@gajae-code/ai 0.12.1 → 0.12.2

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [0.12.2] - 2026-07-30
+
 ## [0.12.1] - 2026-07-29
 
 ### Fixed
@@ -19,6 +21,7 @@
 - The Anthropic "thinking blocks in the latest assistant message cannot be modified" 400 now escalates its one-shot replay repair. The error names the latest assistant message but its cited `messages.N.content.M` path can point at an earlier replayed turn, so the latest-only repair was rejected identically and killed the turn; recovery now retries once more with thinking dropped from every replayed assistant message.
 - Anthropic adaptive-thinking `display` support is now decided by the canonical model-version parser instead of a provider-local `claude-opus-(\d+)-(\d+)` regex. The regex only matched two-component ids, so a single-component alias such as `claude-opus-5` was classified as pre-4.7 while its dated snapshot `claude-opus-5-20260101` was not: the alias sent `thinking: { type: "adaptive" }` without `display: "summarized"`, additionally requested the `interleaved-thinking-2025-05-14` beta, and had its returned thinking blocks recorded as raw rather than summarized. Both Anthropic and Bedrock providers now share `supportsAnthropicAdaptiveThinkingDisplay`, so alias and dated ids of the same model send an identical request shape.
 - Anthropic requests that force a tool choice no longer replay signed thinking blocks. Forcing `tool_choice` strips `thinking` from the request (the API rejects the combination), but the converted history still carried native `thinking`/`redacted_thinking` blocks from thinking-enabled turns, so eager tool-forcing turns (e.g. the todo bootstrap) sent a request whose history contradicted its own thinking setting and drew a 400. The replay now degrades in the same rebuild; the forced request trades its prompt-cache prefix for a shape the API accepts.
+- A definitively failed OAuth refresh can no longer loop forever instead of disabling the credential. The refresh-failure path disables the row with a CAS conditioned on its serialized `data`, and treated a lost CAS as proof that a peer had rotated the token: it reloaded the store and re-resolved, without bound. That predicate also misses when nothing was rotated — an account switcher that replaces the provider's rows leaves the attempted id gone, and an unrelated identity-metadata write leaves the row byte-different — so a revoked credential was never disabled and every subsequent request re-issued the same `invalid_grant` refresh (observed in the wild as ~3k `OAuth token refresh failed` / `disable lost CAS` log pairs in 3.5 hours, one wasted refresh round-trip per request). When the row still holds the refresh token that just failed, it is now disabled by id (no peer rotation exists to clobber); otherwise the reload-and-retry recovery is capped, so resolution terminates instead of recursing until the runtime dies.
 
 ## [0.12.0] - 2026-07-28
 

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.12.1",
+	"version": "0.12.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.12.1",
+		"@gajae-code/utils": "0.12.2",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-storage.ts

@@ -572,6 +572,16 @@ const OAUTH_REFRESH_SKEW_MS = 60_000;
  * pathological detach-without-reattach loops can't grow memory unboundedly.
  */
 const MAX_PENDING_DISABLED_EVENTS = 32;
+/**
+ * Cap on how many times an OAuth resolution may reload the credential store and
+ * re-resolve after a failed refresh. Each retry exists to recover from a peer
+ * process rotating (or replacing) the row under us, which is a bounded event:
+ * the peer either published a usable credential we pick up on the next pass, or
+ * it did not. Without a cap, a credential whose disable can never be applied
+ * (row replaced by an account switcher, CAS predicate that can never match)
+ * makes the recovery path re-issue the same failing token refresh forever.
+ */
+const MAX_OAUTH_RESOLUTION_RELOADS = 3;
 
 type UsageCacheEntry<T> = {
 	value: T;
@@ -1426,6 +1436,34 @@ export class AuthStorage {
 		return true;
 	}
 
