Repository navigation
[Bug]: SDK concurrent 401 responses race single-use refresh tokens #1132
Description
由 LW 授权的 ChatGPT Personal 智能体提交。
Existing issue check
- Searched SDK/refresh/concurrent issues and PRs; no matching SDK fix found. CLI refresh work is a separate implementation.
Version and environment
main 54e49ec3e1753d0661ba48ccda35225eb85d41b1, Node 24.22.1, SDK Vitest tests using synthetic fetch responses; no production credentials or requests.
Actual behavior
Concurrent REST and buffered run-event requests each refresh the same token after 401. The server compare-and-revokes a refresh token, so only one succeeds and another request fails unnecessarily. A delayed 401 also refreshes an already rotated token again. An outstanding refresh can overwrite credentials after setTokens, successful login/registration, or logout, and replay the old request.
Expected behavior
Coordinate refresh per AstraClient instance, reuse successful rotation for delayed 401s, release failed attempts for later recovery, and reject stale refresh completions after explicit authentication changes.
Reproduction and evidence
Eight deterministic public-entrypoint regression cases fail on the original client and pass with the candidate fix: mixed REST/SSE, delayed 401, HTTP/network refresh failure and later recovery, plus four credential-change cases. Focused command: cd packages/sdk && npm test -- src/__tests__/token-refresh-concurrency.test.ts. Full ASTRA_SDK_E2E=1 npm run ci: 465 passed, 1 skipped (unconfigured remote-service placeholder); typecheck, coverage gates and bundle/declaration build passed. These are client tests with mock fetch and a local HTTP harness, not live database/provider validation.
Scope / operation record
Read-only verification and this issue are performed by the attributed agent. Candidate changes are confined to three SDK files; independent review and Web consumer gates are pending. Authenticated own fork MatrixAdventurer/Astra and upstream relationship/push permission verified. Upstream has no dev; user-authorized main target applies. No merge, deployment or issue closure requested.
Activity
MatrixAdventurer commentedon Oct 25, 2026
由 LW 授权的 ChatGPT Personal 智能体提交。
修复固定提交
cebc33e24fdb6f0bba29d696940ee6f15d4e4c08，tree2d37417af5781583d0d2118fb46c8449d4d20c37；3 files +172/-11（含129行回归）。独立 review agent 明确 Approve，独立运行 focused+existing client 测试92 passed，client.ts SHA256490ac9505b707b308e9d9fae106c94d966380da1f0f6954b48a28925331ca3f5。本地完整 SDK gate：465 passed/1 unconfigured remote placeholder skipped，typecheck/coverage/build通过。Web typecheck与817 tests通过，生产build被本地
uv_resident_set_memory环境错误阻塞，未宣称完整Web CI通过。操作记录：本人fork MatrixAdventurer/Astra（parent matrixorigin/Astra、push/admin已核实），拟创建独立
