clawmoney 0.15.61 → 0.15.63

package/dist/relay/provider.js

@@ -94,6 +94,11 @@ function loadRelayConfig(cliOverride) {
     const userRelay = (raw.relay ?? {});
     const relay = {
         cli_type: cliOverride ?? userRelay.cli_type ?? DEFAULT_RELAY.cli_type,
+        // Pass rate_guard through verbatim. Per-field merging happens
+        // inside each upstream module's configureRateGuard() which
+        // already knows its own defaults — we don't want to double-
+        // default here.
+        rate_guard: userRelay.rate_guard,
         model: userRelay.model ?? DEFAULT_RELAY.model,
         mode: userRelay.mode ?? DEFAULT_RELAY.mode,
         concurrency: userRelay.concurrency ?? DEFAULT_RELAY.concurrency,

package/dist/relay/upstream/claude-api.js

@@ -519,6 +519,38 @@ async function refreshUpstreamToken(refreshToken) {
 let cachedCreds = null;
 let refreshInflight = null;
 const REFRESH_SKEW_MS = 3 * 60 * 1000;
+// ── Auth-broken circuit breaker ─────────────────────────────────────────
+//
+// If Anthropic's OAuth refresh endpoint rejects our refresh_token as
+// invalid (400 invalid_grant, 401, 403 "Request not allowed", etc.),
+// that's a persistent condition — the token is not going to start
+// working again on its own. Every subsequent buyer request would burn
+// another refresh attempt on Anthropic, which looks like brute-forcing
+// from their anti-abuse side and risks getting the provider's account
+// flagged.
+//
+// Cache the "broken" state for AUTH_BROKEN_CACHE_MS. During that window
+// ALL calls to getFreshCreds() short-circuit with the cached error
+// WITHOUT hitting Anthropic. After the window expires we allow exactly
+// one probe refresh — if it succeeds, we're unbroken; if it fails
+// again, the window is extended by another interval.
+//
+// Transient 5xx responses are NOT cached — those are "maybe the server
+// is having a moment" and worth retrying. Only 4xx "no, really, the
+// token is bad" responses trip the breaker.
+const AUTH_BROKEN_CACHE_MS = 5 * 60 * 1000;
+let authBrokenUntilMs = 0;
+let authBrokenError = null;
+function isAuthBrokenError(err) {
+    const msg = err.message.toLowerCase();
+    // Matches messages produced by refreshUpstreamToken:
+    //   "Token refresh failed: 400 ...invalid_grant..."
+    //   "Token refresh failed: 401 ..."
+    //   "Token refresh failed: 403 ...Request not allowed..."
+    return (msg.includes("invalid_grant") ||
+        msg.includes("request not allowed") ||
+        /token refresh failed:\s*40[0134]/.test(msg));
+}
 async function doRefreshAndPersist(current) {
     logger.info("[claude-api] refreshing OAuth token...");
     const fresh = await refreshUpstreamToken(current.refreshToken);
@@ -569,6 +601,14 @@ async function doRefreshAndPersist(current) {
     return next;
 }
 async function getFreshCreds() {
+    // Circuit breaker: if the OAuth endpoint is known-broken for this
+    // daemon, throw the cached error immediately without touching
+    // Anthropic again. This is what keeps a retry storm from burning
+    // one refresh attempt per buyer request and getting the account
+    // flagged.
+    if (authBrokenUntilMs && Date.now() < authBrokenUntilMs && authBrokenError) {
+        throw authBrokenError;
+    }
     if (!cachedCreds) {
         cachedCreds = loadClaudeOAuth();
     }
@@ -582,7 +622,24 @@ async function getFreshCreds() {
             refreshInflight = null;
         });
     }
-    cachedCreds = await refreshInflight;
+    try {
+        cachedCreds = await refreshInflight;
+    }
+    catch (err) {
+        const e = err;
+        if (isAuthBrokenError(e)) {
+            authBrokenUntilMs = Date.now() + AUTH_BROKEN_CACHE_MS;
+            authBrokenError = e;
+            logger.error(`[claude-api] OAuth refresh rejected by Anthropic — caching auth-broken state for ${AUTH_BROKEN_CACHE_MS / 1000}s. Subsequent requests will fail fast without hitting the OAuth endpoint. Fix: re-login with 'claude /login' and restart the daemon. Root cause: ${e.message.slice(0, 200)}`);
+        }
+        throw err;
+    }
+    // Successful refresh — clear any cached broken state.
+    if (authBrokenUntilMs) {
+        authBrokenUntilMs = 0;
+        authBrokenError = null;
+        logger.info("[claude-api] OAuth refresh recovered — auth-broken cache cleared");
+    }
     return cachedCreds;
 }
 // ── Version drift check ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawmoney",
-  "version": "0.15.61",
+  "version": "0.15.63",
   "description": "ClawMoney CLI -- Earn rewards with your AI agent",
   "type": "module",
   "bin": {