switchroom 0.19.2 → 0.19.4

package/dist/agent-scheduler/index.js

@@ -13945,6 +13945,8 @@ var AccountStateSchema = exports_external.object({
   label: exports_external.string(),
   expiresAt: exports_external.number().optional(),
   exhausted: exports_external.boolean(),
+  in_service: exports_external.boolean().optional(),
+  entitlement_blocked: exports_external.boolean().optional(),
   exhausted_until: exports_external.number().optional(),
   throttled_until: exports_external.number().optional(),
   threshold_violations: exports_external.number().int().nonnegative().optional(),

package/dist/auth-broker/index.js

@@ -18839,6 +18839,27 @@ function parseQuotaHeaders(headers, now = new Date) {
     }
   };
 }
+function extractApiErrorMessage(bodyText) {
+  if (!bodyText || bodyText.trim().length === 0)
+    return null;
+  try {
+    const parsed = JSON.parse(bodyText);
+    const msg = parsed?.error?.message;
+    if (typeof msg === "string" && msg.trim().length > 0)
+      return msg.trim();
+  } catch {}
+  return bodyText.trim().slice(0, 500);
+}
+function isEntitlementDisabledMessage(message) {
+  if (!message)
+    return false;
+  const m = message.toLowerCase();
+  if (!m.includes("disabled"))
+    return false;
+  const mentionsCode = m.includes("claude code") || m.includes("claude subscription");
+  const mentionsOrgOrSub = m.includes("organization") || m.includes("subscription") || m.includes(" org ");
+  return mentionsCode && mentionsOrgOrSub;
+}
 async function fetchQuota(opts) {
   const token = opts.accessToken?.trim();
   if (!token || token.length === 0) {
@@ -18874,13 +18895,28 @@ async function fetchQuota(opts) {
     }
     return { ok: false, reason: `quota probe network error: ${msg}` };
   }
-  clearTimeout(timeout);
   const parsed = parseQuotaHeaders(resp.headers);
-  if (parsed.ok)
+  if (parsed.ok) {
+    clearTimeout(timeout);
     return parsed;
+  }
   if (!resp.ok) {
-    return { ok: false, reason: `HTTP ${resp.status} from Anthropic (${parsed.reason})` };
+    let bodyText = "";
+    try {
+      bodyText = await resp.text();
+    } catch {}
+    clearTimeout(timeout);
+    const apiErrorMessage = extractApiErrorMessage(bodyText);
+    const entitlement = resp.status === 403 && isEntitlementDisabledMessage(apiErrorMessage);
+    return {
+      ok: false,
+      reason: `HTTP ${resp.status} from Anthropic (${parsed.reason})`,
+      httpStatus: resp.status,
+      ...apiErrorMessage ? { apiErrorMessage } : {},
+      failureKind: entitlement ? "entitlement_blocked" : "other"
+    };
   }
+  clearTimeout(timeout);
   return parsed;
 }
 
