fix(opencode): persist ineligible account state

Author: ualtinok

packages/opencode/src/plugin.ts

@@ -0,0 +1,69 @@
+import { mkdtemp, readFile, rm, stat } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+
+import { afterEach, beforeEach, describe, expect, it } from "vitest"
+
+import { loadAccounts, saveAccountsReplace } from "./storage"
+
+let configDir = ""
+let previousConfigDir: string | undefined
+
+beforeEach(async () => {
+  previousConfigDir = process.env.OPENCODE_CONFIG_DIR
+  configDir = await mkdtemp(join(tmpdir(), "antigravity-ineligible-"))
+  process.env.OPENCODE_CONFIG_DIR = configDir
+})
+
+afterEach(async () => {
+  if (previousConfigDir === undefined) {
+    delete process.env.OPENCODE_CONFIG_DIR
+  } else {
+    process.env.OPENCODE_CONFIG_DIR = previousConfigDir
+  }
+  await rm(configDir, { recursive: true, force: true })
+})
+
+describe("account ineligibility disk persistence", () => {
+  it("round-trips the disabled state and eligibility metadata in the real account file", async () => {
+    await saveAccountsReplace({
+      version: 4,
+      accounts: [
+        {
+          email: "blocked@example.com",
+          refreshToken: "refresh-token",
+          addedAt: 1,
+          lastUsed: 2,
+          enabled: false,
+          accountIneligible: true,
+          accountIneligibleAt: 100,
+          accountIneligibleReason: "ACCOUNT_INELIGIBLE",
+          eligibilityStateUpdatedAt: 100,
+        },
+      ],
+      activeIndex: 0,
+    })
+
+    const storagePath = join(configDir, "antigravity-accounts.json")
+    const raw = JSON.parse(await readFile(storagePath, "utf8")) as {
+      accounts: Array<Record<string, unknown>>
+    }
+    expect(raw.accounts[0]).toMatchObject({
+      enabled: false,
+      accountIneligible: true,
+      accountIneligibleAt: 100,
+      accountIneligibleReason: "ACCOUNT_INELIGIBLE",
+      eligibilityStateUpdatedAt: 100,
+    })
+    expect((await stat(storagePath)).mode & 0o777).toBe(0o600)
+
+    await expect(loadAccounts()).resolves.toMatchObject({
+      accounts: [expect.objectContaining({
+        enabled: false,
+        accountIneligible: true,
+        accountIneligibleReason: "ACCOUNT_INELIGIBLE",
+        eligibilityStateUpdatedAt: 100,
+      })],
+    })
+  })
+})

packages/opencode/src/plugin/account-ineligibility.persistence.test.ts

@@ -0,0 +1,141 @@
+import { beforeAll, describe, expect, it, vi } from "vitest"
+
+type ExtractAccessBlock = (body: string) => {
+  validationRequired: boolean
+  accountIneligible: boolean
+  message?: string
+  verifyUrl?: string
+}
+
+let extractAccessBlock: ExtractAccessBlock | undefined
+let buildProbeRequest: ((projectId: string) => Record<string, unknown>) | undefined
+let interpretProbeResponse: ((response: Response) => Promise<{
+  status: "ok" | "verification-required" | "ineligible" | "error"
+  message: string
+}>) | undefined
+
+beforeAll(async () => {
+  vi.mock("@opencode-ai/plugin", () => ({ tool: vi.fn() }))
+  const { __testExports } = await import("../plugin")
+  const exports = __testExports as {
+    buildAccountAccessProbeRequest?: (projectId: string) => Record<string, unknown>
+    extractAccountAccessErrorDetails?: ExtractAccessBlock
+    interpretAccountAccessProbeResponse?: (response: Response) => Promise<{
+      status: "ok" | "verification-required" | "ineligible" | "error"
+      message: string
+    }>
+  }
+  buildProbeRequest = exports.buildAccountAccessProbeRequest
+  extractAccessBlock = exports.extractAccountAccessErrorDetails
+  interpretProbeResponse = exports.interpretAccountAccessProbeResponse
+})
+
+describe("account eligibility recovery", () => {
+  it("finishes a successful probe without waiting for an open SSE body", async () => {
+    let cancelled = false
+    const body = new ReadableStream({
+      pull(controller) {
+        controller.enqueue(new TextEncoder().encode("data: still-open\n\n"))
+      },
+      cancel() {
+        cancelled = true
+      },
+    })
+
+    await expect(interpretProbeResponse?.(new Response(body, { status: 200 }))).resolves.toMatchObject({
+      status: "ok",
+    })
+    expect(cancelled).toBe(true)
+  })
+
+  it("classifies ineligibility only on HTTP 403", async () => {
+    const body = JSON.stringify({ error: { reason: "ACCOUNT_INELIGIBLE" } })
+
+    await expect(interpretProbeResponse?.(new Response(body, { status: 403 }))).resolves.toMatchObject({
+      status: "ineligible",
+    })
+    await expect(interpretProbeResponse?.(new Response(body, { status: 500 }))).resolves.toMatchObject({
+      status: "error",
+    })
+  })
+
+  it("uses the current AGY request metadata contract for access probes", () => {
+    const body = buildProbeRequest?.("project-a") as {
+      project: string
+      requestId: string
+      model: string
+      request: {
+        sessionId: string
+        labels: Record<string, string>
+        contents: unknown[]
+      }
+    }
+
+    expect(body).toMatchObject({
+      project: "project-a",
+      model: "gemini-3.5-flash-low",
+      request: {
+        sessionId: "-3750763034362895579",
+        labels: {
+          model_enum: "MODEL_PLACEHOLDER_M20",
+          last_step_index: "1",
+        },
+      },
+    })
+    expect(body.requestId).toMatch(/^agent\/[0-9a-f-]+\/\d+\/[0-9a-f-]+\/2$/)
+  })
+})
+
+describe("account ineligibility classification", () => {
+  it("recognizes the exact structured ACCOUNT_INELIGIBLE reason", () => {
+    const result = extractAccessBlock?.(JSON.stringify({
+      error: {
+        code: 403,
+        status: "PERMISSION_DENIED",
+        message: "This account cannot use Antigravity.",
+        details: [{ reason: "ACCOUNT_INELIGIBLE" }],
+      },
+    }))
+
+    expect(result).toMatchObject({
+      accountIneligible: true,
+      validationRequired: false,
+      message: "This account cannot use Antigravity.",
+    })
+  })
+
+  it("recognizes ACCOUNT_INELIGIBLE inside an SSE error frame", () => {
+    const result = extractAccessBlock?.(
+      'data: {"error":{"message":"Not eligible","metadata":{"reason":"ACCOUNT_INELIGIBLE"}}}\n\n',
+    )
+
+    expect(result?.accountIneligible).toBe(true)
+    expect(result?.message).toBe("Not eligible")
+  })
+
+  it("does not disable accounts for generic access-denied text", () => {
+    for (const message of [
+      "Access denied",
+      "Permission denied",
+      "Your account is not eligible for this feature",
+      "An upstream service denied access",
+      "ACCOUNT_INELIGIBLE_TEMPORARY",
+    ]) {
+      const result = extractAccessBlock?.(JSON.stringify({ error: { code: 403, message } }))
+      expect(result?.accountIneligible, message).toBe(false)
+    }
+  })
+
+  it("keeps VALIDATION_REQUIRED separate from account ineligibility", () => {
+    const result = extractAccessBlock?.(JSON.stringify({
+      error: {
+        code: 403,
+        message: "Verify your account",
+        details: [{ reason: "VALIDATION_REQUIRED" }],
+      },
+    }))
+
+    expect(result?.validationRequired).toBe(true)
+    expect(result?.accountIneligible).toBe(false)
+  })
+})

