fix(account-pool): recover failed requests before streaming

packages/templates/src/templates/bb-guide-plugins.md

@@ -89,6 +89,12 @@ attempt. If the token has expired and no other account can serve the request,
 the hub returns HTTP 503. Refresh resumes automatically after the delay.
 Rejected refresh credentials remain an account error.
 
+An OAuth HTTP 401 triggers one credential refresh and retry per account. A
+concurrent request that already refreshed the token supplies the replacement.
+Authentication failures and temporary upstream failures can fail over to
+another eligible account before a response reaches the client. The hub never
+replays a response after it starts streaming to the client.
+
 The builtin Keep Awake plugin prevents macOS idle sleep while bb is running.
 Its settings page lets you target all hosts or selected hosts. The CLI
 equivalents are:

plugins/account-pool/PLUGIN_OVERVIEW.md

@@ -13,6 +13,8 @@ The hub runs inside BB and serves an Anthropic Messages endpoint and an OpenAI R
 
 Concurrent requests share one OAuth refresh per account. During a temporary refresh outage, the hub can continue with an access token whose expiry is known and still in the future. It waits before another refresh attempt. If that token has expired and no other account can serve the request, the hub returns a temporary error and retries refresh on a later request. Rejected refresh credentials remain an account error.
 
+If an OAuth request receives HTTP 401, the hub refreshes its credential once and retries. It reuses a token already refreshed by another request. Authentication failures and temporary upstream failures can move the request to another eligible account before a response reaches the client. Once a response starts, the hub does not replay it on another account.
+
 ## Requirements
 
 Accounts you own and are permitted to use this way.

plugins/account-pool/src/claude-adapter.ts

@@ -97,8 +97,9 @@ export function createClaudeAdapter(options: {
       const secret = context.secret;
       if (
         secret.kind !== "oauth" ||
-        secret.expiresAt === null ||
-        secret.expiresAt > context.now() + REFRESH_WINDOW_MS
+        (!context.forceRefresh &&
+          (secret.expiresAt === null ||
+            secret.expiresAt > context.now() + REFRESH_WINDOW_MS))
       ) {
         return { secret, refreshed: false };
       }

plugins/account-pool/src/codex-adapter.ts

@@ -292,8 +292,9 @@ export function createCodexAdapter(options: {
       const secret = context.secret;
       if (
         secret.kind !== "oauth" ||
-        secret.expiresAt === null ||
-        secret.expiresAt > context.now() + REFRESH_WINDOW_MS
+        (!context.forceRefresh &&
+          (secret.expiresAt === null ||
+            secret.expiresAt > context.now() + REFRESH_WINDOW_MS))
       ) {
         return { secret, refreshed: false };
       }