@@ -18912,7 +18948,9 @@ function snapshotClearlyHealthy(s) {
   return s.fiveHourUtilizationPct < HEALTHY_CLEAR_PCT && s.sevenDayUtilizationPct < HEALTHY_CLEAR_PCT;
 }
 function accountEligibility(opts) {
-  const { mark, snapshot, now, allowOverage = false } = opts;
+  const { mark, snapshot, now, allowOverage = false, entitlementBlocked = false } = opts;
+  if (entitlementBlocked)
+    return "blocked";
   if (snapshotFresh(snapshot, now) && snapshotWalled(snapshot) && !overageLiftsWall(snapshot, allowOverage)) {
     return "blocked";
   }
@@ -20401,6 +20439,8 @@ var AccountStateSchema = exports_external.object({
   label: exports_external.string(),
   expiresAt: exports_external.number().optional(),
   exhausted: exports_external.boolean(),
+  in_service: exports_external.boolean().optional(),
+  entitlement_blocked: exports_external.boolean().optional(),
   exhausted_until: exports_external.number().optional(),
   throttled_until: exports_external.number().optional(),
   threshold_violations: exports_external.number().int().nonnegative().optional(),
@@ -21168,8 +21208,50 @@ class AuthBroker {
       mark: this.exhaustionMarkOf(account),
       snapshot: this.lastQuotaCache[account],
       now: this.now(),
-      allowOverage: this.isOverageAllowed(account)
+      allowOverage: this.isOverageAllowed(account),
+      entitlementBlocked: this.isAccountEntitlementBlocked(account)
+    });
+  }
+  isAccountEntitlementBlocked(account) {
+    return this.quota[account]?.entitlement_blocked === true;
+  }
+  markEntitlementBlocked(label, result) {
+    if (result.ok || result.failureKind !== "entitlement_blocked")
+      return;
+    if (this.quota[label]?.entitlement_blocked === true)
+      return;
+    this.quota[label] = {
+      ...this.quota[label],
+      entitlement_blocked: true,
+      entitlement_blocked_at: this.now(),
+      ...result.apiErrorMessage ? { entitlement_blocked_reason: result.apiErrorMessage } : {}
+    };
+    this.persistQuota();
+    this.audit({
+      op: "mark-exhausted",
+      identity: { kind: "operator" },
+      account: label,
+      accountKind: "claude",
+      ok: true,
+      reason: "entitlement-403"
     });
+    process.stdout.write(`auth-broker: ${label} returned entitlement-403 (Claude Code access disabled) — marked entitlement_blocked${result.apiErrorMessage ? ` (${result.apiErrorMessage})` : ""}
+`);
+  }
+  clearEntitlementBlocked(label) {
+    const entry = this.quota[label];
+    if (!entry?.entitlement_blocked)
+      return;
+    const {
+      entitlement_blocked,
+      entitlement_blocked_at,
+      entitlement_blocked_reason,
+      ...rest
+    } = entry;
+    this.quota[label] = rest;
+    this.persistQuota();
+    process.stdout.write(`auth-broker: live probe of ${label} succeeded — cleared entitlement_blocked mark
+`);
   }
   premiumWallMarkOf(account) {
     const q = this.quota[account];
@@ -21327,7 +21409,8 @@ class AuthBroker {
       mark: this.exhaustionMarkOf(account),
       snapshot,
       now,
-      allowOverage: true
+      allowOverage: true,
+      entitlementBlocked: this.isAccountEntitlementBlocked(account)
     }) === "eligible";
   }
   accountEligibilityOf(account) {
@@ -21337,7 +21420,8 @@ class AuthBroker {
       mark: this.exhaustionMarkOf(account),
       snapshot,
       now: this.now(),
-      allowOverage
+      allowOverage,
+      entitlementBlocked: this.isAccountEntitlementBlocked(account)
     });
     if (verdict === "eligible" && allowOverage && snapshot && (snapshot.fiveHourUtilizationPct >= WALL_PCT || snapshot.sevenDayUtilizationPct >= WALL_PCT)) {
       process.stdout.write(`auth-broker: ${account} is past the utilization wall but eligible via allow_overage — Anthropic overage billing active (5h=${snapshot.fiveHourUtilizationPct.toFixed(1)}%, 7d=${snapshot.sevenDayUtilizationPct.toFixed(1)}%)
@@ -21354,6 +21438,8 @@ class AuthBroker {
       const result = await this.probeQuotaSingleFlight(account, token);
       if (result.ok)
         this.cacheQuotaSnapshot(account, result);
+      else
+        this.markEntitlementBlocked(account, result);
     } catch {}
   }
   async nextHealthyAccountLive(current, order) {
@@ -21441,6 +21527,7 @@ class AuthBroker {
   }
   async opListState(socket, id, identity) {
     const auth = this.config.auth ?? {};
+    const inService = this.inServiceSet();
     const accounts = listAccounts(this.home).map((label) => {
       const creds = readAccountCredentials(label, this.home);
       const meta = readAccountMeta(label, this.home);
@@ -21451,6 +21538,7 @@ class AuthBroker {
         label,
         expiresAt: creds?.claudeAiOauth?.expiresAt,
         exhausted,
+        in_service: inService.has(label),
         exhausted_until: q?.exhausted_until,
         throttled_until: q?.throttled_until,
         threshold_violations: this.thresholdViolations[label] ?? 0,
@@ -21460,6 +21548,7 @@ class AuthBroker {
         premium_walled_until: q?.premium_walled_until,
         premium_wall_bucket: q?.premium_wall_bucket,
         last_tier_quota: this.lastTierQuotaCache[label] ?? null,
+        entitlement_blocked: q?.entitlement_blocked ?? false,
         usage_ledger: summarizeAccountUsage(this.usageLedger, label, this.now())
       };
     });
@@ -21534,6 +21623,7 @@ class AuthBroker {
         this.cacheQuotaSnapshot(label, result);
         return { label, result, served: "live" };
       }
+      this.markEntitlementBlocked(label, result);
       if (cached) {
         return { label, result: cachedSnapshotToResult(cached), served: "cache", capturedAt: cached.capturedAt };
       }
@@ -21555,6 +21645,7 @@ class AuthBroker {
   cacheQuotaSnapshot(label, result) {
     if (!result.ok)
       return;
+    this.clearEntitlementBlocked(label);
     const snapshot = {
       fiveHourUtilizationPct: result.data.fiveHourUtilizationPct,
       sevenDayUtilizationPct: result.data.sevenDayUtilizationPct,
@@ -21584,6 +21675,8 @@ class AuthBroker {
     const canarySet = this.premiumCanarySet();
     const canaryEnabled = process.env.SWITCHROOM_DISABLE_MODEL_TIER_PROBE !== "1";
     for (const label of listAccounts(this.home)) {
+      if (this.isAccountEntitlementBlocked(label))
+        continue;
       const creds = readAccountCredentials(label, this.home);
       const token = creds?.claudeAiOauth?.accessToken;
       if (!token)
@@ -21596,6 +21689,7 @@ class AuthBroker {
         continue;
       }
       this.cacheQuotaSnapshot(label, result);
+      this.markEntitlementBlocked(label, result);
       probed.push({ label, result });
       if (canaryEnabled && canarySet.has(label)) {
         let tierResult;
@@ -21700,6 +21794,14 @@ class AuthBroker {
       set.add(acct);
     return set;
   }
+  inServiceSet() {
+    const set = this.premiumCanarySet();
+    for (const c of this.config.auth?.consumers ?? []) {
+      if (c.account)
+        set.add(c.account);
+    }
+    return set;
+  }
   pinnedAgentAccounts() {
     return new Set(Object.values(this.config.agents ?? {}).map((a) => a.auth?.override).filter((x) => typeof x === "string" && x.length > 0));
   }