packages/opencode/src/plugin/account-ineligibility.test.ts

@@ -16,6 +16,7 @@ vi.mock("./storage", async (importOriginal) => {
 
 describe("AccountManager", () => {
   beforeEach(() => {
+    vi.clearAllMocks();
     vi.useRealTimers();
     vi.stubGlobal("process", { ...process, pid: 0 });
   });
@@ -38,6 +39,88 @@ describe("AccountManager", () => {
     expect(manager.getAccountCount()).toBe(0);
   });
 
+  it("persists explicit ineligibility, rejects manual enable, and recovers only after a successful recheck", async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(1_000);
+    const stored: AccountStorageV4 = {
+      version: 4,
+      accounts: [
+        { refreshToken: "r1", projectId: "p1", addedAt: 1, lastUsed: 0 },
+      ],
+      activeIndex: 0,
+    };
+    const manager = new AccountManager(undefined, stored);
+
+    expect(manager.markAccountIneligible(0, "ACCOUNT_INELIGIBLE")).toBe(true);
+    expect(manager.getAccountsSnapshot()[0]).toMatchObject({
+      enabled: false,
+      accountIneligible: true,
+      accountIneligibleAt: 1_000,
+      accountIneligibleReason: "ACCOUNT_INELIGIBLE",
+      eligibilityStateUpdatedAt: 1_000,
+    });
+    expect(manager.setAccountEnabled(0, true)).toBe(false);
+
+    await manager.saveToDisk();
+    expect(vi.mocked(saveAccounts)).toHaveBeenCalledWith(expect.objectContaining({
+      accounts: [expect.objectContaining({
+        enabled: false,
+        accountIneligible: true,
+        eligibilityStateUpdatedAt: 1_000,
+      })],
+    }));
+
+    vi.setSystemTime(2_000);
+    expect(manager.clearAccountAccessBlocks(0, true)).toBe(true);
+    expect(manager.getAccountsSnapshot()[0]).toMatchObject({
+      enabled: true,
+      accountIneligible: false,
+      eligibilityStateUpdatedAt: 2_000,
+    });
+    await manager.saveToDisk();
+    vi.clearAllTimers();
+  });
+
+  it("keeps ineligible and verification-required states mutually exclusive", () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(1_000);
+    const manager = new AccountManager(undefined, {
+      version: 4,
+      accounts: [
+        {
+          refreshToken: "r1",
+          projectId: "p1",
+          addedAt: 1,
+          lastUsed: 0,
+          verificationRequired: true,
+          verificationRequiredAt: 500,
+          verificationRequiredReason: "verify",
+          verificationUrl: "https://example.com/verify",
+        },
+      ],
+      activeIndex: 0,
+    });
+
+    manager.markAccountIneligible(0, "ACCOUNT_INELIGIBLE");
+    expect(manager.getAccountsSnapshot()[0]).toMatchObject({
+      verificationRequired: false,
+      accountIneligible: true,
+    });
+    expect(manager.getAccountsSnapshot()[0]?.verificationUrl).toBeUndefined();
+
+    vi.setSystemTime(2_000);
+    manager.markAccountVerificationRequired(0, "Verify again", "https://example.com/new");
+    expect(manager.getAccountsSnapshot()[0]).toMatchObject({
+      enabled: false,
+      verificationRequired: true,
+      verificationRequiredReason: "Verify again",
+      accountIneligible: false,
+      eligibilityStateUpdatedAt: 2_000,
+    });
+    expect(manager.getAccountsSnapshot()[0]?.accountIneligibleReason).toBeUndefined();
+    vi.clearAllTimers();
+  });
+
   it("returns current account when not rate-limited for family", () => {
     const stored: AccountStorageV4 = {
       version: 4,