Skip to content

Refresh Codex OAuth token after unauthorized responses - #2287

Closed
mikemikimike wants to merge 2 commits into
netclaw-dev:devfrom
mikemikimike:netclaw-2264-codex
Closed

mikemikimike wants to merge 2 commits into
netclaw-dev:devfrom
mikemikimike:netclaw-2264-codex

Conversation

@mikemikimike

@mikemikimike mikemikimike commented Sep 30, 2026 •

Copy link
Copy Markdown

Summary

  • Refresh an OpenAI Codex OAuth access token when the backend rejects it with HTTP 401, even when the local expiry has not been reached.
  • Reuse a token refreshed by a concurrent request, update the request credential and account header, and retry the request once.
  • Add regression coverage for forced refresh and the 401 recovery path.

Fixes #2264
Fixes #2264

Issue: #2264

Validation

  • dotnet test src/Netclaw.Configuration.Tests/Netclaw.Configuration.Tests.csproj -c Release --no-build --filter FullyQualifiedName~ProviderOAuthTokenRefreshServiceTests (5 passed)
  • dotnet test src/Netclaw.Daemon.Tests/Netclaw.Daemon.Tests.csproj -c Release --no-build --filter FullyQualifiedName~OpenAiCodexTests (26 passed)
  • dotnet build Netclaw.slnx -c Release --no-restore (0 errors)
  • dotnet slopwatch analyze (0 issues)

@Aaronontheweb

Copy link
Copy Markdown
Collaborator

Thanks for the contribution. We reworked the fix in #2432: a 401 from the Codex backend is returned as an error response, not thrown as an exception, so the retry cannot live in a try/catch around ProcessNextAsync (the OpenAI SDK constructs ClientResultException only after the pipeline unwinds). #2432 detects the 401 by inspecting the response status and retries once. We kept the force-refresh idea. This PR will close automatically when #2432 merges.

Aaronontheweb added a commit that referenced this pull request Oct 11, 2026
…2432)

A 401 from the Codex backend is returned as an error response, not thrown as
an exception (the OpenAI SDK throws ClientResultException only after the
pipeline unwinds). Detect the 401 by inspecting the response status after the
downstream run, then force-refresh the token and retry once.

Add ForceRefreshAccessTokenAsync, which reuses a token already refreshed by a
concurrent request instead of rotating the refresh token a second time.

Supersedes #2287.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Memory curation LLM calls get intermittent HTTP 401 while the main model works (llm_available=True)

2 participants