fix/sdk-concurrent-token-refresh产品分支及validate/sdk-refresh-1132验证分支，均不写默认分支。验证分支只承载独立workflow，checkout固定上述产品SHA执行仓库原SDK/Web gate；workflow正独立review。上游PR仍未创建，待完整门禁通过。Issue指派读回为 XuPeng-SH。MatrixAdventurer commentedon Oct 25, 2026
由 LW 授权的 ChatGPT Personal 智能体提交。
验证 workflow 独立审查结果 Approve；验证分支已创建并以无源代码变化的 signed commit 触发 push，最新验证提交
d2d6881043c82b03a6873c1df1457df280ffc6e4。workflow 始终 checkout 产品固定提交cebc33e24fdb6f0bba29d696940ee6f15d4e4c08，未修改产品3文件范围。使用仓库 Node 锁定版本，无secrets，仅contents:read，无发布/部署。后续只按实际运行结果记录SDK/Web门禁，不视为上游完整CI。MatrixAdventurer commentedon Oct 25, 2026
由 LW 授权的 ChatGPT Personal 智能体提交。
本轮续接记录：产品提交已读回保存于本人fork分支 fix/sdk-concurrent-token-refresh，固定SHA
cebc33e24fdb6f0bba29d696940ee6f15d4e4c08，本地等价tree提交089661da91fb98ab20a9c04ca4cf0b5d732d2f6c。3文件+172/-11，工作树干净。独立代码与验证workflow均明确Approve。实际测试：8项原始失败→修复通过；SDK原gate
ASTRA_SDK_E2E=1 npm run ci465passed/1未配置远端placeholder skipped，类型/覆盖率/构建通过；Webnpm run ci类型与817 tests通过，但next build失败ENOENT uv_resident_set_memory；关闭telemetry后正常build重试仍同一环境失败。未跳过/伪造生产构建。远端验证分支
validate/sdk-refresh-1132headd2d6881043c82b03a6873c1df1457df280ffc6e4已读回确认。该分支创建及随后fast-forward后，Actions branch过滤读取仍返回0运行，最新全仓run列表也未出现本轮运行；不能称作排队、执行或通过。当前连接器没有workflow dispatch能力，未绕过权限或改默认分支。故完整Web build门禁仍未完成，尚未创建上游修复PR、尚未请求PR审阅；Issue已指派XuPeng-SH。下一轮优先接续该固定补丁的可审计构建验证，成功后再提交main PR。无自动合并/部署/关闭Issue。MatrixAdventurer commentedon Oct 25, 2026
由 LW 授权的 ChatGPT Personal 智能体提交。
新增续接：用户再次明确无dev时提交main；已遵循。本人fork已打开纯验证PR MatrixAdventurer#3 ，base为本人非默认产品分支
fix/sdk-concurrent-token-refresh，head为本人validate/sdk-refresh-1132，仅1个workflow文件(+27)，不合并、不部署。该pull_request触发新增也经独立review明确Approve。执行源仍固定产品SHAcebc33e24fdb6f0bba29d696940ee6f15d4e4c08，原产品3文件范围不变。PR创建已读回确认；后续Actions branch run列表仍是total_count=0，不能称为在跑或通过。workflow列表读取被连接器明确拒绝(INVALID_ARGUMENT)，连接器无dispatch/enable接口。无法从现有证据断言是workflow禁用还是事件未触发。本地/proc目录不存在，连原生
node -e 'console.log(process.memoryUsage())'都报同一 uv_resident_set_memory，确认本地build障碍非本补丁行为。尚缺可审计完整Web生产构建通过证据，因此继续保留上游修复PR未提交状态，不以验证PR冒充交付。Issue负责人仍XuPeng-SH，已保存全部测试与Approve证据；不重复生产修改或新建重复Issue。
MatrixAdventurer commentedon Oct 25, 2026
由 LW 授权的 ChatGPT Personal 智能体提交。
环境修复后已完成 Web 原 npm run ci，exit0：typecheck、817 tests、production build/page generation全部通过。精确环境处理及独立Approve披露于PR正文：只对ignored本地Next依赖内存诊断中ENOENT/uv_resident_set_memory警告并返回，其他错误抛出，不伪造指标、不跳过编译测试。产品源SHA未变。
已提交上游修复PR #1133 ，main目标，ownfork head cebc33e，3files+172/-11。已执行XuPeng-SH指派及请求审阅，随后读回确认。上游CI待实际结果，不以本地兼容环境通过冒充上游CI。验证PR#3保留未合并；无合并部署或Issue关闭。
MatrixAdventurer commentedon Oct 28, 2026
已核实修复 PR #1133 已合并到上游，Issue 描述的核心缺陷已由该 PR 覆盖。根据 LW 本次“已解决的关掉”的授权，将本 Issue 标记为 completed；如后续复现回归，请携带新版本与复现日志重新打开。
由LW授权的ChatGPT Business智能体提交（合并后 Issue 清理；本操作未合并或部署代码）。