fix(auth): exclude local CLI providers from tokenHealthCheck expiration (Fixes #8407) by MumuTW · Pull Request #8426 · cheaper-inference/OmniRoute

MumuTW · 2026-07-24T12:57:41Z

Summary

devin-cli is a local import-token / CLI-owned provider (devin auth login). It never carries a refresh token, but it was listed in supportsTokenRefresh()'s explicitlySupported set. That made the token health sweep treat it as refresh-capable and write terminal testStatus="expired" / errorCode="no_refresh_token", after which routing failed with No active credentials for provider: devin-cli.

Changes

Root fix — remove "devin-cli" from explicitlySupported in open-sse/services/tokenRefresh.ts (keep windsurf). The existing supportsTokenRefresh=false guard in tokenHealthCheck then skips the expiry write.
No provider hardcode in tokenHealthCheck — one source of truth is enough.
Unit tests — assert supportsTokenRefresh("devin-cli") === false, and that checkConnection leaves a no-refresh-token devin-cli connection active.

Test plan

node --import tsx --test tests/unit/token-health-check-devin-cli-8407.test.ts → 2/2 pass
Manual: add Devin CLI provider → wait for health sweep → connection stays active / routable

…aper-inference#8407) Root cause: listing "devin-cli" as refresh-capable made tokenHealthCheck force-expire local CLI connections that never have a refresh token. Remove it from the explicit set (keep windsurf) and drop the health-check provider hardcode — the existing supportsTokenRefresh=false guard is enough.

MumuTW · 2026-07-24T17:31:00Z

Follow-up push (d0f15f8): switched to the clean root fix.

Removed devin-cli from explicitlySupported in tokenRefresh.ts
Removed the authenticatesViaLocalCli hardcode from tokenHealthCheck.ts (redundant once supportsTokenRefresh is false)
Tests 2/2 pass locally

Ready for review.

diegosouzapw · 2026-07-25T03:31:23Z

Thanks for the clean fix and for following up with the root-cause version after the discussion on #8407 — this matches the approach we confirmed there (drop devin-cli from supportsTokenRefresh()'s explicit set so the existing supportsTokenRefresh=false guard in tokenHealthCheck handles it, no per-provider hardcode). Verified locally: both new tests pass, lint is clean, and the two commits net out to exactly that single-source-of-truth change with no leftover hardcode.

One thing we noticed while reviewing: windsurf shares the same import-token mapTokens() (which always returns refreshToken: null) as devin-cli, and is still listed in explicitlySupported — so a fresh windsurf connection today hits the identical force-expired bug. That's outside the scope of this PR (and not something you introduced), so we're not asking you to change anything here — we'll track it as a separate follow-up. Merging this as-is.

diegosouzapw · 2026-07-25T05:54:10Z

Merged into release/v3.8.49 — thanks @MumuTW! Validated via a 26-PR local merge-train + per-file discriminator confirming zero regressions vs the pure release tip. 🙏

… to fit frozen file-size baseline The 3-line comment added by cheaper-inference#8426 pushed tokenHealthCheck.ts to 843 LOC, 2 over its frozen baseline of 841 (base-red on release/v3.8.49). Fold the devin-cli rationale into one line — same meaning, gate green again.

check:file-size fails on the pristine release/v3.8.49 tip (3070925), which takes the whole Fast Quality Gates job down for every PR against the branch. Both offenders grew after the last rebaseline (_rebaseline_2026_07_25_v3849_basered_filesize, measured at 36f8fd1) and both came from already-merged PRs, so there is no offending branch left to fix: src/lib/tokenHealthCheck.ts 841 -> 843 (cheaper-inference#8426, 4528fc4) src/app/(dashboard)/dashboard/providers/page.tsx 1927 -> 1990 (cheaper-inference#8349, 58ab8b1) Trust-but-verify: both values measured on the pristine tip with an empty working tree. Same situation and remedy as the entry cited above and as _rebaseline_2026_07_02_5798_release_green. This commit is deliberately last and self-contained: drop it if the captain would rather move the frozen values separately. Structural reduction of the 1990-line providers page is not attempted here. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

