Repository navigation
Bug Fixes
- classify a failed pooled-credential token refresh as an auth-failure #51
A pooled OAuth member whose refresh token is rejected (expired, already-used, or revoked) now cools and emits a cred_failover audit event plus a notice, instead of looking like a healthy member. Before this, the rejection was caught only when the provider's error body contained invalid_grant or invalid_token. OpenAI's dead-refresh response (token_expired, or "refresh token has already been used to generate a new access token") matched neither, so a pool whose refresh tokens had died kept reporting a stale 429 cooldown while the agent looped on auth 401s with no signal.
Any 4xx answer to a refresh_token grant at a pooled token endpoint now classifies as an auth-failure (tag refresh_rejected), and token_expired joins the recognized body tags. The check is scoped to refresh grants so an in-progress device_code or authorization_code login, whose 4xx is normal, never cools a healthy member.