header.Get("ChatGPT-Account-Id"); got != "acc-2" {
+				return nil, fmt.Errorf("expected second account header acc-2, got %s", got)
+			}
+			return response(http.StatusOK, `{"output_text":"done","status":"completed","usage":{"input_tokens":1,"output_tokens":1,"total_tokens":2}}`), nil
+		default:
+			return nil, fmt.Errorf("unexpected attempt %d", attempts)
+		}
+	}}
+
+	out, err := client.chatWithDoer(context.Background(), providers.ChatRequest{Role: providers.RoleCoder}, doer)
+	if err != nil {
+		t.Fatalf("chat should succeed after failover: %v", err)
+	}
+	if out.ProviderMetadata["account_id"] != "acc-2" {
+		t.Fatalf("expected account_id metadata acc-2, got %q", out.ProviderMetadata["account_id"])
+	}
+	if !markedSuccess {
+		t.Fatalf("expected account success handler to be called")
+	}
+}
+
 func TestValidateMissingKey(t *testing.T) {
 	_ = os.Unsetenv("OPENAI_API_KEY")
 	client := New(config.OpenAIProviderConfig{APIKeyEnv: "OPENAI_API_KEY", BaseURL: "https://example.test/v1"})

package/internal/providers/state_test.go

@@ -62,3 +62,45 @@ func TestReadStateConnectedWithStoredAPIKey(t *testing.T) {
 		t.Fatalf("unexpected connected providers: %+v", state.Connected)
 	}
 }
+
+func TestReadStateUsesActiveOAuthCredential(t *testing.T) {
+	repoRoot := t.TempDir()
+	cfg := config.DefaultConfig()
+	cfg.Provider.Default = "openai"
+	cfg.Provider.OpenAI.AuthMode = "account"
+	if err := config.Save(repoRoot, cfg); err != nil {
+		t.Fatalf("save config: %v", err)
+	}
+
+	if err := auth.Set(repoRoot, "openai", auth.Credential{Type: "oauth", AccessToken: testAccountToken("acc-1"), RefreshToken: "refresh-1", AccountID: "acc-1", Email: "one@example.com"}); err != nil {
+		t.Fatalf("save first oauth: %v", err)
+	}
+	if err := auth.Set(repoRoot, "openai", auth.Credential{Type: "oauth", AccessToken: testAccountToken("acc-2"), RefreshToken: "refresh-2", AccountID: "acc-2", Email: "two@example.com"}); err != nil {
+		t.Fatalf("save second oauth: %v", err)
+	}
+	if err := auth.SetActive(repoRoot, "openai", "acc-1"); err != nil {
+		t.Fatalf("set active oauth: %v", err)
+	}
+
+	state, err := ReadState(repoRoot)
+	if err != nil {
+		t.Fatalf("read state: %v", err)
+	}
+	if !state.OpenAI.Connected {
+		t.Fatalf("expected connected openai state")
+	}
+	if state.OpenAI.Source != "local" {
+		t.Fatalf("expected local source, got: %s", state.OpenAI.Source)
+	}
+	active, err := auth.Get(repoRoot, "openai")
+	if err != nil {
+		t.Fatalf("get active oauth: %v", err)
+	}
+	if active == nil || active.ID != "acc-1" {
+		t.Fatalf("expected acc-1 active, got %#v", active)
+	}
+}
+
+func testAccountToken(accountID string) string {
+	return "eyJhbGciOiJub25lIn0.eyJodHRwczovL2FwaS5vcGVuYWkuY29tL2F1dGgiOnsiY2hhdGdwdF9hY2NvdW50X2lkIjoi" + accountID + "In19.sig"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orch-code",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Local-first control plane for deterministic AI coding",
   "license": "MIT",
   "bin": {