Merge branch 'release/pr-329' into release/integration-1.2.2

# Conflicts:
#	lib/refresh-guardian.ts
#	test/refresh-guardian.test.ts

Author: ndycode

lib/refresh-guardian.ts

@@ -1,6 +1,7 @@
 import { createLogger } from "./logger.js";
 import { refreshExpiringAccounts } from "./proactive-refresh.js";
 import type { AccountManager } from "./accounts.js";
+import { ACCOUNT_LIMITS } from "./constants.js";
 import { CodexAuthError } from "./errors.js";
 import type { CooldownReason } from "./storage.js";
 import type { TokenResult } from "./types.js";
@@ -25,80 +26,7 @@ export interface RefreshGuardianStats {
 }
 
 const DEFAULT_INTERVAL_MS = 60_000;
-
-function findMatchingLiveAccountIndexes(
-	liveAccounts: ManagedAccount[],
-	predicate: (candidate: ManagedAccount) => boolean,
-): number[] {
-	const matches: number[] = [];
-	for (const [index, candidate] of liveAccounts.entries()) {
-		if (predicate(candidate)) {
-			matches.push(index);
-		}
-	}
-	return matches;
-}
-
-function resolveLiveAccountIndex(
-	liveAccounts: ManagedAccount[],
-	sourceAccount: ManagedAccount,
-): number {
-	if (sourceAccount.accountId) {
-		const accountIdMatches = findMatchingLiveAccountIndexes(
-			liveAccounts,
-			(candidate) => candidate.accountId === sourceAccount.accountId,
-		);
-		const resolvedIndex = accountIdMatches[0];
-		if (resolvedIndex !== undefined) {
-			log.debug("Resolved refreshed account by accountId", {
-				sourceIndex: sourceAccount.index,
-				resolvedIndex,
-				matchCount: accountIdMatches.length,
-			});
-			if (accountIdMatches.length > 1) {
-				log.warn("Duplicate live accountId matches during refresh reconciliation", {
-					sourceIndex: sourceAccount.index,
-					resolvedIndex,
-					matchCount: accountIdMatches.length,
-				});
-			}
-			return resolvedIndex;
-		}
-	}
-
-	const sourceEmail = sanitizeEmail(sourceAccount.email);
-	if (sourceEmail) {
-		const emailMatches = findMatchingLiveAccountIndexes(
-			liveAccounts,
-			(candidate) => sanitizeEmail(candidate.email) === sourceEmail,
-		);
-		const resolvedIndex = emailMatches[0];
-		if (resolvedIndex !== undefined) {
-			log.debug("Resolved refreshed account by email", {
-				sourceIndex: sourceAccount.index,
-				resolvedIndex,
-				matchCount: emailMatches.length,
-			});
-			if (emailMatches.length > 1) {
-				log.warn("Duplicate live email matches during refresh reconciliation", {
-					sourceIndex: sourceAccount.index,
-					resolvedIndex,
-					matchCount: emailMatches.length,
-				});
-			}
-			return resolvedIndex;
-		}
-	}
-
-	const byToken = liveAccounts.findIndex(
-		(candidate) => candidate.refreshToken === sourceAccount.refreshToken,
-	);
-	log.debug("Resolved refreshed account by refresh token fallback", {
-		sourceIndex: sourceAccount.index,
-		resolvedIndex: byToken,
-	});
-	return byToken;
-}
+const NETWORK_FAILURE_COOLDOWN_MS = 6_000;
 
 export class RefreshGuardian {
 	private readonly getAccountManager: () => AccountManager | null;
@@ -170,6 +98,15 @@ export class RefreshGuardian {
 		return "network-error";
 	}
 
