feat(gateway): re-mint once and resume on a 401 from an aged bearer - #1224
Open
brandonleung wants to merge 3 commits into
Open
feat(gateway): re-mint once and resume on a 401 from an aged bearer#1224brandonleung wants to merge 3 commits into
brandonleung wants to merge 3 commits into
Conversation
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
brandonleung
force-pushed
the
brandon/wizard-w1-3-remint-on-401
branch
from
September 8, 2026 18:11
7c0893a to
5200d83
Compare
brandonleung
force-pushed
the
brandon/wizard-w1-3-remint-on-401
branch
from
September 8, 2026 19:52
5200d83 to
155d804
Compare
brandonleung
force-pushed
the
brandon/wizard-w1-3-remint-on-401
branch
from
September 8, 2026 20:20
155d804 to
fb5732b
Compare
brandonleung
force-pushed
the
brandon/wizard-w1-3-remint-on-401
branch
from
September 8, 2026 20:45
fb5732b to
d1b2e48
Compare
brandonleung
force-pushed
the
brandon/wizard-w1-3-remint-on-401
branch
from
September 8, 2026 20:57
d1b2e48 to
3172e81
Compare
brandonleung
marked this pull request as ready for review
September 8, 2026 21:26
Member
|
@gewenyu99 we might need to update health checks. it might be looking at the old gateway |
gewenyu99
reviewed
Sep 8, 2026
gewenyu99
approved these changes
Sep 8, 2026
gewenyu99
left a comment
gewenyu99
left a comment
Collaborator
There was a problem hiding this comment.
How long is the TTL that we might need a remint mid run?
I think the shape is a little sus, I'm afraid of the mid-run nudging being pretty unpredictable.
Not blocking if this stack runs
| // A turn that ends on a 401 from an aged bearer re-mints once and | ||
| // continues; pi resolves the provider's apiKey per request, so | ||
| // re-registering is enough. | ||
| const turns = withGatewayRemint({ |
Collaborator
There was a problem hiding this comment.
Should we just refresh before every single agent start?
No single agent should run beyond the TTL/ this just chops up the conversation stream unnecessarily and will likely be soooper hard to maintain. But not blocking
| export function isGatewayAuthRejection( | ||
| errorMessage: string | undefined, | ||
| ): boolean { | ||
| return /\b401\b|authentication_error|unauthorized/i.test(errorMessage ?? ''); |
Collaborator
There was a problem hiding this comment.
There shouldn't be styling attached to stuff thrown through the gateway. There is a real/proper abort path to take
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… prose Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
brandonleung
force-pushed
the
brandon/wizard-w1-3-remint-on-401
branch
from
September 8, 2026 23:24
e6767f2 to
388cd7d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The anthropic subprocess captures its bearer at spawn and pi bakes it into the provider, so a token must outlive the whole session. That is why the server TTL is a day, and a shorter one cannot ship without this.
Changes
A 401 from an aged bearer re-mints and resumes instead of ending the run.
query()with a resume. Once per run: a second 401 fails, so a revoked token cannot drive an unbounded mint loop.Test plan
pnpm test. The 0.8 boundary runs under fake timers so the revert mutant dies on every run rather than by wall-clock luck; a second 401, a young bearer, and concurrent 401s each have a case.Known gap: a run longer than about two TTLs still dies at its second 401, so the charts TTL stays at its current value until that bound is either raised or accepted.