Repository navigation
Select the credential from recorded quota state via agent-shim #128
Description
The action picks among the credentials in its fallback secret without knowing which account has headroom, so a limited account can be tried first. The idea is to let agent-shim make that selection from recorded quota state.
Findings so far, from a throwaway probe workflow run against a haiku request and the usage route:
- Setup tokens return 403
permission_erroron/api/oauth/usage(inference-only scope), so the usage route cannot be read with them. - A normal run's stream-json carries a
rate_limit_event, so selection from recorded state looks viable without the usage route. - One credential in the fallback list returns 401
authentication_errorand needs replacing (a secret only a maintainer can mint).
Not yet done: probe B, which supplies a full-scope refresh token through CLAUDE_CODE_OAUTH_REFRESH_TOKEN and CLAUDE_CODE_OAUTH_SCOPES to see whether the usage route is readable in CI. It needs one interactive browser login into an isolated config directory, so it cannot run unattended. The selection step itself is not started.
Activity
claude commentedon Oct 13, 2026
What this looks like: An enhancement proposal/research note (filed by a repo maintainer) about improving the credential fallback mechanism in
action.yml: instead of always trying fallback credentials in the order configured, select based on recorded quota/rate-limit state so an already-exhausted account isn't tried first. It's written as in-progress investigation notes rather than a finished spec — no bug, no urgency, nothing user-facing broken today.Note: the issue body appears to have passed through a compression layer before reaching me (it rendered as a
<<ccr:...>>placeholder via the normal view, and the raw API fetch came back as a lossy summary rather than verbatim text), so the detail below is my best reconstruction, not a quote — worth a human double-checking the original body for exact wording (error codes, env var names, etc.) before acting on it.Related issues: none found. I searched issue/PR history for "fallback credential", "oauth usage", "rate_limit_event", and "agent-shim" and found no prior or duplicate issue;
docs/credentials.mddocuments the existing ordered fallback chain but nothing about quota-aware selection.What is missing:
action.yml,docs/, prompts, workflows) — it's not clear whether this refers to an external tool, a planned component, or something that lives elsewhere. Worth clarifying what it is and how it would plug into the five statically-unrolledattempt_Nsteps inaction.yml.CLAUDE_CODE_OAUTH_REFRESH_TOKEN/CLAUDE_CODE_OAUTH_SCOPESto check whether the usage route is readable in CI) is blocked on an interactive browser login that can't run unattended, and the selection step hasn't been started.Suggested next step: Given the
/api/oauth/usage403 for setup-token scopes, the more promising path noted here is using therate_limit_eventalready present in a run'sstream-jsonoutput rather than pursuing the usage-route probe further — that data is already being read in a related form byscripts/execution-result.shfor the rate-limit retry gate (see docs/credentials.md). A concrete first step would be a small design note on where recorded quota state would be persisted between runs (a composite action's steps don't share state across separate workflow runs) before touching theattempt_Nsteps inaction.yml.Labels applied:
enhancement. No native issue type set — onlyBugappears on existing issues in this repository's history, and this isn't a bug.github-actions commentedon Oct 13, 2026
🗜️ Headroom context compression