+	private getNetworkFailureCooldownMs(): number {
+		return Math.min(this.bufferMs, NETWORK_FAILURE_COOLDOWN_MS);
+	}
+
+	private getAuthFailureCooldownMs(failureCount: number): number {
+		const streak = Math.max(1, Math.floor(failureCount));
+		return Math.min(this.bufferMs, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS * streak);
+	}
+
 	private async applyRefreshOutcome(
 		manager: AccountManager,
 		sourceAccount: ReturnType<AccountManager["getAccountsSnapshot"]>[number],
@@ -185,7 +122,12 @@ export class RefreshGuardian {
 				if (result.tokenResult?.type !== "success") {
 					const account = manager.getAccountByIdentity(sourceAccount);
 					if (!account) return false;
-					manager.markAccountCoolingDown(account, this.bufferMs, "network-error");
+					manager.clearAuthFailures(account);
+					manager.markAccountCoolingDown(
+						account,
+						this.getNetworkFailureCooldownMs(),
+						"network-error",
+					);
 					this.stats.failed += 1;
 					this.stats.networkFailed += 1;
 					return true;
@@ -208,9 +150,10 @@ export class RefreshGuardian {
 							manager.getAccountByIdentity(sourceAccount, refreshedAuth) ??
 							manager.getAccountByIdentity(sourceAccount);
 						if (account) {
+							manager.clearAuthFailures(account);
 							manager.markAccountCoolingDown(
 								account,
-								this.bufferMs,
+								this.getNetworkFailureCooldownMs(),
 								"network-error",
 							);
 						}
@@ -231,7 +174,21 @@ export class RefreshGuardian {
 							? "auth-failure"
 							: "network-error";
 					if (account) {
-						manager.markAccountCoolingDown(account, this.bufferMs, cooldownReason);
+						if (cooldownReason === "auth-failure") {
+							const failureCount = manager.incrementAuthFailures(account);
+							manager.markAccountCoolingDown(
+								account,
+								this.getAuthFailureCooldownMs(failureCount),
+								cooldownReason,
+							);
+						} else {
+							manager.clearAuthFailures(account);
+							manager.markAccountCoolingDown(
+								account,
+								this.getNetworkFailureCooldownMs(),
+								cooldownReason,
+							);
+						}
 					}
 					this.stats.failed += 1;
 					if (cooldownReason === "auth-failure") this.stats.authFailed += 1;
@@ -245,7 +202,24 @@ export class RefreshGuardian {
 				const account = manager.getAccountByIdentity(sourceAccount);
 				if (!account) return false;
 				const cooldownReason = this.classifyFailureReason(result.tokenResult);
-				manager.markAccountCoolingDown(account, this.bufferMs, cooldownReason);
+				if (cooldownReason === "rate-limit") {
+					manager.clearAuthFailures(account);
+					manager.markRateLimited(account, this.bufferMs, "codex");
+				} else if (cooldownReason === "auth-failure") {
+					const failureCount = manager.incrementAuthFailures(account);
+					manager.markAccountCoolingDown(
+						account,
+						this.getAuthFailureCooldownMs(failureCount),
+						cooldownReason,
+					);
+				} else {
+					manager.clearAuthFailures(account);
+					manager.markAccountCoolingDown(
+						account,
+						this.getNetworkFailureCooldownMs(),
+						cooldownReason,
+					);
+				}
 				this.stats.failed += 1;
 				if (cooldownReason === "rate-limit") this.stats.rateLimited += 1;
 				else if (cooldownReason === "auth-failure") this.stats.authFailed += 1;
@@ -258,7 +232,12 @@ export class RefreshGuardian {
 			case "no_refresh_token": {
 				const account = manager.getAccountByIdentity(sourceAccount);
 				if (!account) return false;
-				manager.markAccountCoolingDown(account, this.bufferMs, "auth-failure");
+				const failureCount = manager.incrementAuthFailures(account);
+				manager.markAccountCoolingDown(
+					account,
+					this.getAuthFailureCooldownMs(failureCount),
+					"auth-failure",
+				);
 				manager.setAccountEnabled(account.index, false);
 				this.stats.noRefreshToken += 1;
 				this.stats.failed += 1;