fix: harden workspace-disabled rotation retry

Author: ndycode

index.ts

@@ -1478,7 +1478,7 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 											);
 										}
 
-while (attempted.size < Math.max(1, accountCount)) {
+accountAttemptLoop: while (attempted.size < Math.max(1, accountCount)) {
 				let account = null;
 				if (
 					!usedPreferredSessionAccount &&
@@ -1967,75 +1967,84 @@ while (attempted.size < Math.max(1, accountCount)) {
 					blockedModel,
 				);
 			}
-		if (errorResponse.status === 403 && !unsupportedModelInfo.isUnsupported) {
-			entitlementCache.markBlocked(
-				entitlementAccountKey,
-				model ?? modelFamily,
-				"plan-entitlement",
-			);
-			capabilityPolicyStore.recordFailure(
-				entitlementAccountKey,
-				capabilityModelKey,
+		const workspaceErrorCode =
+			(errorBody as { error?: { code?: string } } | undefined)?.error?.code ?? "";
+		const workspaceErrorMessage =
+			(errorBody as { error?: { message?: string } } | undefined)?.error?.message ?? "";
+		const isDisabledWorkspaceError =
+			errorResponse.status === 403 &&
+			isWorkspaceDisabledError(
+				errorResponse.status,
+				workspaceErrorCode,
+				workspaceErrorMessage,
 			);
-		}
 
 		// Handle workspace disabled/expired errors by rotating to next workspace within account
-		if (errorResponse.status === 403 && errorBody) {
-			const errorCode = (errorBody as { error?: { code?: string } })?.error?.code ?? "";
-			const errorMessage = (errorBody as { error?: { message?: string } })?.error?.message ?? "";
-			
-			if (isWorkspaceDisabledError(errorResponse.status, errorCode, errorMessage)) {
+		if (isDisabledWorkspaceError) {
 				runtimeMetrics.failedRequests++;
 				runtimeMetrics.lastError = `Workspace disabled for account ${account.index + 1}`;
-				
+
 				// Get current workspace info for logging
 				const currentWorkspace = accountManager.getCurrentWorkspace(account);
 				const workspaceName = currentWorkspace?.name ?? currentWorkspace?.id ?? "unknown";
-				
+
 				logWarn(
-					`Workspace disabled/expired for account ${account.index + 1} (${account.email ?? "unknown"}) - workspace: ${workspaceName}. Rotating to next workspace.`,
-					{ errorCode, errorMessage },
+					`Workspace disabled/expired for account ${account.index + 1} - workspace: ${workspaceName}. Rotating to next workspace.`,
+					{ errorCode: workspaceErrorCode },
 				);
-				
+
 				// Disable the current workspace
 				accountManager.disableCurrentWorkspace(account);
-				
+
 				// Try to rotate to next enabled workspace
 				const nextWorkspace = accountManager.rotateToNextWorkspace(account);
-				
+
 				if (nextWorkspace) {
-					// Found another enabled workspace, retry with it
+					// Found another enabled workspace, persist it and restart the
+					// outer account loop so accountId and headers are rebuilt.
 					accountManager.saveToDiskDebounced();
-					
+
 					const newWorkspaceName = nextWorkspace.name ?? nextWorkspace.id;
 					await showToast(
 						`Workspace ${workspaceName} disabled. Switched to ${newWorkspaceName}.`,
 						"warning",
 						{ duration: toastDurationMs },
 					);
-					
+
 					logInfo(`Rotated to workspace ${newWorkspaceName} for account ${account.index + 1}`);
-					
-					// Retry the request with the new workspace (continue the loop)
-					continue;
+
+					// Allow the same account to be selected again with fresh request state.
+					attempted.delete(account.index);
+					continue accountAttemptLoop;
 				} else {
 					// No more enabled workspaces, disable the entire account
 					logWarn(`All workspaces disabled for account ${account.index + 1}. Disabling account.`);
-					
+
 					accountManager.setAccountEnabled(account.index, false);
 					accountManager.saveToDiskDebounced();
-					
+
 					await showToast(
 						`All workspaces disabled for account ${account.index + 1}. Switching to another account.`,
 						"warning",
 						{ duration: toastDurationMs },
 					);
-					
+
 					// Forget session affinity and rotate to next account
 					sessionAffinityStore?.forgetSession(sessionAffinityKey);
 					break;
 				}
-			}
+		}
+
+		if (errorResponse.status === 403 && !unsupportedModelInfo.isUnsupported && !isDisabledWorkspaceError) {
+			entitlementCache.markBlocked(
+				entitlementAccountKey,
+				model ?? modelFamily,
+				"plan-entitlement",
+			);
+			capabilityPolicyStore.recordFailure(
+				entitlementAccountKey,
+				capabilityModelKey,
+			);
 		}
 
 		if (recoveryHook && errorBody && isRecoverableError(errorBody)) {

lib/accounts.ts

@@ -849,7 +849,7 @@ export class AccountManager {
 		const workspace = account.workspaces[idx];
 		if (!workspace) return false;
 		workspace.enabled = false;
-		workspace.disabledAt = Date.now();
+		workspace.disabledAt = nowMs();
 		return true;
 	}
 

lib/request/fetch-helpers.ts

@@ -290,22 +290,24 @@ export function isWorkspaceDisabledError(status: number, code: string, bodyText:
                 }
         }
 
-        // Check for specific error codes that indicate workspace issues
-        const workspaceErrorCodes = [
-                "workspace_disabled",
-                "workspace_expired",
-                "workspace_terminated",
-                "account_disabled",
-                "account_expired",
-                "organization_disabled",
-                "billing_failed",
-                "payment_required",
-        ];
-        
-        if (workspaceErrorCodes.some((c) => code.toLowerCase().includes(c))) {
-                return true;
+        // Check for specific error codes that indicate workspace issues.
+        if (status === 403) {
+                const workspaceErrorCodes = [
+                        "workspace_disabled",
+                        "workspace_expired",
+                        "workspace_terminated",
+                        "account_disabled",
+                        "account_expired",
+                        "organization_disabled",
+                        "billing_failed",
+                        "payment_required",
+                ];
+
+                if (workspaceErrorCodes.some((c) => code.toLowerCase().includes(c))) {
+                        return true;
+                }
         }
-        
+
         return false;
 }
 

lib/storage/migrations.ts

@@ -5,17 +5,10 @@
 
 import { MODEL_FAMILIES, type ModelFamily } from "../prompts/codex.js";
 import type { AccountIdSource } from "../types.js";
+import type { Workspace } from "../accounts.js";
 
 export type CooldownReason = "auth-failure" | "network-error" | "rate-limit";
 
-export interface Workspace {
-	id: string;
-	name?: string;
-	enabled: boolean;
-	disabledAt?: number;
-	isDefault?: boolean;
-}
-
 export interface RateLimitStateV3 {
 	[key: string]: number | undefined;
 }

test/fetch-helpers.test.ts

@@ -346,6 +346,8 @@ describe('isWorkspaceDisabledError', () => {
 		expect(isWorkspaceDisabledError(400, '', 'Your workspace has been disabled')).toBe(false);
 		expect(isWorkspaceDisabledError(401, '', 'Your workspace has been disabled')).toBe(false);
 		expect(isWorkspaceDisabledError(500, '', 'Your workspace has been disabled')).toBe(false);
+		expect(isWorkspaceDisabledError(400, 'workspace_disabled', '')).toBe(false);
+		expect(isWorkspaceDisabledError(402, 'payment_required', '')).toBe(false);
 	});
 
 	it('returns false for 403 with unrelated messages', () => {