fix: preserve live refresh state and terminal auth setter failures

Author: ndycode

lib/accounts.ts

@@ -804,9 +804,9 @@ export class AccountManager {
 		const nextAccountId = extractAccountId(auth.access)?.trim() || undefined;
 		const nextEmail = sanitizeEmail(extractAccountEmail(auth.access));
 		try {
-			return await withAccountStorageTransaction(async (current, persist) => {
+			return await withAccountStorageTransaction(async (_current, persist) => {
 				const nextStorage = structuredClone(
-					current ?? this.buildStorageSnapshot(),
+					this.buildStorageSnapshot(),
 				) as AccountStorageV3;
 				const storageIndex = findAccountIndexByIdentity(
 					nextStorage.accounts,

lib/refresh-guardian.ts

@@ -124,7 +124,25 @@ export class RefreshGuardian {
 					multiAccount: true,
 				};
 				try {
-					await manager.commitRefreshedAuth(sourceAccount, refreshedAuth);
+					const committedAccount = await manager.commitRefreshedAuth(
+						sourceAccount,
+						refreshedAuth,
+					);
+					if (!committedAccount) {
+						const account =
+							manager.getAccountByIdentity(sourceAccount, refreshedAuth) ??
+							manager.getAccountByIdentity(sourceAccount);
+						if (account) {
+							manager.markAccountCoolingDown(
+								account,
+								this.bufferMs,
+								"network-error",
+							);
+						}
+						this.stats.failed += 1;
+						this.stats.networkFailed += 1;
+						return !!account;
+					}
 				} catch (error) {
 					log.warn("Refresh guardian commit failed", {
 						sourceIndex: sourceAccount.index,

lib/request/fetch-helpers.ts

@@ -461,7 +461,9 @@ export async function refreshAndUpdateToken(
 ): Promise<Auth> {
 	const authSetter = (client as Partial<CodexAuthSetter>).auth;
 	if (!authSetter || typeof authSetter.set !== "function") {
-		throw new CodexAuthError(ERROR_MESSAGES.TOKEN_REFRESH_FAILED, { retryable: true });
+		throw new CodexAuthError(ERROR_MESSAGES.TOKEN_REFRESH_FAILED, {
+			retryable: false,
+		});
 	}
 
 	const refreshToken = currentAuth.type === "oauth" ? currentAuth.refresh : "";

test/accounts.test.ts

@@ -1159,6 +1159,76 @@ describe("AccountManager", () => {
       expect(account.consecutiveAuthFailures).toBe(0);
     });
 
+    it("preserves unsaved live pool state when persisting refreshed auth", async () => {
+      const { withAccountStorageTransaction } = await import("../lib/storage.js");
+      const mockWithAccountStorageTransaction = vi.mocked(
+        withAccountStorageTransaction,
+      );
+      const now = Date.now();
+      const stored = {
+        version: 3 as const,
+        activeIndex: 0,
+        activeIndexByFamily: {
+          codex: 0,
+        },
+        accounts: [
+          {
+            refreshToken: "old-refresh-a",
+            accessToken: "old-access-a",
+            expiresAt: now,
+            addedAt: now,
+            lastUsed: now,
+            email: "a@example.com",
+          },
+          {
+            refreshToken: "old-refresh-b",
+            accessToken: "old-access-b",
+            expiresAt: now,
+            addedAt: now,
+            lastUsed: now,
+            email: "b@example.com",
+          },
+        ],
+      };
+      const manager = new AccountManager(undefined, stored as any);
+      const accountA = manager.getAccountByIndex(0)!;
+      const accountB = manager.getAccountByIndex(1)!;
+      manager.markSwitched(accountB, "rotation", "codex");
+      manager.markRateLimited(accountB, 45_000, "codex");
+      manager.markAccountCoolingDown(accountB, 30_000, "network-error");
+
+      const refreshedAuth: OAuthAuthDetails = {
+        type: "oauth",
+        access: "header.payload.signature",
+        refresh: "new-refresh-a",
+        expires: now + 3_600_000,
+      };
+
+      mockWithAccountStorageTransaction.mockImplementationOnce(async (handler) => {
+        const persist = vi.fn().mockResolvedValue(undefined);
+        const result = await handler(stored as any, persist);
+
+        expect(persist).toHaveBeenCalledTimes(1);
+        const persistedStorage = persist.mock.calls[0]?.[0];
+        expect(persistedStorage?.activeIndex).toBe(1);
+        expect(persistedStorage?.activeIndexByFamily?.codex).toBe(1);
+        expect(persistedStorage?.accounts[0]?.refreshToken).toBe("new-refresh-a");
+        expect(persistedStorage?.accounts[1]?.rateLimitResetTimes?.codex).toBeGreaterThan(
+          now,
+        );
+        expect(persistedStorage?.accounts[1]?.cooldownReason).toBe(
+          "network-error",
+        );
+        expect(persistedStorage?.accounts[1]?.coolingDownUntil).toBeGreaterThan(
+          now,
+        );
+
+        return result;
+      });
+
+      await manager.commitRefreshedAuth(accountA, refreshedAuth);
+    });
+
     it("propagates storage write failure as retryable CodexAuthError", async () => {
       const { withAccountStorageTransaction } = await import("../lib/storage.js");
       const mockWithAccountStorageTransaction = vi.mocked(

