Preserve auth-failure disable invariants

Author: ndycode

lib/accounts.ts

@@ -953,6 +953,12 @@ export class AccountManager {
 		if (enabled && account.disabledReason === "auth-failure") {
 			return { ok: false, reason: "auth-failure-blocked" };
 		}
+		// Once an account is auth-failure disabled, callers must refresh credentials
+		// instead of downgrading the reason to a manually re-enableable state.
+		if (!enabled && account.disabledReason === "auth-failure") {
+			account.enabled = false;
+			return { ok: true, account };
+		}
 		account.enabled = enabled;
 		if (enabled) {
 			delete account.disabledReason;
@@ -1065,6 +1071,8 @@ export class AccountManager {
 		while (true) {
 			flushIterations += 1;
 			if (flushIterations > MAX_FLUSH_ITERATIONS) {
+				// This is intentionally far above realistic debounce re-arm chains; if we
+				// still haven't converged, shutdown callers log the failure and continue exit.
 				log.warn("flushPendingSave exceeded max iterations; possible save loop", {
 					iterations: flushIterations - 1,
 				});

lib/storage/migrations.ts

@@ -123,7 +123,10 @@ export function migrateV1ToV3(v1: AccountStorageV1): AccountStorageV3 {
 				accessToken: account.accessToken,
 				expiresAt: account.expiresAt,
 				enabled: normalizeStoredEnabled(account.enabled),
-				disabledReason: account.enabled === false ? account.disabledReason ?? "user" : undefined,
+				disabledReason:
+					account.enabled === false
+						? normalizeAccountDisabledReason(account.disabledReason) ?? "user"
+						: undefined,
 				addedAt: account.addedAt,
 				lastUsed: account.lastUsed,
 				lastSwitchReason: account.lastSwitchReason,

test/accounts.test.ts

@@ -1240,7 +1240,7 @@ describe("AccountManager", () => {
       });
     });
 
-    it("preserves the legacy setAccountEnabled account-or-null contract", () => {
+    it("ignores explicit disable-reason overrides for auth-failure disabled accounts", () => {
       const now = Date.now();
       const stored = {
         version: 3 as const,
@@ -1258,14 +1258,50 @@ describe("AccountManager", () => {
 
       const manager = new AccountManager(undefined, stored);
 
+      const disabled = manager.trySetAccountEnabled(0, false, "user");
+      expect(disabled).toMatchObject({
+        ok: true,
+        account: {
+          enabled: false,
+          disabledReason: "auth-failure",
+        },
+      });
+
+      expect(manager.trySetAccountEnabled(0, true)).toEqual({
+        ok: false,
+        reason: "auth-failure-blocked",
+      });
       expect(manager.setAccountEnabled(0, true)).toBeNull();
+    });
+
+    it("preserves the legacy setAccountEnabled account-or-null contract", () => {
+      const now = Date.now();
+      const stored = {
+        version: 3 as const,
+        activeIndex: 0,
+        accounts: [
+          {
+            refreshToken: "token-1",
+            addedAt: now,
+            lastUsed: now,
+          },
+        ],
+      };
+
+      const manager = new AccountManager(undefined, stored);
+
       expect(manager.setAccountEnabled(99, false)).toBeNull();
 
       const userDisabled = manager.setAccountEnabled(0, false, "user");
       expect(userDisabled).toMatchObject({
         enabled: false,
         disabledReason: "user",
       });
+
+      const reenabled = manager.setAccountEnabled(0, true);
+      expect(reenabled).toMatchObject({
+        enabled: true,
+      });
     });
   });
 

test/storage.test.ts

@@ -1074,6 +1074,31 @@ describe("storage", () => {
       });
     });
 
+    it("defaults invalid migrated legacy disabled reasons to user", () => {
+      const data = {
+        version: 1,
+        activeIndex: 0,
+        accounts: [
+          {
+            refreshToken: "t1",
+            accountId: "A",
+            enabled: false,
+            disabledReason: "future-reason",
+            addedAt: 1,
+            lastUsed: 1,
+          },
+        ],
+      };
+
+      const result = normalizeAccountStorage(data);
+      expect(result?.version).toBe(3);
+      expect(result?.accounts[0]).toMatchObject({
+        refreshToken: "t1",
+        enabled: false,
+        disabledReason: "user",
+      });
+    });
+
     it("omits enabled for enabled accounts during v1 migration", () => {
       const data = {
         version: 1,