feat: auto-rotate on disabled/expired workspace errors

Author: Microck

index.ts

@@ -147,6 +147,7 @@ import {
         rewriteUrlForCodex,
 	shouldRefreshToken,
 	transformRequestForCodex,
+	isWorkspaceDisabledError,
 } from "./lib/request/fetch-helpers.js";
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import {
@@ -1942,19 +1943,51 @@ while (attempted.size < Math.max(1, accountCount)) {
 					blockedModel,
 				);
 			}
-			if (errorResponse.status === 403 && !unsupportedModelInfo.isUnsupported) {
-				entitlementCache.markBlocked(
-					entitlementAccountKey,
-					model ?? modelFamily,
-					"plan-entitlement",
+		if (errorResponse.status === 403 && !unsupportedModelInfo.isUnsupported) {
+			entitlementCache.markBlocked(
+				entitlementAccountKey,
+				model ?? modelFamily,
+				"plan-entitlement",
+			);
+			capabilityPolicyStore.recordFailure(
+				entitlementAccountKey,
+				capabilityModelKey,
+			);
+		}
+
+		// Handle workspace disabled/expired errors by marking account as disabled and rotating
+		if (errorResponse.status === 403 && errorBody) {
+			const errorCode = (errorBody as { error?: { code?: string } })?.error?.code ?? "";
+			const errorMessage = (errorBody as { error?: { message?: string } })?.error?.message ?? "";
+			
+			if (isWorkspaceDisabledError(errorResponse.status, errorCode, errorMessage)) {
+				runtimeMetrics.failedRequests++;
+				runtimeMetrics.accountRotations++;
+				runtimeMetrics.lastError = `Workspace disabled for account ${account.index + 1}`;
+				
+				logWarn(
+					`Workspace disabled/expired for account ${account.index + 1} (${account.email ?? "unknown"}). Disabling account and rotating.`,
+					{ errorCode, errorMessage },
 				);
-				capabilityPolicyStore.recordFailure(
-					entitlementAccountKey,
-					capabilityModelKey,
+				
+				// Mark the account as disabled
+				accountManager.setAccountEnabled(account.index, false);
+				accountManager.saveToDiskDebounced();
+				
+				// Show a toast notification
+				await showToast(
+					`Workspace disabled for account ${account.index + 1}. Switching to another account.`,
+					"warning",
+					{ duration: toastDurationMs },
 				);
+				
+				// Forget session affinity and rotate to next account
+				sessionAffinityStore?.forgetSession(sessionAffinityKey);
+				break;
 			}
+		}
 
-			if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
+		if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
 					const errorType = detectErrorType(errorBody);
 					const toastContent = getRecoveryToastContent(errorType);
 					await showToast(

lib/request/fetch-helpers.ts

@@ -254,6 +254,61 @@ export function isEntitlementError(code: string, bodyText: string): boolean {
         return /usage_not_included|not.included.in.your.plan|subscription.does.not.include/i.test(haystack);
 }
 
+/**
+ * Detects whether an error indicates the workspace/account has been disabled or expired.
+ *
+ * Workspace disabled errors signal that the current workspace is no longer accessible
+ * (expired, disabled, or removed) and the plugin should automatically switch to another account.
+ *
+ * @param status - HTTP status code
+ * @param code - The error code string returned by the service
+ * @param bodyText - The response body text to inspect for workspace-related phrases
+ * @returns `true` if the error indicates a disabled/expired workspace
+ */
+export function isWorkspaceDisabledError(status: number, code: string, bodyText: string): boolean {
+        const haystack = `${code} ${bodyText}`.toLowerCase();
+        
+        // Check for HTTP 403 with workspace disabled messages
+        if (status === 403) {
+                // Common patterns for disabled/expired workspaces
+                const disabledPatterns = [
+                        /workspace.*(?:disabled|expired|deactivated|terminated)/i,
+                        /account.*(?:disabled|expired|deactivated|terminated)/i,
+                        /(?:workspace|account).*no longer.*(?:active|available|valid)/i,
+                        /(?:workspace|account).*has been.*(?:disabled|expired|closed)/i,
+                        /workspace.*(?:access|subscription).*expired/i,
+                        /billing.*(?:failed|expired|disabled)/i,
+                        /payment.*(?:failed|expired|required)/i,
+                        /organization.*(?:disabled|expired|inactive)/i,
+                        /team.*(?:disabled|expired|inactive)/i,
+                ];
+                
+                for (const pattern of disabledPatterns) {
+                        if (pattern.test(haystack)) {
+                                return true;
+                        }
+                }
+        }
+        
+        // Check for specific error codes that indicate workspace issues
+        const workspaceErrorCodes = [
+                "workspace_disabled",
+                "workspace_expired",
+                "workspace_terminated",
+                "account_disabled",
+                "account_expired",
+                "organization_disabled",
+                "billing_failed",
+                "payment_required",
+        ];
+        
+        if (workspaceErrorCodes.some((c) => code.toLowerCase().includes(c))) {
+                return true;
+        }
+        
+        return false;
+}
+
 /**
  * Constructs a standardized 403 entitlement error Response indicating the user lacks access to Codex models.
  *