+	/**
+	 * Whether the persisted row `credentialId` is still an OAuth credential holding
+	 * `refreshToken`. Used by the refresh-failure path to tell "a peer rotated this
+	 * row" (retry is worthwhile) apart from "the row is unchanged but the CAS
+	 * predicate cannot match it" (retry replays the same failing refresh).
+	 */
+	#credentialRowHoldsRefreshToken(provider: string, credentialId: number, refreshToken: string): boolean {
+		const row = this.#store.listAuthCredentials(provider).find(entry => entry.id === credentialId);
+		const credential = row?.credential;
+		return credential?.type === "oauth" && credential.refresh === refreshToken;
+	}
+
+	/**
+	 * Soft-deletes a row by id, bypassing the data-equality CAS. Only safe when the
+	 * caller has confirmed the row still holds the credential it attempted to
+	 * refresh, so no peer rotation can be clobbered.
+	 */
+	#disableCredentialById(provider: string, credentialId: number, disabledCause: string): void {
+		this.#store.deleteAuthCredential(credentialId, disabledCause);
+		const entries = this.#getStoredCredentials(provider);
+		this.#setStoredCredentials(
+			provider,
+			entries.filter(entry => entry.id !== credentialId),
+		);
+		this.#resetProviderAssignments(provider);
+		this.#emitCredentialDisabled({ provider, disabledCause });
+	}
+
 	#emitCredentialDisabled(event: CredentialDisabledEvent): void {
 		if (this.#credentialDisabledListeners.size === 0) {
 			// No subscribers — buffer for later replay. Cap the backlog so a process that runs
@@ -2989,7 +3027,15 @@ export class AuthStorage {
 		provider: string,
 		sessionId?: string,
 		options?: AuthApiKeyOptions,
+		reloadsUsed = 0,
 	): Promise<OAuthResolutionResult | undefined> {
+		if (reloadsUsed > MAX_OAUTH_RESOLUTION_RELOADS) {
+			logger.warn("OAuth credential resolution exhausted its reload budget", {
+				provider,
+				reloadsUsed,
+			});
+			return undefined;
+		}
 		const selectedCredential = this.#resolveSelectedStoredCredential(provider, options);
 		const selectedOAuthCredential =
 			selectedCredential?.credential.type === "oauth"
@@ -3087,18 +3133,27 @@ export class AuthStorage {
 					usagePrechecked: candidate.usageChecked,
 					enforceProRequirement,
 				},
+				reloadsUsed,
 			);
 			if (resolved) return resolved;
 		}
 
 		if (fallback && this.#isCredentialBlocked(providerKey, fallback.selection.index)) {
-			return this.#tryOAuthCredential(provider, fallback.selection, providerKey, sessionId, options, {
-				checkUsage,
-				allowBlocked: true,
-				prefetchedUsage: fallback.usage,
-				usagePrechecked: fallback.usageChecked,
-				enforceProRequirement,
-			});
+			return this.#tryOAuthCredential(
+				provider,
+				fallback.selection,
+				providerKey,
+				sessionId,
+				options,
+				{
+					checkUsage,
+					allowBlocked: true,
+					prefetchedUsage: fallback.usage,
+					usagePrechecked: fallback.usageChecked,
+					enforceProRequirement,
+				},
+				reloadsUsed,
+			);
 		}
 
 		return undefined;
@@ -3219,6 +3274,7 @@ export class AuthStorage {
 			usagePrechecked?: boolean;
 			enforceProRequirement?: boolean;
 		},
+		reloadsUsed = 0,
 	): Promise<OAuthResolutionResult | undefined> {
 		const {
 			checkUsage,
@@ -3357,7 +3413,7 @@ export class AuthStorage {
 						credentialId: attemptedCredentialId,
 					});
 					await this.reload();
-					return this.#resolveOAuthSelection(provider, sessionId, options);
+					return this.#resolveOAuthSelection(provider, sessionId, options, reloadsUsed + 1);
 				}
 			}
 			// Only remove credentials for definitive auth failures
@@ -3387,18 +3443,39 @@ export class AuthStorage {
 					`oauth refresh failed: ${errorMsg}`,
 				);
 				if (!disabled) {
-					logger.debug("OAuth refresh disable lost CAS; reloading after peer rotation", {
-						provider,
-						index: selection.index,
-					});
-					await this.reload();
-					return this.#resolveOAuthSelection(provider, sessionId, options);
+					// The CAS predicate compares the row's serialized `data`, so it also
+					// misses when nothing was rotated: the row may have been replaced by
+					// a peer (account switcher rewriting the provider's credentials, so
+					// our snapshot's id no longer exists) or updated with unrelated
+					// identity metadata. Reload-and-retry only makes progress in the
+					// rotation case; otherwise the same revoked token is re-refreshed on
+					// every request forever. When the row is still present with the very
+					// refresh token we just tried, disabling by id is safe — there is no
+					// peer rotation to clobber — so apply it directly instead of looping.
+					const stillHoldsAttemptedToken =
+						attemptedCredentialId !== undefined &&
+						this.#credentialRowHoldsRefreshToken(provider, attemptedCredentialId, selection.credential.refresh);
+					if (stillHoldsAttemptedToken && attemptedCredentialId !== undefined) {
+						logger.warn("OAuth refresh disable CAS mismatched an unrotated row; disabling by id", {
+							provider,
+							index: selection.index,
+							credentialId: attemptedCredentialId,
+						});
+						this.#disableCredentialById(provider, attemptedCredentialId, `oauth refresh failed: ${errorMsg}`);
+					} else {
+						logger.debug("OAuth refresh disable lost CAS; reloading after peer rotation", {
+							provider,
+							index: selection.index,
+						});
+						await this.reload();
+						return this.#resolveOAuthSelection(provider, sessionId, options, reloadsUsed + 1);
+					}
 				}
 				if (
 					!this.#getCredentialSelector(provider, options) &&
 					this.#getCredentialsForProvider(provider).some(credential => credential.type === "oauth")
 				) {
-					return this.#resolveOAuthSelection(provider, sessionId, options);
+					return this.#resolveOAuthSelection(provider, sessionId, options, reloadsUsed);
 				}
 			} else {
 				// Block temporarily for transient failures (5 minutes)