package/dist/cli/autoaccept-poll.js

@@ -4874,6 +4874,8 @@ var AccountStateSchema = exports_external.object({
   label: exports_external.string(),
   expiresAt: exports_external.number().optional(),
   exhausted: exports_external.boolean(),
+  in_service: exports_external.boolean().optional(),
+  entitlement_blocked: exports_external.boolean().optional(),
   exhausted_until: exports_external.number().optional(),
   throttled_until: exports_external.number().optional(),
   threshold_violations: exports_external.number().int().nonnegative().optional(),

package/dist/cli/drive-write-pretool.mjs

@@ -4162,6 +4162,8 @@ var init_protocol = __esm(() => {
     label: exports_external.string(),
     expiresAt: exports_external.number().optional(),
     exhausted: exports_external.boolean(),
+    in_service: exports_external.boolean().optional(),
+    entitlement_blocked: exports_external.boolean().optional(),
     exhausted_until: exports_external.number().optional(),
     throttled_until: exports_external.number().optional(),
     threshold_violations: exports_external.number().int().nonnegative().optional(),

package/dist/cli/ms-365-write-pretool.mjs

@@ -4164,6 +4164,8 @@ var init_protocol = __esm(() => {
     label: exports_external.string(),
     expiresAt: exports_external.number().optional(),
     exhausted: exports_external.boolean(),
+    in_service: exports_external.boolean().optional(),
+    entitlement_blocked: exports_external.boolean().optional(),
     exhausted_until: exports_external.number().optional(),
     throttled_until: exports_external.number().optional(),
     threshold_violations: exports_external.number().int().nonnegative().optional(),