[rdself]

Summary

• fix the background token healthcheck to pass the resolved proxy payload, not the proxy-resolution metadata wrapper, into token refresh
• add a regression test that exercises token refresh through a resolved account proxy during healthcheck execution
• keep the existing manual refresh and request-time refresh paths unchanged

Problem

Users could see Codex accounts marked as refresh failed on the provider page even though the account still worked in practice.

The concrete failure pattern was:

• the background healthcheck logged Refreshing codex/... (interval: 60min)
• token refresh then failed with [ProxyDispatcher] Context proxy host is required
• the provider page showed a failed refresh state
• manual token refresh still succeeded
• direct Codex model calls also succeeded

That made the failure look like a broken Codex OAuth refresh flow, but the issue was isolated to the scheduled healthcheck path.

Root Cause

resolveProxyForConnection() returns a structured object like { proxy, level, levelId, ... }.

The healthcheck code forwarded that wrapper object directly into the token refresh pipeline. The proxy dispatcher expects the raw proxy config itself, so the background refresh path could fail before the upstream token request was even attempted.

Manual refresh and request-time execution did not hit this bug because they resolve and pass a plain provider proxy object.

What Changed

• unwrap the resolved proxy result before calling getAccessToken() from token healthcheck
• export the minimal helper needed to verify that unwrapping behavior in tests
• add a regression test with a local CONNECT proxy and token endpoint to prove the healthcheck refresh path succeeds when a connection-level proxy is configured

Impact

• background Codex healthchecks no longer report false refresh failures caused by proxy wrapper objects
• the provider page should stop showing a failed refresh state for accounts that are otherwise healthy
• other OAuth providers using the same healthcheck refresh path benefit from the same fix

Validation

• node --import tsx/esm --test tests/unit/token-health-check.test.mjs
• node --import tsx/esm --test tests/unit/token-refresh-service.test.mjs
• node --import tsx/esm --test tests/unit/token-refresh-route-service.test.mjs
• npx eslint src/lib/tokenHealthCheck.ts tests/unit/token-health-check.test.mjs
• repository pre-push unit suite triggered by git push

[gemini-code-assist]

Code Review

This pull request introduces the extractResolvedProxyConfig utility to handle proxy configuration metadata and updates checkConnection to utilize it during token refreshes. Additionally, the test suite is expanded with helpers and new test cases to verify proxy-aware connection checks. Feedback was provided to explicitly type the conn parameter in checkConnection to improve type safety in the TypeScript codebase.

[gemini-code-assist]

The conn parameter is implicitly typed as any. Since this is a TypeScript file and the function is now exported for use in tests, it should have a proper type definition to ensure type safety and improve maintainability. Consider defining an interface for the connection object or using a more specific type than the implicit any.

Suggested change

	export async function checkConnection(conn) {
	export async function checkConnection(conn: any) {

[Copilot]

Pull request overview

This PR fixes false OAuth token refresh failures during the background token healthcheck by ensuring the healthcheck passes the resolved proxy payload (not the proxy-resolution metadata wrapper) into the token refresh pipeline.

Changes:

• Unwrap resolveProxyForConnection() results before calling getAccessToken() in the scheduled healthcheck path.
• Export small helpers (extractResolvedProxyConfig, checkConnection) to make the proxy-unwrapping behavior directly testable.
• Add a regression test that refreshes via a resolved connection-level HTTP CONNECT proxy and verifies the token refresh succeeds.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tests/unit/token-health-check.test.mjs	Adds regression coverage validating healthcheck refresh succeeds when a connection proxy is configured and proxy resolution returns wrapper metadata.
src/lib/tokenHealthCheck.ts	Unwraps proxy resolution wrapper before token refresh; exports helper(s) needed for direct unit testing of the healthcheck refresh path.