check:file-size fails on the pristine release/v3.8.49 tip (3070925), which takes the whole Fast Quality Gates job down for every PR against the branch. Both offenders grew after the last rebaseline (_rebaseline_2026_07_25_v3849_basered_filesize, measured at 36f8fd1) and both came from already-merged PRs, so there is no offending branch left to fix: src/lib/tokenHealthCheck.ts 841 -> 843 (#8426, 4528fc4) src/app/(dashboard)/dashboard/providers/page.tsx 1927 -> 1990 (#8349, 58ab8b1) Trust-but-verify: both values measured on the pristine tip with an empty working tree. Same situation and remedy as the entry cited above and as _rebaseline_2026_07_02_5798_release_green. This commit is deliberately last and self-contained: drop it if the captain would rather move the frozen values separately. Structural reduction of the 1990-line providers page is not attempted here. Co-authored-by: alexey.nazarov@softmg.ru <alexey.nazarov@softmg.ru> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…card highlight wiring (#8524) * chore(auth): condense #8407 note in tokenHealthCheck to fit frozen file-size baseline The 3-line comment added by #8426 pushed tokenHealthCheck.ts to 843 LOC, 2 over its frozen baseline of 841 (base-red on release/v3.8.49). Fold the devin-cli rationale into one line — same meaning, gate green again. * refactor(dashboard): extract provider card highlight into HighlightableProviderCard #8349 left the back-navigation highlight concern inline in providers/page.tsx (state + two callbacks + onCardClick/ref props repeated at 18 card call sites), pushing the page to 1990 LOC over its frozen baseline of 1927. Move the concern into a HighlightableProviderCard wrapper: each card instance keeps its own copy of the highlighted id and only the card whose provider id matches scrolls into view and highlights — same semantics as the single page-level state, since resolveHighlightedCard already gates on the id match. page.tsx drops to 1917 LOC (under the frozen baseline, no rebaseline needed). * test(dashboard): cover HighlightableProviderCard wiring Direct coverage for the wrapper extracted in the previous refactor: mount-time scroll+highlight only when history.state.providerId matches, no reaction on mismatch/null state, isolation across multiple card instances, and click-time navigation recording via history.replaceState. Note: the jsdom scrollIntoView shim is a plain no-op rather than a vi.fn() — vi.restoreAllMocks() would otherwise restore the shared mock and let the next test's spy inherit its accumulated call count.

…on (Fixes cheaper-inference#8407) (cheaper-inference#8426) * fix(providers): prevent health sweep from expiring devin-cli local credentials * fix(auth): drop devin-cli from supportsTokenRefresh explicit set (cheaper-inference#8407) Root cause: listing "devin-cli" as refresh-capable made tokenHealthCheck force-expire local CLI connections that never have a refresh token. Remove it from the explicit set (keep windsurf) and drop the health-check provider hardcode — the existing supportsTokenRefresh=false guard is enough.

…er-inference#8561) check:file-size fails on the pristine release/v3.8.49 tip (df69bd1), which takes the whole Fast Quality Gates job down for every PR against the branch. Both offenders grew after the last rebaseline (_rebaseline_2026_07_25_v3849_basered_filesize, measured at d61504d) and both came from already-merged PRs, so there is no offending branch left to fix: src/lib/tokenHealthCheck.ts 841 -> 843 (cheaper-inference#8426, 903ecfa) src/app/(dashboard)/dashboard/providers/page.tsx 1927 -> 1990 (cheaper-inference#8349, e62c217) Trust-but-verify: both values measured on the pristine tip with an empty working tree. Same situation and remedy as the entry cited above and as _rebaseline_2026_07_02_5798_release_green. This commit is deliberately last and self-contained: drop it if the captain would rather move the frozen values separately. Structural reduction of the 1990-line providers page is not attempted here. Co-authored-by: alexey.nazarov@softmg.ru <alexey.nazarov@softmg.ru> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…card highlight wiring (cheaper-inference#8524) * chore(auth): condense cheaper-inference#8407 note in tokenHealthCheck to fit frozen file-size baseline The 3-line comment added by cheaper-inference#8426 pushed tokenHealthCheck.ts to 843 LOC, 2 over its frozen baseline of 841 (base-red on release/v3.8.49). Fold the devin-cli rationale into one line — same meaning, gate green again. * refactor(dashboard): extract provider card highlight into HighlightableProviderCard cheaper-inference#8349 left the back-navigation highlight concern inline in providers/page.tsx (state + two callbacks + onCardClick/ref props repeated at 18 card call sites), pushing the page to 1990 LOC over its frozen baseline of 1927. Move the concern into a HighlightableProviderCard wrapper: each card instance keeps its own copy of the highlighted id and only the card whose provider id matches scrolls into view and highlights — same semantics as the single page-level state, since resolveHighlightedCard already gates on the id match. page.tsx drops to 1917 LOC (under the frozen baseline, no rebaseline needed). * test(dashboard): cover HighlightableProviderCard wiring Direct coverage for the wrapper extracted in the previous refactor: mount-time scroll+highlight only when history.state.providerId matches, no reaction on mismatch/null state, isolation across multiple card instances, and click-time navigation recording via history.replaceState. Note: the jsdom scrollIntoView shim is a plain no-op rather than a vi.fn() — vi.restoreAllMocks() would otherwise restore the shared mock and let the next test's spy inherit its accumulated call count.

…on (Fixes cheaper-inference#8407) (cheaper-inference#8426) * fix(providers): prevent health sweep from expiring devin-cli local credentials * fix(auth): drop devin-cli from supportsTokenRefresh explicit set (cheaper-inference#8407) Root cause: listing "devin-cli" as refresh-capable made tokenHealthCheck force-expire local CLI connections that never have a refresh token. Remove it from the explicit set (keep windsurf) and drop the health-check provider hardcode — the existing supportsTokenRefresh=false guard is enough.

