fix(providers): refresh inference OAuth tokens by Aaronontheweb · Pull Request #1465 · netclaw-dev/netclaw

Aaronontheweb · 2026-06-23T21:29:42Z

Summary

refresh OpenAI/Codex OAuth credentials before runtime requests
refresh GitHub OAuth credentials before Copilot token exchange and configured-provider probes
keep pending add/fix validation no-clobber while allowing configured providers to persist refreshed credentials

Fixes #1463

Validation

dotnet test "src/Netclaw.Daemon.Tests/Netclaw.Daemon.Tests.csproj" --filter "CopilotTokenExchangerTests|CopilotRequestPolicyTests|GitHubCopilotProviderPluginTests|GitHubCopilotDescriptorTests|OpenAiCodexRequestPolicyTests|ProviderPluginFactoryTests"
dotnet test "src/Netclaw.Cli.Tests/Netclaw.Cli.Tests.csproj" --filter "ProviderManagerViewModelTests"
dotnet test "src/Netclaw.Configuration.Tests/Netclaw.Configuration.Tests.csproj" --filter "ProviderOAuthRefreshingProbeTests|ProviderOAuthTokenRefreshServiceTests"
pwsh ./scripts/Add-FileHeaders.ps1 -Verify
git diff --check
dotnet slopwatch analyze (reports pre-existing timing-test warnings outside this change)

Aaronontheweb

Self-review notes on the main OAuth refresh design choices and boundary decisions.

Aaronontheweb · 2026-06-23T21:46:15Z

+/// Implementations may use <paramref name="providerName"/> to update persisted
+/// runtime metadata, such as refreshed OAuth credentials.
+/// </summary>
+public interface IConfiguredProviderProbe


Self-review: IConfiguredProviderProbe is intentionally separate from the generic probe API. Refresh persistence needs the config key (providerName), and temporary add/fix probes do not have a committed key yet, so they should not be able to write refreshed credentials.

Aaronontheweb · 2026-06-23T21:46:15Z

+        if (!NeedsRefresh(entry.OAuthTokenExpiry))
+            return accessToken;
+
+        var refreshGate = _refreshLocks.GetOrAdd(providerName, _ => new SemaphoreSlim(1, 1));


Self-review: This per-provider semaphore avoids a refresh stampede when several chat or probe calls find the same expired OAuth credential. The second expiry check inside the lock lets callers that waited on another refresh return the newly valid token without making a duplicate token request.

Aaronontheweb · 2026-06-23T21:46:15Z

+            }
+
+            ApplyRefreshResult(entry, result);
+            OAuthTokenPersistence.PersistTokens(paths, providerName, result);


Self-review: Persistence is centralized here instead of spread across provider-specific code. That keeps OpenAI, Copilot, and configured-provider probes writing the same config/secrets representation, and prevents a successful in-memory refresh from being lost after restart.

Aaronontheweb · 2026-06-23T21:46:15Z

+                $"Unknown provider type: {entry.Type}", []);
+        }
+
+        if (entry.AuthMethod is AuthMethod.OAuthDevice or AuthMethod.OAuthPkce


Self-review: Only persisted OAuth entries with a known expiry enter the refresh path. The plain IProviderProbe overloads still delegate unchanged so provider add/fix validation remains no-clobber until validation succeeds.

Aaronontheweb · 2026-06-23T21:46:16Z

+        ProviderDisplayItem item,
+        CancellationToken ct)
+    {
+        if (item is { Entry: not null, ConfiguredName: not null }


Self-review: This is the TUI boundary between existing configured providers and transient add/fix entries. Existing providers supply ConfiguredName and can refresh/persist; pending entries fall back to the plain probe so a failed validation cannot overwrite stored credentials.

Aaronontheweb · 2026-06-23T21:46:16Z

+        if (tokenRefreshService is null)
+            return await GetTokenAsync(entry, ct);
+
+        var oauthToken = await tokenRefreshService.GetValidAccessTokenAsync(


Self-review: Copilot has two token layers. This refreshes the persisted GitHub OAuth token before exchanging it for the short-lived Copilot API token; otherwise /copilot_internal/v2/token receives an expired GitHub bearer and runtime chat fails even though a refresh token is available.

Aaronontheweb · 2026-06-23T21:46:16Z

        PipelineMessage message, IReadOnlyList<PipelinePolicy> pipeline, int currentIndex)
    {
-        var token = await exchanger.GetTokenAsync(entry, message.CancellationToken);
+        var token = providerName is not null && oauth is not null


Self-review: Passing providerName and descriptor OAuth config through the request policy is what lets the daemon chat path use the refresh-aware exchanger. The fallback keeps descriptor/probe paths working when they only have a raw entry and must not persist.

