Harden workspace-disabled detection

Author: ndycode

lib/request/fetch-helpers.ts

@@ -265,50 +265,52 @@ export function isEntitlementError(code: string, bodyText: string): boolean {
  * @param bodyText - The response body text to inspect for workspace-related phrases
  * @returns `true` if the error indicates a disabled/expired workspace
  */
-export function isWorkspaceDisabledError(status: number, code: string, bodyText: string): boolean {
-        const haystack = `${code} ${bodyText}`.toLowerCase();
-        
-        // Check for HTTP 403 with workspace disabled messages
-        if (status === 403) {
-                // Common patterns for disabled/expired workspaces
-                const disabledPatterns = [
-                        /workspace.*(?:disabled|expired|deactivated|terminated)/i,
-                        /account.*(?:disabled|expired|deactivated|terminated)/i,
-                        /(?:workspace|account).*no longer.*(?:active|available|valid)/i,
-                        /(?:workspace|account).*has been.*(?:disabled|expired|closed)/i,
-                        /workspace.*(?:access|subscription).*expired/i,
-                        /billing.*(?:failed|expired|disabled)/i,
-                        /payment.*(?:failed|expired|required)/i,
-                        /organization.*(?:disabled|expired|inactive)/i,
-                        /team.*(?:disabled|expired|inactive)/i,
-                ];
-                
-                for (const pattern of disabledPatterns) {
-                        if (pattern.test(haystack)) {
-                                return true;
-                        }
-                }
+export function isWorkspaceDisabledError(
+        status: number,
+        code: unknown,
+        bodyText: string,
+): boolean {
+        if (status !== 403) {
+                return false;
         }
-        
-        // Check for specific error codes that indicate workspace issues.
-        if (status === 403) {
-                const workspaceErrorCodes = [
-                        "workspace_disabled",
-                        "workspace_expired",
-                        "workspace_terminated",
-                        "account_disabled",
-                        "account_expired",
-                        "organization_disabled",
-                        "billing_failed",
-                        "payment_required",
-                ];
-
-                if (workspaceErrorCodes.some((c) => code.toLowerCase().includes(c))) {
+
+        const normalizedCode = typeof code === "string" ? code.trim().toLowerCase() : "";
+        const haystack = `${normalizedCode} ${bodyText}`.toLowerCase();
+
+        const disabledPatterns = [
+                /workspace.*(?:disabled|expired|deactivated|terminated)/i,
+                /account.*(?:disabled|expired|deactivated|terminated)/i,
+                /(?:workspace|account).*no longer.*(?:active|available|valid)/i,
+                /(?:workspace|account).*has been.*(?:disabled|expired|closed)/i,
+                /workspace.*(?:access|subscription).*expired/i,
+                /organization.*(?:disabled|expired|inactive)/i,
+                /team.*(?:disabled|expired|inactive)/i,
+        ];
+
+        for (const pattern of disabledPatterns) {
+                if (pattern.test(haystack)) {
                         return true;
                 }
         }
 
-        return false;
+        const workspaceErrorCodes = new Set([
+                "workspace_disabled",
+                "workspace_expired",
+                "workspace_terminated",
+                "account_disabled",
+                "account_expired",
+                "organization_disabled",
+        ]);
+        if (workspaceErrorCodes.has(normalizedCode)) {
+                return true;
+        }
+
+        const normalizedTokens = normalizedCode
+                .split(/[^a-z0-9_]+/i)
+                .map((token) => token.trim())
+                .filter((token) => token.length > 0);
+
+        return normalizedTokens.some((token) => workspaceErrorCodes.has(token));
 }
 
 /**

test/fetch-helpers.test.ts

@@ -338,8 +338,8 @@ describe('isWorkspaceDisabledError', () => {
 		expect(isWorkspaceDisabledError(403, 'account_disabled', '')).toBe(true);
 	});
 
-	it('returns true for billing_failed error code', () => {
-		expect(isWorkspaceDisabledError(403, 'billing_failed', '')).toBe(true);
+	it('returns true for organization_disabled error code', () => {
+		expect(isWorkspaceDisabledError(403, 'organization_disabled', '')).toBe(true);
 	});
 
 	it('returns false for non-403 status even with disabled message', () => {
@@ -358,6 +358,19 @@ describe('isWorkspaceDisabledError', () => {
 	it('returns false for entitlement errors', () => {
 		expect(isWorkspaceDisabledError(403, 'usage_not_included', 'Not in your plan')).toBe(false);
 	});
+
+	it('returns false for numeric error codes', () => {
+		expect(isWorkspaceDisabledError(403, 402, 'Workspace disabled')).toBe(true);
+		expect(isWorkspaceDisabledError(403, 402, 'Billing failed for your subscription')).toBe(false);
+		expect(isWorkspaceDisabledError(403, 0, '')).toBe(false);
+	});
+
+	it('returns false for billing-style 403 codes without workspace or account disable signals', () => {
+		expect(isWorkspaceDisabledError(403, 'billing_failed', '')).toBe(false);
+		expect(isWorkspaceDisabledError(403, 'payment_required', '')).toBe(false);
+		expect(isWorkspaceDisabledError(403, '', 'Payment required to continue')).toBe(false);
+		expect(isWorkspaceDisabledError(403, '', 'Billing failed for your plan')).toBe(false);
+	});
 });
 
 describe('createEntitlementErrorResponse', () => {

test/index-retry.test.ts

@@ -479,6 +479,7 @@ describe("OpenAIAuthPlugin rate-limit retry", () => {
 			enabled: false,
 		});
 		expect(accountManagerState.saveToDiskDebouncedCalls).toBeGreaterThanOrEqual(1);
+		expect(exhaustedAccount.enabled).toBe(false);
 
 		const firstHeaders = fetchMock.mock.calls[0]?.[1]?.headers as Headers;
 		const secondHeaders = fetchMock.mock.calls[1]?.[1]?.headers as Headers;