…er-inference#8561) check:file-size fails on the pristine release/v3.8.49 tip (400757e), which takes the whole Fast Quality Gates job down for every PR against the branch. Both offenders grew after the last rebaseline (_rebaseline_2026_07_25_v3849_basered_filesize, measured at 75eb952) and both came from already-merged PRs, so there is no offending branch left to fix: src/lib/tokenHealthCheck.ts 841 -> 843 (cheaper-inference#8426, 35b6719) src/app/(dashboard)/dashboard/providers/page.tsx 1927 -> 1990 (cheaper-inference#8349, 17aed5f) Trust-but-verify: both values measured on the pristine tip with an empty working tree. Same situation and remedy as the entry cited above and as _rebaseline_2026_07_02_5798_release_green. This commit is deliberately last and self-contained: drop it if the captain would rather move the frozen values separately. Structural reduction of the 1990-line providers page is not attempted here. Co-authored-by: alexey.nazarov@softmg.ru <alexey.nazarov@softmg.ru> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…card highlight wiring (cheaper-inference#8524) * chore(auth): condense cheaper-inference#8407 note in tokenHealthCheck to fit frozen file-size baseline The 3-line comment added by cheaper-inference#8426 pushed tokenHealthCheck.ts to 843 LOC, 2 over its frozen baseline of 841 (base-red on release/v3.8.49). Fold the devin-cli rationale into one line — same meaning, gate green again. * refactor(dashboard): extract provider card highlight into HighlightableProviderCard cheaper-inference#8349 left the back-navigation highlight concern inline in providers/page.tsx (state + two callbacks + onCardClick/ref props repeated at 18 card call sites), pushing the page to 1990 LOC over its frozen baseline of 1927. Move the concern into a HighlightableProviderCard wrapper: each card instance keeps its own copy of the highlighted id and only the card whose provider id matches scrolls into view and highlights — same semantics as the single page-level state, since resolveHighlightedCard already gates on the id match. page.tsx drops to 1917 LOC (under the frozen baseline, no rebaseline needed). * test(dashboard): cover HighlightableProviderCard wiring Direct coverage for the wrapper extracted in the previous refactor: mount-time scroll+highlight only when history.state.providerId matches, no reaction on mismatch/null state, isolation across multiple card instances, and click-time navigation recording via history.replaceState. Note: the jsdom scrollIntoView shim is a plain no-op rather than a vi.fn() — vi.restoreAllMocks() would otherwise restore the shared mock and let the next test's spy inherit its accumulated call count.

fix(providers): prevent health sweep from expiring devin-cli local cr…

4c47cd9

…edentials

MumuTW requested a review from diegosouzapw as a code owner July 24, 2026 12:57

MumuTW mentioned this pull request Jul 24, 2026

fix(providers): token health-check marks local-CLI providers expired every sweep, making devin-cli unroutable within 60s #8407

Closed

This was referenced Jul 24, 2026

fix(providers): devin-cli and agy missing from OAUTH_TEST_CONFIG — healthy accounts persisted as errored (same gap as #7610) #8408

Closed

fix(providers): add devin-cli and agy to oauthTestConfig (Fixes #8408) #8427

Merged

diegosouzapw merged commit 4528fc4 into cheaper-inference:release/v3.8.49 Jul 25, 2026
3 checks passed

MumuTW mentioned this pull request Jul 25, 2026

fix(ci): base-red compounds because fast-gates fail-fast hides later gates, and PRs land while red #8542

Closed

This was referenced Jul 25, 2026

fix(quality): repair release/v3.8.49 base-red gates #8561

Merged

fix(api): enforce image generation API key auth #8306

Merged

diegosouzapw mentioned this pull request Jul 28, 2026

Release v3.8.49 #7076

Merged

maxmad64bis mentioned this pull request Aug 21, 2026

[Feature] Carry the origin on terminal writes — probe vs production, transient vs terminal #11006

Closed

MumuTW deleted the fix/health-check-local-cli-providers branch September 5, 2026 10:19

aldoeliacim mentioned this pull request Sep 20, 2026

fix(auth): working Claude setup-token connections are marked expired/no_refresh_token every sweep #14261

Closed

Navigation Menu

Repository navigation

fix(auth): exclude local CLI providers from tokenHealthCheck expiration (Fixes #8407) - #8426

fix(auth): exclude local CLI providers from tokenHealthCheck expiration (Fixes #8407)#8426
diegosouzapw merged 2 commits into
cheaper-inference:release/v3.8.49from
MumuTW:fix/health-check-local-cli-providers

MumuTW commented Jul 24, 2026 •

edited

Loading

Uh oh!

MumuTW commented Jul 24, 2026

Uh oh!

diegosouzapw commented Jul 25, 2026

Uh oh!

Uh oh!

diegosouzapw commented Jul 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

MumuTW commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Related

Uh oh!

MumuTW commented Jul 24, 2026

Uh oh!

diegosouzapw commented Jul 25, 2026

Uh oh!

Uh oh!

diegosouzapw commented Jul 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MumuTW commented Jul 24, 2026 •

edited

Loading