Aaronontheweb · 2026-06-23T21:46:16Z

                Endpoint = new Uri("https://chatgpt.com/backend-api/codex")
            };
-            options.AddPolicy(new OpenAiCodexRequestPolicy(accountId), PipelinePosition.PerCall);
+            var credential = new ApiKeyCredential(token.Value);


Self-review: The credential object is shared with OpenAiCodexRequestPolicy so the policy can update it before the SDK auth policy runs. We only require the existing account id immediately when refresh is unavailable; with refresh enabled, the policy can recover it from refreshed OpenAI token metadata.

Aaronontheweb · 2026-06-23T21:46:16Z

-        Modify(message);
+        if (_tokenRefreshService is not null)
+        {
+            var token = await _tokenRefreshService.GetValidAccessTokenAsync(


Self-review: Refresh is async because it may issue an OAuth network call. The sync Process path fails loudly instead of using a stale token; in the async path we update the SDK credential before calling the next policy so authorization uses the refreshed token.

Aaronontheweb · 2026-06-23T21:46:16Z

+    /// Call after <see cref="ProviderDescriptorServiceExtensions.AddProviderDescriptors"/>
+    /// when the host needs OAuth provider flows or configured-provider refresh.
+    /// </summary>
+    public static IServiceCollection AddProviderOAuthServices(this IServiceCollection services)


Self-review: Centralizing this registration keeps the daemon, init wizard, provider TUI, and config editor on the same OAuth stack. This avoids hosts drifting into slightly different device-flow or refresh-probe wiring.

Aaronontheweb

Generally looks good, had one question that I need to answer...

Aaronontheweb · 2026-06-23T22:00:40Z

+        CancellationToken ct = default)
+    {
+        if (tokenRefreshService is null)
+            return await GetTokenAsync(entry, ct);


get the initial token

Aaronontheweb · 2026-06-23T22:00:55Z

+        if (tokenRefreshService is null)
+            return await GetTokenAsync(entry, ct);
+
+        var oauthToken = await tokenRefreshService.GetValidAccessTokenAsync(


get the refresh token

Aaronontheweb · 2026-06-23T22:02:16Z

+
+        // Coalesce concurrent refreshes for the same configured provider so a
+        // burst of requests does not spend the same refresh token multiple times.
+        var refreshGate = _refreshLocks.GetOrAdd(providerName, _ => new SemaphoreSlim(1, 1));


not sure how necessary this really is but we'll see in practice

Aaronontheweb · 2026-06-23T22:04:30Z

+            new OAuthDeviceFlowService(
+                sp.GetRequiredService<IHttpClientFactory>().CreateClient("OAuthDeviceFlow"),
+                sp.GetService<TimeProvider>()));
+        services.AddSingleton(sp =>


why are we adding this every time?

NM, only used when OpenAI oauth is actually needed.

Aaronontheweb added 3 commits June 22, 2026 19:22

test(skills): block system and external skill mutations

9d89936

fix(providers): refresh OpenAI OAuth tokens at runtime

49fbb72

fix(providers): refresh OAuth tokens during Copilot probes

d9aac3b

Aaronontheweb added bug Something isn't working reliability Retries, resilience, graceful degradation providers Provider integrations and capability detection across OpenAI-compatible backends. labels Jun 23, 2026

Merge branch 'dev' into issue-inference-oauth-refresh

85f614f

Aaronontheweb commented Jun 23, 2026

View reviewed changes

docs(providers): explain OAuth refresh boundaries

4d90034

Aaronontheweb commented Jun 23, 2026

View reviewed changes

Aaronontheweb enabled auto-merge (squash) June 23, 2026 22:06

Merge branch 'dev' into issue-inference-oauth-refresh

5e296b1

Aaronontheweb merged commit 73540a7 into netclaw-dev:dev Jun 23, 2026
15 checks passed

This was referenced Jun 24, 2026

Release: v0.24.2-beta.1 #1482

Merged

chore: update RELEASE_NOTES.md with 0.24.2-beta.1 entries #1484

Merged

release: Netclaw 0.24.2 #1497

Merged

Uh oh!

Conversation

Aaronontheweb commented Jun 23, 2026

Summary

Validation

Uh oh!

Aaronontheweb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Aaronontheweb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant