SMOODEV-2717: retry transient 429/5xx in bootstrap token exchange

[brentrager]

Problem

On 2026-07-23 four monorepo Docker image builds died with OAuth token exchange failed: HTTP 429 ReservedFunctionConcurrentInvocationLimitExceeded during pnpm build — the auth issuer runs under a reserved-concurrency cap after the 2026-07-21 self-recursion incident, and parallel builds' single-shot token exchanges throttled each other to death, leaving prod web ~20h stale.

Solution

mintAccessToken in the zero-dep bootstrap path now retries transient 429/5xx with exponential backoff + jitter (5 attempts, ~0.4→6.4s). Permanent 4xx (e.g. 401 invalid_client) still fail fast on the first attempt. Node built-ins only — bootstrap stays dependency-free.

Verification

• New tests: retries a transient 429 then succeeds, does not retry a permanent 401 — plus the full existing bootstrap suite (27/27).
• Changeset included (patch).

Jira: SMOODEV-2717

🤖 Generated with Claude Code

https://claude.ai/code/session_01GD91XYuyT6AFTpj5N6fYL9

[changeset-bot]

🦋 Changeset detected

Latest commit: 56c429d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@smooai/config	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR