mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-03 22:02:08 +03:00
cb1c5471dd
Root cause of the production token-invalidation storm (claude/aa5dd5cf
refreshed 1352x, kimi-coding 270x): when a refresh endpoint returned
invalid_grant in a non-canonical body shape (a JSON string, a double-encoded
string, a nested {error:{code}}, or raw text wrapped by a proxy/MITM),
refreshClaudeOAuthToken's errorBody.error === "invalid_grant" check failed and
returned null instead of the unrecoverable sentinel. The HealthCheck then kept
the connection active and re-tried every 60s forever (the loop + log flood +
upstream hammering that contributed to the 429s).
- extractOAuthErrorCode(): shape-agnostic OAuth error extractor (object, nested,
bare string, double-encoded JSON string, raw text) restricted to a known
unrecoverable set so transient errors (server_error, 502 HTML) never become
false positives.
- refreshClaudeOAuthToken + refreshAccessToken/Cline/Qoder/GitHub now classify
invalid_grant/invalid_request via the helper -> always emit the unrecoverable
sentinel so the HealthCheck deactivates cleanly instead of looping.
- HealthCheck refresh circuit breaker: track consecutive refresh failures in
providerSpecificData.refreshCircuit and back off exponentially (5->10->20...
->240min cap) instead of retrying every 60s; cleared on a successful refresh.
Stops the loop for null/network failures (e.g. dead proxy / Kimi fetch failed).
TDD: 26 new tests (19 resilience + 7 circuit breaker); 113 oauth/refresh/
healthcheck tests green. typecheck:core=0, lint clean.