fix(chat-provider): preserve refreshed OAuth token on connection recovery

[ayokaa]

Fixes #1971

Root Cause

When OAuth refreshes the access token, _apply_access_token() updates client.api_key but not self._api_key. If a transient network error triggers on_retryable_error() to rebuild the OpenAI client, it uses the stale self._api_key — a token that the server has already invalidated upon issuing the new one — causing 401 errors.

T+0:00    Login → token-A → self._api_key = "token-A", client.api_key = "token-A"
T+7:30    OAuth refresh → token-B, token-A invalidated by server
          → client.api_key = "token-B" ✅
          → self._api_key = "token-A" ❌ (never updated)
T+7:31    Network error → on_retryable_error() rebuilds client with self._api_key
          → New client uses token-A (already invalidated) → 401

Fix

Read api_key from the current live client instead of the cached self._api_key in on_retryable_error():

def on_retryable_error(self, error: BaseException) -> bool:
    old_client = self.client
    current_api_key = old_client.api_key  # read from live client
    self.client = create_openai_client(
        api_key=current_api_key,           # use latest token
        base_url=self._base_url,
        client_kwargs=self._client_kwargs,
    )
    self._api_key = current_api_key        # keep cache in sync
    close_replaced_openai_client(old_client, client_kwargs=self._client_kwargs)
    return True

Why TUN mode triggers this

TUN mode causes occasional network route changes that interrupt established HTTP connections, triggering APIConnectionError → on_retryable_error(). Without TUN mode, connections are stable and on_retryable_error() is never called, so the bug remains latent. After this fix, TUN mode usage no longer produces 401 errors.

Testing

• 4 new tests in test_kimi_stale_api_key.py:
  • Token preservation after refresh + retry
  • Correct token at construction
  • Idempotent across multiple refresh/retry cycles
  • End-to-end: captures actual HTTP Authorization header via respx mock, confirms rebuilt client sends the refreshed token
• 2793 existing tests pass, no regression

Checklist

• I have read the CONTRIBUTING document.
• I have linked the related issue (401 Authentication Error when TUN Mode Enabled #1971).
• I have added tests that prove my fix is effective.
• I have run make gen-changelog to update the changelog.
• I have run make gen-docs to update the user documentation.

---

[Copilot]

Pull request overview

Fixes a connection-recovery authentication bug in the Kosong Kimi chat provider where OAuth token refresh updates the live OpenAI client’s api_key, but a retry-triggered client rebuild previously reused a stale cached key, leading to intermittent 401s (notably in TUN mode).

Changes:

• Update Kimi.on_retryable_error() to rebuild the client using old_client.api_key and sync self._api_key.
• Add regression tests covering refresh+retry cycles and an end-to-end Authorization header assertion via respx.
• Add changelog entries (root + package + docs).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/kosong/src/kosong/chat_provider/kimi.py	Rebuilds the OpenAI client using the currently-active api_key to avoid stale-token 401s after refresh.
packages/kosong/tests/test_kimi_stale_api_key.py	Adds regression + E2E tests to confirm the rebuilt client sends the refreshed Bearer token.
CHANGELOG.md	Documents the user-visible fix in the root Unreleased changelog.
packages/kosong/CHANGELOG.md	Records the provider-specific fix in the Kosong package changelog.
docs/en/release-notes/changelog.md	Updates the English docs changelog entry (but this file is generated).
docs/zh/release-notes/changelog.md	Adds the corresponding Chinese release note entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

docs/en/release-notes/changelog.md is auto-generated from the root CHANGELOG.md via docs/scripts/sync-changelog.mjs (see docs/AGENTS.md). To avoid the doc page drifting, please regenerate it with npm run sync / make gen-docs rather than editing this file directly (and ensure the committed output matches the root changelog).

[ayokaa]

@copilot apply changes based on this feedback

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[wbxl2000]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".