test/fetch-helpers.test.ts

@@ -86,7 +86,7 @@ describe('Fetch Helpers Module', () => {
 				(err) => err as CodexAuthError,
 			);
 			expect(error).toBeInstanceOf(CodexAuthError);
-			expect(error.retryable).toBe(true);
+			expect(error.retryable).toBe(false);
 			expect(refreshSpy).not.toHaveBeenCalled();
 		});
 
@@ -99,7 +99,7 @@ describe('Fetch Helpers Module', () => {
 				(err) => err as CodexAuthError,
 			);
 			expect(error).toBeInstanceOf(CodexAuthError);
-			expect(error.retryable).toBe(true);
+			expect(error.retryable).toBe(false);
 			expect(refreshSpy).not.toHaveBeenCalled();
 		});
 

test/refresh-guardian.test.ts

@@ -711,6 +711,52 @@ describe("refresh-guardian", () => {
     );
   });
 
+  it("treats null commit results as retryable network cooldowns", async () => {
+    const accountA = createManagedAccount(0);
+    const manager = createManagerMock([accountA]);
+    const commitRefreshedAuthMock = manager
+      .commitRefreshedAuth as ReturnType<typeof vi.fn>;
+    commitRefreshedAuthMock.mockResolvedValueOnce(null);
+
+    const { RefreshGuardian } = await import("../lib/refresh-guardian.js");
+    const guardian = new RefreshGuardian(() => manager, {
+      bufferMs: 60_000,
+      intervalMs: 5_000,
+    });
+
+    refreshExpiringAccountsMock.mockResolvedValue(
+      new Map([
+        [
+          0,
+          {
+            refreshed: true,
+            reason: "success",
+            tokenResult: {
+              type: "success",
+              access: "access-0",
+              refresh: "refresh-0-new",
+              expires: Date.now() + 3_600_000,
+            },
+          },
+        ],
+      ]),
+    );
+
+    await guardian.tick();
+
+    expect(applyRefreshResultMock).not.toHaveBeenCalled();
+    expect(commitRefreshedAuthMock).toHaveBeenCalledTimes(1);
+    expect(
+      manager.markAccountCoolingDown as ReturnType<typeof vi.fn>,
+    ).toHaveBeenCalledWith(accountA, 60_000, "network-error");
+
+    const stats = guardian.getStats();
+    expect(stats.runs).toBe(1);
+    expect(stats.refreshed).toBe(0);
+    expect(stats.failed).toBe(1);
+    expect(stats.networkFailed).toBe(1);
+  });
+
   it("treats commit failures as retryable network cooldowns and continues the batch", async () => {
     const accountA = createManagedAccount(0);
     const accountB = createManagedAccount(1);