ldrouter 1.17.4 → 1.17.5

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.17.5] - 2026-09-19
+
+### Fixed
+
+- **An account whose session was revoked kept being selected instead of leaving the Codex pool.** Auth0 answers `refresh_token_invalidated` ("Your session has ended. Please log in again.") for an account whose login was revoked; the account cannot serve anything again until it is re-imported. The credential layer surfaced that as a bare `oauth_refresh_failed`, which the router classified `unknown` — and `unknown` is not a routing decision, so `shouldFallback` answered false, the retry never advanced to a sibling account, and the request answered `502`. Live production data confirmed the shape: two accounts holding invalidated refresh tokens sat at the head of the pool, so every request landed on one of them, and 226 of 241 failed requests carried `attempts_count=1` while healthy accounts sat idle behind them. Credential failure is now its own failure class, checked before the error-type switch, and it always advances to the next candidate — with or without a combo plan, since a direct `codex1/...` model has no fallback triggers to consult.
+- **The account with the dead credential is now disabled, not merely degraded.** Marking down *and* disabling (`enabled=0`) is what actually stops the churn, mirroring quota exhaustion: every selection path — `expandCodexAccountCandidates`, `getCodexAccountForProvider` — filters on `enabled`. Deliberately kept out of `isUpstreamHealthFailure`, because one re-imported account must not open the provider circuit breaker for its healthy siblings.
+- **`codexCredentialError` discarded the raw error code.** Its wrapping message is deliberately generic, so without the cause the routing layer could not distinguish a dead account from any other `authentication_error`. The raw error is now carried as `cause`.
+
 ## [1.17.4] - 2026-09-18
 
 ### Fixed

package/dist/server/gateway/runner.js

@@ -296,6 +296,7 @@ export class GatewayRunner {
                 catch (e) {
                     const err = e instanceof GatewayError ? e : new GatewayError('upstream_error', e.message, { cause: e });
                     const quotaFailure = isQuotaFailure(err);
+                    const credentialFailure = isCredentialFailure(err);
                     debugUpstream(ctx.requestId, 'ATTEMPT ERROR', [
                         `attempt=${i + 1}`,
                         `provider=${provider.name}`,
@@ -329,6 +330,11 @@ export class GatewayRunner {
                     // dead account on every request for hours (verified live) and answered "usage limited".
                     if (quotaFailure)
                         markQuotaExhausted(candidate, err.message);
+                    // A dead refresh token also leaves the pool outright: the account cannot serve anything
+                    // again until it is re-imported, so a retry may only be spent on a sibling account. Without
+                    // this the retry landed on the same dead account and the request answered 502.
+                    if (credentialFailure)
+                        markCredentialsDead(candidate, err.message);
                     if (isUpstreamHealthFailure(err)) {
                         recordFailure(provider.id, provider.cbFailureThreshold, provider.cbCooldownSeconds);
                         if (candidate.codexAccountId)
@@ -1032,6 +1038,39 @@ export function markQuotaExhausted(candidate, message) {
     if (candidate.qoderAccountId)
         setQoderAccountHealth(candidate.qoderAccountId, 'down', reason, false);
 }
+/**
+ * A credential failure is a durable, per-account verdict — the same class as quota exhaustion.
+ *
+ * `withCodexCredentials` throws these as bare codes when the account's refresh token is dead
+ * (Auth0 answers `refresh_token_invalidated`, "Your session has ended. Please log in again.").
+ * The account cannot serve anything again until it is re-imported, so retrying it is pure waste
+ * and leaving it in the pool answers 502 to every client.
+ *
+ * Live evidence (production, 2026-09-19): two accounts holding invalidated refresh tokens sat at
+ * the head of the pool, so every request landed on one of them — `oauth_refresh_failed`,
+ * classified `unknown`, `attempts_count=1`, 502 straight to the client (226 of 241 failed
+ * requests had exactly one attempt while healthy accounts sat idle behind them).
+ *
+ * Deliberately NOT part of `isUpstreamHealthFailure`: one re-imported account must not open the
+ * provider circuit breaker for its healthy siblings. The verdict is applied per account by
+ * `markCredentialsDead` instead.
+ *
+ * Both spellings are checked because the code travels either raw (from `withCodexCredentials`
+ * inside the gateway) or wrapped by `codexCredentialError`, which now keeps it as `cause`.
+ */
+export function isCredentialFailure(err) {
+    const codes = /^(oauth_refresh_failed|invalid_refresh_response|credential_unavailable|account_not_found)$/;
+    const cause = err.cause;
+    return codes.test(err.message) || (typeof cause?.message === 'string' && codes.test(cause.message));
+}
+/** Takes an account with a dead refresh token out of the pool. `enabled=0` is what stops the churn. */
+export function markCredentialsDead(candidate, message) {
+    const reason = redactString(message);
+    if (candidate.codexAccountId)
+        setCodexAccountHealth(candidate.codexAccountId, 'down', reason, false);
+    if (candidate.qoderAccountId)
+        setQoderAccountHealth(candidate.qoderAccountId, 'down', reason, false);
+}
 /**
  * Whether a failed attempt should advance to the next candidate.
  *
@@ -1043,11 +1082,17 @@ export function markQuotaExhausted(candidate, message) {
  * plan means no fallback.
  */
 export function shouldRetryAttempt(comboPlan, err) {
+    if (isCredentialFailure(err))
+        return true;
     if (isQuotaFailure(err))
         return true;
     return comboPlan ? shouldFallback(comboPlan, { type: classifyFailure(err), status: err.status }) : false;
 }
 export function classifyFailure(err) {
+    // Checked before the type switch for the same reason as quota: a dead account is not a routing
+    // decision the combo's triggers were meant to gate, and `unknown` is not a routing decision at all.
+    if (isCredentialFailure(err))
+        return 'credential';
     // Checked first, before the type switch: a quota refusal arrives as `upstream_rate_limit` (a
     // 429) or `upstream_error` (Codex rewraps it as a 502 with a 429 cause; Qoder uses code 112) and
     // must not fall through to `http_status`/`unknown`, neither of which is a routing decision.

package/dist/server/providers/codex-refresh.js

@@ -11,7 +11,9 @@ export function codexCredentialError(error) {
     if (code === 'account_not_found')
         return new GatewayError('invalid_request_error', 'Codex account not found', { status: 404 });
     if (code === 'oauth_refresh_failed' || code === 'invalid_refresh_response' || code === 'credential_unavailable') {
-        return new GatewayError('authentication_error', 'Codex credentials could not be refreshed — re-import the account', { status: 401 });
+        // `cause` carries the raw credential code: the wrapping message is deliberately generic, so
+        // without it the routing layer cannot tell a dead account from any other authentication_error.
+        return new GatewayError('authentication_error', 'Codex credentials could not be refreshed — re-import the account', { status: 401, cause: error });
     }
     return error;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldrouter",
-  "version": "1.17.4",
+  "version": "1.17.5",
   "description": "LateDev Router — lightweight self-hosted LLM gateway with admin UI",
   "type": "module",
   "license": "MIT",