v1.5.1 — Throttle on HTTP 401 to prevent auth-storm

Fixes an auth-storm regression where invalid or expired credentials caused a tight 401 retry loop from hook invocations.

Fixed

• HTTP 401 from the AxonFlow agent now stamps a 5-minute throttle. When AXONFLOW_AUTH is invalid or expired, every PreToolUse and PostToolUse hook used to fire a 401, the envelope handler returned non-zero (it only fires on 429/403), and the script fell through. The next tool call immediately re-fired another 401 — a tight retry loop. One customer observed 716 retries against the audit endpoint from a single source IP in 24h. Now, on 401 the plugin stamps ~/.cache/axonflow/throttle-until with a 5-minute cooldown and auth_failure limit_type, so subsequent hook fires short-circuit locally. The user sees a one-time-per-UTC-day nudge on stderr pointing at https://getaxonflow.com/dashboard. After 5 minutes the throttle clears automatically and the next hook retries — so a refreshed credential is picked up without further action. Wired into both pre- and post-tool hooks. Fail-open semantics preserved.

---

Compatibility: requires AxonFlow platform v7.9.0+.