c4ebe4b078
Currently, when the access token expires, we attempt to use the refresh token to acquire a new access token. This works most of the time. However, there are situations where the refresh token is expired, exhausted (already used to perform a refresh), or revoked. In those cases, the current logic treats the error as transient and attempts to retry it repeatedly. This PR changes the token refresh logic to differentiate between permanent and transient errors. It also changes callers to treat the permanent errors as fatal rather than retrying them. And it provides better error messages to users so they understand how to address the problem. These error messages should also help us further understand why we're seeing examples of refresh token exhaustion. Here is the error message in the CLI. The same text appears within the extension. <img width="863" height="38" alt="image" src="https://github.com/user-attachments/assets/7ffc0d08-ebf0-4900-b9a9-265064202f4f" /> I also correct the spelling of "Re-connecting", which shouldn't have a hyphen in it. Testing: I manually tested these code paths by adding temporary code to programmatically cause my refresh token to be exhausted (by calling the token refresh endpoint in a tight loop more than 50 times). I then simulated an access token expiration, which caused the token refresh logic to be invoked. I confirmed that the updated logic properly handled the error condition. Note: We earlier discussed the idea of forcefully logging out the user at the point where token refresh failed. I made several attempts to do this, and all of them resulted in a bad UX. It's important to surface this error to users in a way that explains the problem and tells them that they need to log in again. We also previously discussed deleting the auth.json file when this condition is detected. That also creates problems because it effectively changes the auth status from logged in to logged out, and this causes odd failures and inconsistent UX. I think it's therefore better not to delete auth.json in this case. If the user closes the CLI or VSCE and starts it again, we properly detect that the access token is expired and the refresh token is "dead", and we force the user to go through the login flow at that time. This should address aspects of #6191, #5679, and #5505
47 lines
919 B
Rust
47 lines
919 B
Rust
// Aggregates all former standalone integration tests as modules.
|
|
|
|
#[cfg(not(target_os = "windows"))]
|
|
mod abort_tasks;
|
|
#[cfg(not(target_os = "windows"))]
|
|
mod apply_patch_cli;
|
|
#[cfg(not(target_os = "windows"))]
|
|
mod apply_patch_freeform;
|
|
#[cfg(not(target_os = "windows"))]
|
|
mod approvals;
|
|
mod auth_refresh;
|
|
mod cli_stream;
|
|
mod client;
|
|
mod codex_delegate;
|
|
mod compact;
|
|
mod compact_resume_fork;
|
|
mod deprecation_notice;
|
|
mod exec;
|
|
mod fork_conversation;
|
|
mod grep_files;
|
|
mod items;
|
|
mod json_result;
|
|
mod list_dir;
|
|
mod live_cli;
|
|
mod model_overrides;
|
|
mod model_tools;
|
|
mod otel;
|
|
mod prompt_caching;
|
|
mod read_file;
|
|
mod resume;
|
|
mod review;
|
|
mod rmcp_client;
|
|
mod rollout_list_find;
|
|
mod seatbelt;
|
|
mod shell_serialization;
|
|
mod stream_error_allows_next_turn;
|
|
mod stream_no_completed;
|
|
mod tool_harness;
|
|
mod tool_parallelism;
|
|
mod tools;
|
|
mod truncation;
|
|
mod undo;
|
|
mod unified_exec;
|
|
mod user_notification;
|
|
mod user_shell_cmd;
|
|
mod view_image;
|