test/fetch-helpers.test.ts

@@ -9,6 +9,7 @@ import {
     handleErrorResponse,
     handleSuccessResponse,
     isEntitlementError,
+    isWorkspaceDisabledError,
     createEntitlementErrorResponse,
 	getUnsupportedCodexModelInfo,
 	resolveUnsupportedCodexFallbackModel,
@@ -307,12 +308,57 @@ describe('Fetch Helpers Module', () => {
 			expect(isEntitlementError('rate_limit_exceeded', '')).toBe(false);
 		});
 
-		it('returns false for generic errors', () => {
-			expect(isEntitlementError('not_found', 'Resource not found')).toBe(false);
-		});
+	it('returns false for generic errors', () => {
+		expect(isEntitlementError('not_found', 'Resource not found')).toBe(false);
+	});
+});
+
+describe('isWorkspaceDisabledError', () => {
+	it('returns true for 403 with workspace disabled message', () => {
+		expect(isWorkspaceDisabledError(403, '', 'Your workspace has been disabled')).toBe(true);
+	});
+
+	it('returns true for 403 with workspace expired message', () => {
+		expect(isWorkspaceDisabledError(403, '', 'Workspace expired')).toBe(true);
+	});
+
+	it('returns true for 403 with account disabled message', () => {
+		expect(isWorkspaceDisabledError(403, '', 'Account has been deactivated')).toBe(true);
+	});
+
+	it('returns true for workspace_disabled error code', () => {
+		expect(isWorkspaceDisabledError(403, 'workspace_disabled', '')).toBe(true);
+	});
+
+	it('returns true for workspace_expired error code', () => {
+		expect(isWorkspaceDisabledError(403, 'workspace_expired', 'Some message')).toBe(true);
 	});
 
-	describe('createEntitlementErrorResponse', () => {
+	it('returns true for account_disabled error code', () => {
+		expect(isWorkspaceDisabledError(403, 'account_disabled', '')).toBe(true);
+	});
+
+	it('returns true for billing_failed error code', () => {
+		expect(isWorkspaceDisabledError(403, 'billing_failed', '')).toBe(true);
+	});
+
+	it('returns false for non-403 status even with disabled message', () => {
+		expect(isWorkspaceDisabledError(400, '', 'Your workspace has been disabled')).toBe(false);
+		expect(isWorkspaceDisabledError(401, '', 'Your workspace has been disabled')).toBe(false);
+		expect(isWorkspaceDisabledError(500, '', 'Your workspace has been disabled')).toBe(false);
+	});
+
+	it('returns false for 403 with unrelated messages', () => {
+		expect(isWorkspaceDisabledError(403, '', 'Permission denied')).toBe(false);
+		expect(isWorkspaceDisabledError(403, '', 'Not authorized')).toBe(false);
+	});
+
+	it('returns false for entitlement errors', () => {
+		expect(isWorkspaceDisabledError(403, 'usage_not_included', 'Not in your plan')).toBe(false);
+	});
+});
+
+describe('createEntitlementErrorResponse', () => {
 		it('returns 403 status with user-friendly message', async () => {
 			const resp = createEntitlementErrorResponse('original body');
 			expect(resp.status).toBe(403);